Free · live registry data · no login

Email DNS Health Check

MX, SPF, DKIM and DMARC graded in one report.

How it works

Email DNS health check: MX, SPF, DKIM and DMARC graded in one report

One domain, four live DNS checks, one score. We fetch MX records and resolve each server, parse your SPF record and count its lookups, scan nine common DKIM selectors for published keys, and grade your DMARC policy and reporting. Each area gets a mark out of 25 and the flags tell you precisely which record to add or change first. Ideal before a launch, after switching email providers, or when mail suddenly starts landing in spam.

Results appear here after you click Run health check.

How this works

1
Four parallel DNS checks
MX, SPF, DMARC and nine DKIM selectors are queried at the same time over DNS-over-HTTPS.
2
Grade each area
Each record type scores up to 25 based on presence, validity and policy strength.
3
Prioritise the fix
Findings are ordered so the first item on the list is the change with the biggest deliverability impact.

Frequently asked questions

What is a good email DNS health score?: 90 or above means MX, SPF, DKIM and DMARC are all present and well configured. 70–89 usually means DMARC is still in monitor mode or SPF needs tightening. Below 40, a core record is missing.
Why is DKIM scored as missing when my provider says it is on?: We can only scan common selectors (default, google, selector1, selector2, k1, mail, dkim, s1, s2). If your provider uses a unique selector, run the DKIM Checker with that selector; your real setup may be fine.
Which record matters most for deliverability?: DKIM and DMARC together. SPF breaks on forwarding, but DKIM survives it, and DMARC tells receivers to trust aligned, authenticated mail. Gmail and Yahoo require all three for bulk senders.
How often should I run this check?: After any change to email providers, marketing tools or DNS hosting, and at least once a quarter. Provider includes change and keys get rotated, so a passing setup can silently degrade.
My score is high but mail still goes to spam. Why?: Authentication is necessary but not sufficient. Reputation, content, list quality and sending volume on a new domain all matter. Check the Blacklist Checker and read our domain warm-up guide.

Every MailShrine domain includes WHOIS privacy, transfer lock, Anycast DNS with DNSSEC and two business mailboxes.