DNS zone file email audit: find MX, SPF, DKIM and DMARC problems
In short: Paste the zone file export from your DNS host. The tool reads it in your browser, lists the MX, SPF, DKIM and DMARC records for the domain and flags what to fix, such as two SPF records or a TXT string over 255 octets. Limit: It reads pasted text, not live DNS.
Paste a zone file export and the tool reads its records, then checks the mail ones: MX at the domain, exactly one SPF record, a DMARC record at _dmarc, and each DKIM selector key with its size. Two SPF records are flagged as a problem, because RFC 7208 says SPF then returns permerror. Nothing leaves your browser.
Price: this tool is free. Checking a whole email list is from $9/mo, and the first 100 checks are free with Google, no card. Check your list free nowSee pricing
Needed only when the file has no $ORIGIN line.
Sample result
A five-record zone has one problem, two SPF records, and two items to check.
- Problems
- 1
- Records read
- 5
- SPF records
- 2
What this means for you
The two to check are a missing DMARC record and a 1024-bit DKIM key.
- MX, SPF, DKIM and DMARC
- Duplicate SPF flagged
- DKIM key sizes
- Strings over 255 octets
- Zone file
- DNS
- Audit
By SimpleVerifier Team · Last updated · Runs in your browser; nothing you paste is sent to us
With the records in order, check the list you will send to.
- Records decide whether mail is accepted; the list decides how much of it bounces.
- Upload or paste it at /verify. Every address gets a live mailbox check, and the first 100 email checks are free with a Google sign-in, no card.
How do I check my zone file for email problems?
- Export the zone from your DNS host as a zone file, or copy its record lines, and paste them in.
- Type the domain if the file has no $ORIGIN line. Otherwise leave it blank.
- Read the problems first, then the items to check, then the records table.
- Fix them at your DNS host, export again and rerun the audit.
Example
- You enter
- A zone file for example.com with one MX record, two SPF TXT records, a CNAME for www and a DKIM key at s1._domainkey with a 1024-bit RSA key.
- You get
- Five records read. One problem: two SPF records at the domain, which RFC 7208 says gives permerror. Two items to check: no DMARC record at _dmarc.example.com, and a 1024-bit DKIM key that meets the minimum but not the 2048-bit recommendation.
- Limits
- Runs in your browser; nothing is uploaded.
What does the audit look at?
It reads the master file format described in RFC 1035: comments after a semicolon, records spread over lines in parentheses, $ORIGIN, @ for the origin, a blank owner for the previous owner. Then it checks the mail records for the domain: MX, SPF, DMARC at _dmarc and every DKIM key at selector._domainkey.
Why are two SPF records a problem?
RFC 7208 says that if the records found include more than one SPF record, the check returns permerror, and that records not beginning with exactly v=spf1 are discarded. Merge your services into a single record; the SPF record merger does that.
What does the audit leave out?
It checks the file you paste, not live DNS, and it does not follow includes inside an SPF record. To read what is published now, use the bulk SPF lookup counter and the bulk DKIM checker.
Who uses this tool, and for what?
- Cold email senders
- Audit the records on a batch of sending domains moved between DNS hosts.
- Deliverability consultants
- Check a client's whole export in one pass.
- Sales ops
- Confirm a migration kept every mail record.
What can’t this tool tell you?
- It reads pasted text, not live DNS.
- Control lines other than $ORIGIN are ignored, and records of types it does not list are skipped.
- Subdomain mail setups are checked only for the domain you name.
- It does not test whether SPF authorises a particular sender.
Common questions
- Which zone file format does it read?
- The standard master file format: one record per line or grouped in parentheses, with optional TTL and class. Lines it cannot read are counted and skipped.
- Does it read exports from my DNS host?
- If the export is a zone file, yes. A spreadsheet export needs to be saved as zone file lines first.
- Why does it say no MX record is a note, not a problem?
- A domain used only for sending does not need an MX record. It is only needed to receive mail.
- Does it check my live DNS?
- No. It only reads the text you paste.
- Does it check SPF includes and lookups?
- No. Use the SPF lookup counter for that.
- Is my zone file uploaded?
- No. It is read in your browser.
Sources
A tidy list can still be full of dead addresses.
Extracting, deduplicating and syntax checks all work on the text of an address. None of them can tell whether the mailbox exists. Only the server that hosts it can answer that, through an SMTP check, and that is what the paid product does.
- Upload the cleaned file as it is: CSVs up to 100,000 rows
- A real SMTP mailbox check on every row, with catch-all detection
- Small list? Starter at $9/mo covers 2,500 emails a month, cancel anytime
Plans from $9 a month, cancel anytime, no contract. Sign in with Google and your first 100 email checks are free, no card. The free tools stay free either way.