Email Domain Health Check: MX, SPF, DKIM, DMARC and BIMI in One Test
Enter your domain to check the five DNS records that decide whether your email is delivered and trusted. Each record gets a status and, when something is wrong, the fix.
Results
- 5 email checks in one run
- Live DNS answers
- Free, no signup
What this domain health check tests
The check reads your domain's public DNS and runs five tests at once. Leave the DKIM selector empty unless you know it: mailX tries the most common ones.
| Check | What it looks at | Why it matters |
|---|---|---|
| MX | The mail servers that receive email for the domain, with their priority | No MX means replies and bounces have nowhere reliable to go |
| SPF | The TXT record listing who may send for the domain: missing, duplicated or malformed | Receivers use it to check that the sending server is allowed |
| DKIM | Public keys under common selectors, following CNAMEs (Microsoft 365, SendGrid...) | Signed messages prove they were not changed and come from your domain |
| DMARC | The policy at _dmarc: none, quarantine or reject, and where reports go | Gmail and Yahoo require it from bulk senders; it protects your domain from spoofing |
| BIMI | The record that points to your logo and its certificate | Shows your logo in supporting inboxes, once DMARC is enforced |
What it does not test: inbox placement (whether a message lands in the inbox or in spam), blocklists and your sending IP's reverse DNS. Use the PTR Lookup for reverse DNS.
How to run an email domain health check
Four steps from the test to a clean setup.
Enter the domain you send from
The one after the @ in your From address. If you send newsletters from a subdomain, such as news.example.com, check it too.
Read the five results
Valid records are marked as such. Missing, duplicated or unenforced records come with an explanation and a link to the fix.
Fix in this order
MX and SPF first, then DKIM for every service that sends as you, then DMARC, starting at p=none and moving to quarantine or reject. BIMI comes last.
Run the check again after your changes
DNS changes appear once the old records expire from caches, usually within minutes to a few hours.
What a healthy email domain looks like
The target for each record.
One or more MX records
Pointing to host names (never an IP or a CNAME), with the lowest number on your main mail server.
Exactly one SPF record
Starting with v=spf1, listing every service that sends as you, and ending with ~all or -all.
A DKIM key per sending service
Your mailbox provider, your newsletter tool and your CRM each sign with their own selector.
DMARC at quarantine or reject
After a few weeks at p=none reading reports, with every legitimate sender passing SPF or DKIM aligned with your domain.
No duplicate records
Two SPF records or two DMARC records invalidate both. Merge them into one.
BIMI when DMARC is enforced
Optional. A BIMI record with an SVG logo, and a certificate if you want the logo in Gmail.
Why email domain health matters
Mailbox providers check your DNS on every message
Gmail, Outlook and Yahoo look up your SPF, DKIM and DMARC records each time they receive an email from your domain. Since 2024, Gmail and Yahoo require SPF or DKIM from all senders, and SPF, DKIM and DMARC from bulk senders. A missing or broken record is one of the first reasons mail ends up in spam or gets rejected.
Records break silently
Adding a new sending tool, migrating to another email provider or editing a TXT record by hand can create a second SPF record, drop a DKIM key or leave an old MX behind. Nothing warns you until delivery drops. A health check after every DNS change catches it.
From the check to monitoring
A health check is a snapshot. If you manage several domains or send at volume, the mailX API and MCP server let you run the same checks from your own scripts or from an AI assistant, on a schedule.
Most common problems found
And how to fix them.
No SPF record
Receivers cannot check your senders. Create one with the SPF generator, listing every service that sends as you.
Two SPF records
Both become invalid. Merge them into a single v=spf1 record.
No DKIM found
Either DKIM is not set up, or your provider uses a custom selector. Check the s= value in a sent email's DKIM-Signature header.
DMARC at p=none
Your domain is monitored but not protected. Move to quarantine, then reject, once your legitimate mail passes.
No DMARC record
Add one at _dmarc.yourdomain.com, starting with p=none and a report address.
No MX record
The domain cannot reliably receive replies or bounces. Add the MX records your email provider gives you.
Email authentication guides
Understand every record this test checks.
Email Authentication Guide
SPF, DKIM, DMARC and BIMI: how they work together to prove your email is yours.
SPF vs DKIM vs DMARC
What each record does, and why you need all three.
Why Emails Go to Spam
The causes behind spam folder placement and how to fix them.
Run these checks from your own code or AI assistant
The mailX API and MCP server run the same DNS checks for any domain, from your scripts, ChatGPT or Claude.