Free Email Health Check

01 · Definition

What is email health check?

An email health check audits the technical foundation of your sending domain — MX records, SPF, DKIM, DMARC, BIMI, MTA-STS, TLS-RPT, CAA and reputation — and returns a single score with the specific records to fix. It is the fastest way to catch authentication gaps before they show up as inbox-placement failures.

The tool above runs the audit live: enter a domain or email address, pick the DKIM scope, and it scores nine signal groups, weights them into a single percentage, and surfaces every red flag with the record that needs to change. Treat it as a one-click email deliverability test for any sending domain you control. Read the in-depth email health check guide for what each score means and the rollout playbook for fixing the failures.

02 · Process

How it works

1. 1Enter a domain or email.Submit example.com or noreply@example.com — both resolve to the same domain root, which is what every check below is keyed on.
2. 2Resolve every authentication record.Query MX, SPF (with full include: expansion), DMARC, DKIM (popular selectors in quick mode, a wider sweep in full mode), BIMI, MTA-STS policy file, TLS-RPT and CAA — the nine signals modern receivers grade you on.
3. 3Score each signal group.Each bucket has its own maximum score weighted by how strongly it influences inbox placement; SPF and DKIM dominate, MTA-STS and CAA fill in the long tail.
4. 4Roll up the percentage.Sum obtained vs maximum across applicable buckets and return a single score 0–100 — anything below 80 has at least one fix worth making before the next campaign.
5. 5Surface the actionable items.Every failed check returns the record value, the failure reason, and the fix to apply — pull it into a remediation ticket without hand-reading raw DNS output.

03 · Risk

Why it matters

Email authentication is the foundation of inbox placement, but its components fail silently. SPF passes today, then a vendor change pushes the lookup count over ten and SPF starts to permerror everywhere. DMARC reports go to a parsed-out address that nobody reads. DKIM rotates, the new selector is missing, and signature checks fail. The first signal you usually get is a deliverability complaint from sales — by which time the reputation damage is already done.

For regulated firms, an unauthenticated message is not just a deliverability problem — it is an audit-trail problem. Mailbox providers downgrade unauthenticated mail to spam, the customer never sees it, and the firm has no record of what was actually delivered. A regular email health check turns silent failure modes into something an oncall engineer can act on the same week.

04 · Use cases

Common ways to use this tool

• Quarterly compliance audit. Run the check across every sending domain on the first business day of each quarter and file the score against the marketing-comms compliance log.
• Vendor onboarding. Before authorising a new ESP, transactional provider, or marketing-automation platform to send for your domain, run the health check — most vendor changes break SPF or DKIM first.
• Pre-campaign deliverability triage. When a marketer reports inbox placement dropping on one ISP, run the check and compare against the last green snapshot — drift in DMARC alignment is the most common silent cause.
• M&A migration sign-off. After consolidating sending infrastructure post-merger, the health check is the cleanest pass/fail gate before flipping production traffic to the new domain.
• Incident-response evidence. When a phishing campaign claims to come from your domain, the health check captures the authentication state at a point in time — useful as evidence in regulator filings or law-enforcement referrals.

05 · Interpretation

What to check in the result

Read the result in priority order — the cheapest fixes give the largest score lifts:

• Final percentage and missing checks. If dataCompleteness is below 100%, your score has gaps. Fill the missing checks first — incomplete data masks risk.
• SPF lookup count. RFC 7208 caps SPF at 10 DNS lookups. Anywhere near the cap, trim or flatten an include: chain before it permerrors.
• DMARC policy direction. p=none is monitoring only — receivers ignore alignment failures. Production sending domains should be on p=quarantine or p=reject once you trust your sender list.
• DKIM selector coverage. Quick mode tests popular selectors. If your selectors are custom, switch to full mode and confirm the records the tool detected match what your provider actually signs with.
• Domain blacklist status. A blacklisted domain or its mail-server IP is the first thing a receiver checks. One listing is recoverable; multiple listings need urgent investigation.
• MTA-STS and TLS-RPT presence. Both are nice-to-have for general business but increasingly mandatory for finance — receivers like Google, Microsoft and Apple use them to enforce TLS for inbound mail.