DNS Health Monitor
Check SPF, DKIM, DMARC, MX, and CAA records for any domain in one click. Get an email deliverability score and know exactly what to fix.
What gets checked
Frequently Asked Questions
SPF (Sender Policy Framework) is a DNS TXT record that lists which mail servers are authorised to send email on behalf of your domain. Without it, anyone can spoof your domain in the "From" address. Most spam filters reject or mark as spam any email from a domain without a valid SPF record.
DMARC (Domain-based Message Authentication, Reporting & Conformance) builds on SPF and DKIM. It tells receiving mail servers what to do when SPF or DKIM checks fail — nothing (p=none), quarantine (p=quarantine), or reject (p=reject). It also enables aggregate reports so you can see who's sending email on your behalf. SPF checks the sending server; DMARC orchestrates the policy and reporting.
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to outgoing emails. The public key is published as a DNS TXT record under a selector (e.g. google._domainkey.yourdomain.com). Receiving servers use this to verify the email wasn't altered in transit. Our tool probes 16 common selectors automatically — if yours uses a custom selector, check your email provider's setup guide.
SPF alone is not enough. Gmail, Outlook, and other providers increasingly require all three — SPF, DKIM, and DMARC — to be properly configured. A missing DMARC record, a DMARC policy of p=none, or a broken DKIM selector are the most common causes. Also check that you're sending through an IP listed in your SPF record, and that you have valid MX records.
The score from 0 to 100 is weighted across five checks: SPF (25 pts), DMARC (30 pts), DKIM (20 pts), MX records (15 pts), and CAA (10 pts). A score of 90+ means your email setup is solid. 70–89 means warnings to address. Below 60 means critical records are missing or misconfigured and your emails are likely landing in spam or being rejected.
SPF has a hard limit of 10 DNS lookups per evaluation (RFC 7208). If your SPF record includes too many include:, a:, or mx: mechanisms, it causes a "permerror" — the SPF check fails as if no SPF record exists. The fix is to "flatten" your SPF record by replacing include: statements with the actual IP ranges using a tool like dmarcian or EasyDMARC.
Yes — all DNS records are public by design. You can check any domain's SPF, DMARC, DKIM, MX and CAA records. This is completely legitimate and is the standard way administrators audit email security. It's also useful for understanding how large senders like Google or Stripe have configured their DNS.
A CAA (Certification Authority Authorization) record restricts which certificate authorities are allowed to issue SSL certificates for your domain. Without one, any CA could technically issue a cert for your domain. It's optional but recommended as a security best practice — especially if you only use Let's Encrypt or a specific commercial CA. Example: 0 issue "letsencrypt.org".