Free tool
Email server & DNS test
Check every DNS record that decides whether your mail reaches the inbox — MX, SPF, DKIM, DMARC, MTA-STS, TLS-RPT, BIMI and reverse DNS — scored out of 100 with a prioritised fix list.
- No signup required
- Results in seconds
- DNS only — we never connect to your mail server
Free for everyone, 10 tests an hour. Results are shareable — the link updates with the domain you tested.
Try it with a domain you send from, or with github.com to see what a full report looks like.
What we check
Nine checks, weighted by what actually moves delivery
Each check expands to show the raw records we read, so you can hand the output straight to whoever runs your DNS.
MX records
20 ptsDo you publish mail servers, are they sorted sensibly by priority, do they resolve to real addresses, and is there a fallback?
SPF
20 ptsExactly one v=spf1 record, inside the ten-lookup limit, ending in a policy that actually means something.
DMARC
25 ptsYour policy, the percentage it applies to, alignment mode, and whether anybody is collecting the aggregate reports.
DKIM
15 ptsNineteen common selectors probed, with the key type and length reported for every key we find.
Reverse DNS
10 ptsForward-confirmed reverse DNS on your primary mail server — the PTR test receivers really run.
MTA-STS
5 ptsThe TXT record and the policy file itself, fetched and parsed to confirm mode, mx patterns and max_age.
TLS-RPT
5 ptsWhether providers have somewhere to send their daily TLS failure reports.
DNS basics
ContextName server delegation and apex resolution — the ground everything else stands on.
BIMI
ContextYour logo record, reported for information. BIMI needs DMARC at quarantine or reject before it renders.
FAQ
Questions about the test
What does the email server test check?
It reads every DNS record a mailbox provider looks at before it decides what to do with your mail: MX records and whether they resolve, your SPF record and its DNS lookup count, your DMARC policy, DKIM keys on the common selectors, MTA-STS, TLS-RPT, BIMI, your name server delegation, and forward-confirmed reverse DNS on your primary mail server.
Do you connect to my mail server?
No. Every check is a DNS query, plus one HTTPS request for the MTA-STS policy file when that record exists. We never open an SMTP connection and never send a test message, so running the test cannot affect your mail flow or your reputation.
Why does DKIM show as informational instead of a pass or a fail?
DKIM selectors cannot be enumerated from DNS — there is no record that lists them. We probe the selectors the major providers use, so finding nothing means we did not guess your selector, not that your mail is unsigned. To find yours, open a message you sent and read the s= value from its DKIM-Signature header.
How is the score calculated?
Out of 100, weighted by how much each control affects delivery: DMARC 25, MX 20, SPF 20, DKIM 15, reverse DNS 10, MTA-STS 5 and TLS-RPT 5. A warning scores roughly half of its weight. 90 and above is an A, 80 a B, 70 a C, 60 a D, and anything lower an F.
Is the test free?
Yes. The public tool runs up to 10 tests an hour per IP address with no account. A free InboxVet account removes that limit, keeps a history of every run for your workspace so you can see the score move, and adds blocklist and DMARC monitoring.
My SPF record has too many DNS lookups. What now?
RFC 7208 allows ten DNS-querying mechanisms — include, a, mx, ptr, exists and redirect. Past that, receivers return a permanent error and SPF fails for every message. Remove senders you no longer use, replace an include with the ip4 and ip6 ranges behind it, or use an SPF flattening service.
Keep it fixed
One test tells you where you stand. Monitoring tells you when it breaks.
A free InboxVet workspace keeps every run's score so you can watch it improve, and DMARC monitoring turns the aggregate reports receivers already send into something you can read.