SysAdmin Tools

An email health checker analyses everything that affects whether your emails reach the inbox — or end up in spam. Unlike individual lookup tools that return raw DNS records, this tool combines five critical checks into a single plain-English verdict: MX records, SPF, DKIM, DMARC, and blacklist status.

Every email you send passes through a gauntlet of authentication checks before it reaches its destination. The receiving mail server first confirms your domain has MX records to prove it can send and receive mail, then verifies SPF to confirm your sending server is authorised, validates the DKIM signature to prove the message has not been tampered with, and checks DMARC to determine what should happen if authentication fails. On top of all that, your mail server's IP address is cross-referenced against seven global spam blacklists maintained by organisations like Spamhaus, SpamCop, and Barracuda.

A gap in any one of these layers can cause legitimate email to land in spam, get rejected outright, or leave your domain open to spoofing and phishing. This free email deliverability checker runs all five checks simultaneously and delivers a clear verdict — Healthy, Warning, or Critical — along with a detailed breakdown so you know exactly what needs fixing, why it matters, and where to start. Whether you're asking why are my emails going to spam or auditing a client's domain, this is the only check you need to run first.

How to Use the Email Health Checker

  1. 1

    Enter your domain name

    Type the domain you want to audit — for example, yourbusiness.com. You do not need the full email address, just the domain. The tool strips http://, www., and any path automatically.

  2. 2

    Click "Check Email Health"

    The tool simultaneously queries MX records, SPF and DMARC TXT records, DKIM public keys across common selectors, and resolves your mail server IP against seven blacklists. This typically completes in under 10 seconds.

  3. 3

    Read your verdict

    You will receive a Healthy (green), Warning (yellow), or Critical (red) verdict with a plain-English explanation of the most significant issue found. A summary row shows the pass/fail status of each individual check at a glance.

  4. 4

    Expand the breakdown for specifics

    Each of the five checks has its own expandable section showing the raw DNS record, status badge, and plain-language explanation. If there is an issue, the section explains exactly what it means and links to the relevant individual lookup tool for deeper inspection.

Understanding Your Email Health Verdict

The verdict reflects the most severe issue found across all five checks, evaluated in priority order. A Healthy verdict means MX records exist, SPF authorises your sending servers, a DKIM key was found, DMARC is configured (even if set to "none"), and your mail server IP is not on any checked blacklist. This is the ideal baseline — though it does not guarantee inbox placement, as content filtering, sender reputation, and engagement history also play a role. A Warning verdict means one or more authentication layers are missing. Missing SPF means any server can send email pretending to be from your domain. Missing DKIM means emails cannot be cryptographically signed. Missing DMARC means there is no enforcement policy tying SPF and DKIM to the visible From: header — even a domain with SPF and DKIM configured can be spoofed in the From: header without DMARC. A Critical verdict means either your domain has no MX records at all (it cannot send or receive email) or your mail server IP is listed on one or more spam blacklists. Blacklisting causes most receiving servers to reject or silently discard your messages regardless of how well your DNS authentication is configured.
FieldDescription
MX RecordsMail Exchange records identify which servers handle email for your domain. Without MX records, no email can be delivered to or sent from the domain.
SPFSender Policy Framework — a TXT record listing which servers are authorised to send email from your domain. Prevents spoofing of the envelope sender address.
DKIMDomainKeys Identified Mail — a TXT record containing a public key used to verify a cryptographic signature added to each outgoing email by your mail server.
DMARCDomain-based Message Authentication, Reporting and Conformance — a TXT record that ties SPF and DKIM results to the visible From: header and specifies what to do when authentication fails (none, quarantine, or reject).
Blacklist (DNSBL)DNS-based Blackhole List — a database of IP addresses known to send spam. Checked by receiving mail servers to decide whether to accept, quarantine, or reject incoming messages.

Advertisement

When to Run an Email Health Check

Diagnosing why emails land in spam

If recipients are finding your messages in junk folders, a missing or misconfigured SPF, DKIM, or DMARC record is the most common cause. This tool identifies the exact missing layer within seconds so you can fix the root problem rather than guessing.

Auditing email setup after a domain migration

Moving to a new hosting provider, email platform, or registrar frequently breaks DNS records. Run this check immediately after a migration to confirm all five layers — MX, SPF, DKIM, DMARC, and blacklist status — are intact on the new configuration.

Checking a new domain before sending campaigns

Before launching email marketing from a brand-new domain, verify that all authentication is in place. Sending campaigns without SPF, DKIM, and DMARC established results in high spam rates that damage your sender reputation before it is even built.

Verifying email security for a client engagement

Freelancers, agencies, and IT consultants can use this tool as a fast first-pass audit for any client domain. The colour-coded verdict and detailed breakdown provide an instant talking point and a clear prioritised remediation list.

Confirming blacklist removal after a spam incident

After a server compromise, a misconfigured bulk-send, or a hijacked account, mail server IPs frequently end up on blacklists. Use this tool to confirm removal from each DNSBL after submitting delisting requests, rather than waiting for email delivery to recover on its own.

Email Health Checker — Frequently Asked Questions

What is an email health checker?
An email health checker is a diagnostic tool that audits the DNS configuration of a domain to assess its email deliverability and security. It checks MX records (can the domain receive mail), SPF (which servers are authorised to send), DKIM (are emails cryptographically signed), DMARC (is there an enforcement policy), and blacklist status (is the mail server IP flagged as a spam source). The result is a single verdict — Healthy, Warning, or Critical — with a plain-English explanation of any issues found.
Why are my emails going to spam?
The most common reasons emails land in spam are: a missing or incorrect SPF record (the receiving server cannot confirm your server is authorised to send), missing DKIM (messages lack a cryptographic signature that proves authenticity), missing DMARC (no policy to handle emails that fail authentication), or a blacklisted mail server IP (your IP has been flagged for sending spam in the past). Content triggers, sending to purchased lists, and poor sender reputation are also contributing factors, but DNS authentication gaps are the fastest to diagnose and fix.
What does it mean if my domain has no SPF record?
If your domain has no SPF record, any mail server in the world can send email with your domain in the sender address and there is no DNS-level mechanism to stop it. Receiving servers that check SPF will see no record and typically apply a "neutral" result, which means the message is more likely to be treated with suspicion. Many modern spam filters treat a missing SPF record as a negative signal. You should publish an SPF TXT record at your domain's root that lists all authorised sending servers.
How do I fix MX record errors?
If the email health check reports no MX records, log in to your domain registrar or DNS provider and add MX records pointing to your mail server hostnames. Your email provider (Google Workspace, Microsoft 365, Zoho, etc.) will supply the exact MX record values and priorities in their setup documentation. After adding the records, allow up to 48 hours for DNS propagation and then re-run this check. Use the MX Lookup tool to verify the records are visible globally.
What is DKIM and why does my domain need it?
DKIM (DomainKeys Identified Mail) is an email authentication method that uses a public/private key pair to sign outgoing messages. Your mail server signs each email with a private key, and the public key is published as a TXT record in DNS. Receiving servers retrieve the public key and use it to verify the signature, confirming the message came from an authorised server and has not been altered in transit. Without DKIM, your emails lack this verification layer and are more likely to be filtered by spam systems, particularly when combined with a DMARC policy.
What does a DMARC policy of "none" mean?
A DMARC policy of p=none is a monitor-only mode. It tells receiving servers to take no action against emails that fail DMARC alignment — the messages still reach the recipient's inbox (or spam folder based on other filters). The value of p=none is that it enables DMARC reporting: you can receive aggregate and forensic reports showing who is sending email using your domain. It is a useful starting point, but you should eventually move to p=quarantine (send failures to spam) or p=reject (block failures entirely) once you have confirmed all legitimate sending sources are properly authenticated.
How do I know if my domain is blacklisted?
This email health checker queries your mail server's IP address against seven major DNS blacklists (Spamhaus, SpamCop, Barracuda, SORBS, Abuseat CBL, and PSBL) and reports any listings. If your IP is listed, the tool shows which blacklists have flagged it. A listed IP will cause many receiving mail servers to reject or silently discard your messages. You should investigate the root cause (compromised account, malware, spam complaint spike) before requesting delisting.
How do I get removed from an email blacklist?
Each blacklist operates its own removal process. First identify the root cause of the listing — a compromised account sending spam, a misconfigured mail relay, or a malware infection — and fix it. Then visit the blacklist's website directly (for example, spamhaus.org, barracudacentral.org) and follow their self-service delisting instructions. Some blacklists (like Spamhaus CBL) have automatic removal once the underlying issue is resolved; others require a manual request. Attempting removal before fixing the root cause will result in the IP being relisted within days.
What is the difference between SPF, DKIM, and DMARC?
SPF verifies that the sending server's IP address is authorised to send on behalf of your domain — it checks the infrastructure. DKIM verifies the message content by applying a cryptographic signature — it checks that the email was not tampered with in transit. DMARC ties both together by specifying what to do when SPF and/or DKIM fail, and crucially, it aligns the results with the From: header the recipient actually sees. You need all three: SPF and DKIM provide the authentication signals, and DMARC provides the enforcement and reporting layer that makes them effective against spoofing.
Can I fix email deliverability issues myself?
Yes, for most DNS-related issues. Adding or correcting SPF, DKIM, and DMARC records only requires access to your domain's DNS settings — typically through your registrar or DNS provider's control panel. Your email provider's documentation will give you the exact record values to publish. Blacklist removal is also self-service for most major lists. Where professional help is needed is in diagnosing compromised servers, investigating spam complaint sources, or architecting complex multi-sender SPF records without exceeding the 10 DNS lookup limit.
How long does it take for email DNS changes to take effect?
DNS changes typically propagate within 1 to 48 hours, depending on the TTL (Time to Live) set on your DNS records. Most modern DNS providers apply changes within minutes for new records. For records that already existed with a high TTL (e.g., 86400 seconds / 24 hours), resolvers that cached the old record will continue serving it until the TTL expires. To verify a change has propagated, use the DNS Propagation tool to check from multiple global nameservers.
Why does my email work for some recipients but not others?
Different mail providers apply different spam filtering rules and thresholds. A domain with a missing DKIM record might pass Gmail's filters but be rejected by Microsoft 365. A blacklisted IP might be blocked by Spamhaus subscribers but not by providers who do not query that list. This inconsistency is a strong sign that your email authentication is incomplete — some providers are more forgiving than others. Fixing SPF, DKIM, and DMARC will improve consistency across all receiving servers.
What is a DNSBL?
A DNSBL (DNS-based Blackhole List) is a database of IP addresses or domain names known to be associated with spam or malicious activity, published as a DNS zone. Mail servers query DNSBLs in real time during the SMTP connection: the sending IP is reversed and prepended to the DNSBL domain, and if a DNS A record is returned, the IP is listed. Spamhaus, SpamCop, Barracuda, and SORBS are among the most widely used DNSBLs. This tool checks your mail server IP against seven major lists simultaneously.
Do I need all of SPF, DKIM, and DMARC, or just one?
You need all three for complete protection. SPF alone prevents IP-level spoofing but does not protect the From: header a recipient sees. DKIM alone verifies message integrity but does not prevent spoofing of the From: address. DMARC alone has nothing to enforce without SPF and DKIM providing authentication signals. Together, they create a complete chain: SPF and DKIM authenticate the sending infrastructure and message, and DMARC enforces alignment between those authentication results and the visible From: header, blocking domain spoofing and enabling forensic reporting.

Related Tools

SPF Lookup

Inspect SPF mechanisms, DNS lookup count, and policy qualifier in detail.

DKIM Lookup

Check DKIM public key for any selector, including key length and revocation status.

DMARC Lookup

Review the full DMARC policy, reporting addresses, and alignment settings.

MX Lookup

Check mail server records and priorities for any domain.

DNS Propagation

Verify that new SPF, DKIM, or DMARC records have propagated across global nameservers.