Email diagnostic tools
Live checks of a domain's email configuration: authentication (SPF, DKIM, DMARC, DANE, BIMI), transport security (MTA-STS, TLS-RPT, certificates), MX and DNS, blocklists and the connection to mail servers and mail clients, individually or bundled in the Domain Check. Records and endpoints are resolved, rated and checked for common mistakes. Plus generators that produce a finished record instead of just faulting the old one. Every tool works without an account. A free account is optional and only unlocks extras such as saving results and record drafts. Only what is publicly reachable is evaluated: DNS records and services. We do not send test mails.
Overview
Domain Check
All email checks for a domain in one run: MX, SPF, DMARC, DKIM, MTA-STS and an SMTP connection test.
Spoofing Protection Check
MX, SPF, DMARC and DKIM evaluated together: is sender spoofing rejected?
SMTP Test
Connects to a domain's MX servers and checks port 25, EHLO and STARTTLS.
Exchange Server Check
Check the Exchange build of your OWA URL against Microsoft's build list.
DNS
DNS Lookup
Resolve a name or an IP directly in DNS and show the standard records.
DNSSEC Check
Check a domain's DNSSEC chain of trust: DS, DNSKEY, RRSIG, algorithms.
CAA Check
Check a domain's CAA records: which certification authorities may issue.
MX Lookup
Resolve MX records sorted by priority, with the IP addresses of the mail servers.
Email authentication
Mail Check
Send a real email to a one-time address and have SPF, DKIM, DMARC and blocklists checked against the actual delivery.
SPF Check
Find the SPF record, check its syntax, count DNS lookups against the limit of 10.
DMARC Analyzer
Read the DMARC record and assess policy, alignment and reporting addresses.
DKIM Lookup
Query the DKIM public key, check the real key length and the record status.
MTA-STS and TLS-RPT Check
Check the MTA-STS record and HTTPS policy, MX comparison, certificate, TLS-RPT.
DANE Check
Check the TLSA records of the MX hosts: DNSSEC, Usage/Selector/Matching, coverage.
BIMI Check
Check a domain's BIMI record: logo URL, SVG profile, VMC and the DMARC precondition.
TLS & certificates
Client configuration
Autodiscover Check
Check Exchange Autodiscover: DNS entries, certificate and an anonymous endpoint test on port 443.
Autoconfig Check
Check Thunderbird auto-configuration: SRV records, autoconfig XML and the Mozilla ISPDB.
IMAP/POP3/SMTP TLS Test
Check a mail server host on the client ports 143/993/110/995/587/465: TLS, certificate, capabilities.
Generators
SPF Generator
Put an SPF record together step by step, without syntax errors.
Summarise SPF
Replace includes with their IP ranges and get back under the 10-lookup limit.
DMARC Generator
Put a DMARC record together, with plain words on what the level actually does.
MTA-STS Generator
Create the TXT record and the policy file for MTA-STS, both together.
TLS-RPT Generator
Create a TLS-RPT record so that TLS delivery problems do not stay silent.