Every email check, in one place.

Looks up your domain's SPF record and validates it against RFC 7208.

Lists which mail servers are allowed to send for your domain. Without it, anyone can forge a message that looks like it's from you.

Looks up your domain's DKIM selector and verifies the signing key is published and valid.

A cryptographic signature on outgoing mail that proves it actually came from your domain and wasn't altered in transit.

Looks up your domain's DMARC record and evaluates its policy, alignment, and enforcement percentage.

Tells inboxes what to do with mail that fails SPF or DKIM — quarantine it, reject it, or let it through — and where to send reports.

Queries the Spamhaus Domain Block List for your domain.

Checks whether your sending domain or IP has been flagged by major spam blocklists, which can silently tank your deliverability.

Checks whether your domain's root resolves over IPv6 (an AAAA record).

Not required for email deliverability today, but IPv6-only networks are a growing share of the internet.

Builds a correct DMARC TXT record from your chosen policy and report address.

Answer two questions, get a correct DMARC record to paste — no account needed.

Builds a correct SPF TXT record from the senders you select, with a live DNS-lookup tally.

Pick who sends your mail, get a correct SPF record — with a live DNS-lookup tally as you add senders.

Generates a real RSA-2048 key pair in your browser via the Web Crypto API.

The public half becomes a DKIM record to publish, the private half is yours to install — nothing is sent to our servers.

Builds a correct TLS-RPT TXT record from your report email address.

One field, one correct TLS-RPT record — reports on encryption-in-transit failures mailbox providers see.

Builds the MTA-STS TXT record and policy file from your enforcement mode and mail servers.

Pick your enforcement mode and mail servers, get the exact DNS record and policy file to publish.

Builds a BIMI TXT record from your logo URL and optional VMC.

Add your logo (and VMC, if you have one), get a correct BIMI record — once DMARC is enforced.

Walks every mechanism in your SPF record and counts the DNS lookups each one uses.

SPF caps you at 10 DNS lookups. See exactly what's using them up, sorted worst-first.

Looks up nameservers, A, AAAA, MX, and TXT records, plus mail redundancy and reverse DNS.

Nameservers, A, AAAA, MX, and TXT records in one place — plus mail redundancy and reverse DNS.

Parses a pasted email's raw headers for its Authentication-Results and Received chain.

Paste a message's raw headers to see its SPF/DKIM/DMARC verdicts and delivery path in plain English.

Generates typo, transposition, and homoglyph variants of your domain, then checks which ones resolve.

Checks typo and homoglyph variations of your domain to see which ones are live right now.