DeliverSight Run a free test

Domain checker

Check a domain's email setup

Run MX, SPF, DMARC, and DKIM in one pass and get the whole picture — what's configured, what's missing, and what to fix before you send.

This check runs MX, SPF, DKIM and DMARC against one domain in a single pass and reports each independently. It answers whether the domain can receive mail, whether it tells receivers who may send as it, and whether it has a policy for mail that fails — the records behind most deliverability problems.

How to read your result

Each cell is one record type with its own status, and each links through to the dedicated checker for the same domain so you can see the detail. The four are independent: three green cells and one red is a real and common state, not a contradiction.

What a green cell does not mean

Present and parseable is not the same as correct. SPF can exist, resolve and still authorize the wrong senders. DMARC can exist and be set to p=none, which protects nothing. A DKIM key can be published at a selector your provider stopped using last year.

This page tells you what is configured. Whether it is configured well is the question each individual checker answers, which is why the cells link through rather than summarising.

Fix them in this order

The records depend on each other, and doing them out of order creates work.

  • MX first, if the domain is meant to receive mail at all. Nothing else matters if delivery inbound is broken.
  • SPF and DKIM next, together. These are what DMARC evaluates, so a DMARC policy written before they are right will reject your own mail.
  • DMARC at p=none with a reporting address, then read the reports for a few weeks. This is the step people skip and the one that makes the rest safe.
  • Tighten DMARC to quarantine and then reject, once the reports show only senders you recognise.
  • BIMI last, if you want it. It requires enforcement to already be in place.

The patterns this check usually surfaces

MX present, everything else missing

The domain receives mail because someone set up a mailbox, and no one ever configured sending authentication. Extremely common on domains that have never run a campaign. It also means the domain is trivially spoofable.

SPF and DKIM fine, DMARC at p=none

The most common state on domains that have had some attention. Authentication works, and nothing acts on the result. The fix is not technical — it is reading reports and then raising the policy.

SPF over the lookup limit

Arrives by accretion as vendors are added, and produces a permerror that most receivers treat as a failure. The SPF checker counts the lookups; this page will only tell you something is wrong.

DKIM found only at an unused selector

A key exists, so the cell looks healthy, but the sending platform now signs with a different selector. The only way to confirm which selector is live is to read the DKIM-Signature header of a real message.

A record check is not a deliverability test

Everything here is DNS, and DNS is roughly half the picture. Content, sending reputation, blocklist status, list hygiene and message structure all affect whether mail reaches an inbox, and none of them are visible in a record lookup. A domain can pass every check on this page and still land in spam.

Related checks