Email domain health checker: one domain, one report
An email domain health check reads every DNS record that decides whether mail from a domain is trusted: MX, SPF and its lookup count, DKIM, DMARC, MTA-STS, TLS-RPT and BIMI, plus whether the domain's own sending IPs are on a blocklist. Enter a domain and you get a score out of 100 and a plain-English fix list, broken items first.
Free, no account. DNS lookups plus one HTTPS request for the MTA-STS policy; nothing is sent to the domain's mail servers. A few runs a minute.
Sample result
acme.example scores 65/100: nothing is broken, but DMARC only monitors and DKIM wasn't found.
- Domain
- acme.example
- Fix first
- DKIM: turn on signing
- SPF lookups
- 4 of 10
What this means for you
Mail is delivered, but these gaps cost trust. The fix list puts DMARC and DKIM first, with the record to publish for each.
- MX, SPF, DKIM, DMARC, MTA-STS, TLS-RPT, BIMI
- Blocklists for the domain's own sending IPs
- Score out of 100 with the weights shown
- Fix list ordered by what breaks delivery
- Domain
- Authentication
- Blocklists
By SimpleVerifier Team · Last updated
How do I check my domain's email health?
- Enter a domain, such as
acme.com, or paste an email address and the domain is taken from it. - Press Check health. The tool reads MX first, then runs the SPF, DKIM, DMARC, MTA-STS, TLS-RPT and BIMI checks side by side, then checks blocklists for any IP the domain lists as its own.
- Read the score and the verdict: Healthy, Fair, or Needs work. A broken MX, SPF, DMARC or blocklist result means Needs work whatever the number says.
- Work down "What to fix, in order". Each line links to the single-record checker that shows that record in full, with the generator for the fix.
Example
- You enter
- The domain
acme.example, with Google Workspace MX, SPFv=spf1 include:_spf.google.com ~all, no DKIM key on the common selectors, DMARCv=DMARC1; p=none; rua=mailto:dmarc@acme.example, and no MTA-STS, TLS-RPT or BIMI. - You get
- Fair, 65/100. MX and SPF pass (4 of 10 DNS lookups). DKIM and DMARC are marked Improve and earn half: no key on the common selectors, and
p=nonemonitors without enforcing. The blocklist check isn't scored because mail runs through Google's shared servers and SPF lists no IP of the domain's own. The fix list starts with DKIM and DMARC, then the optional MTA-STS, TLS-RPT and BIMI. - Limits
- One domain a run, no account needed. Each underlying lookup allows ten runs a minute per IP address; DNS and one HTTPS request for the MTA-STS policy, no email sent.
What does an email domain health check look at?
Eight things, in two groups. The four that decide delivery: MX records (can the domain receive replies and bounces), SPF (which servers may send as it, within RFC 7208's limit of 10 DNS lookups), DKIM (is mail signed) and DMARC (what receivers should do with mail that fails). Google's email sender guidelines require all three authentication records from bulk senders, with DMARC at p=none or stricter.
Then the extras: MTA-STS and TLS-RPT protect and report on mail coming in to you, and BIMI shows your logo in supporting inboxes. They count for little in the score because most domains don't publish them and mail is delivered fine without them. Finally, blocklists: if an IP the domain names as its own sender is listed, receivers that use that list refuse its mail.
How is the health score worked out?
Each check has a fixed weight: SPF, DKIM and DMARC 20 points each, MX and blocklists 15 each, MTA-STS 5, TLS-RPT 3 and BIMI 2. A pass earns the full weight, a result marked Improve earns half, and a missing or broken record earns nothing. A lookup that didn't complete is left out and the score is scaled to 100, so a slow DNS server doesn't count as a failure.
The verdict can overrule the number. If MX, SPF, DMARC or the blocklist check fails, the domain is marked Needs work even at 80, because each of those alone is enough for a mailbox provider to filter or refuse its mail. The weights are our judgment of what matters most, not a formula any mailbox provider publishes.
Which IPs does the blocklist check test?
Only IPs the domain names as its own: single ip4: addresses in its SPF record, and the MX host's address when the domain runs its own mail server. Each is looked up on the same public IP blocklists as the IP blacklist check, including Spamhaus ZEN. A Spamhaus PBL listing alone is marked Improve rather than Fix, because it means the range isn't meant to send mail directly, not that it sent spam.
If the domain sends through Google Workspace, Microsoft 365 or another large provider and lists no IP of its own, the blocklist check is not scored. Those shared servers aren't yours to delist, and testing them would say nothing about your domain. To test the IP your mail actually leaves from, copy it from the Received header of a message you sent; how to get off a blacklist covers what to do if it's listed.
Why does DKIM say "not found" when I have it set up?
DKIM keys live at a name built from a selector, such as google._domainkey.acme.com, and DNS can't list the selectors a domain uses. The check tries the common ones through the DKIM selector finder: Google, Microsoft 365, the big sending platforms and generic names like s1 or k1. Platforms that give each account its own selector, such as Amazon SES, can't be found this way.
So "not found" on DKIM is marked Improve, not Fix, and the fix tells you how to confirm it: open a message you sent, read the s= value in its DKIM-Signature header, and check that selector with the DKIM checker.
Is this the same as the email deliverability test?
It covers more and explains each result. The email deliverability test is a quick audit of MX, SPF, DKIM, DMARC and blocklists. This report adds the SPF lookup count, the DMARC policy and its inheritance from a parent domain, MTA-STS, TLS-RPT and BIMI, and turns every gap into a fix ordered by how much it matters.
If you are setting up a new domain for cold email, the cold email domain checker adds what matters there: the domain's age and whether its website redirects. For many domains at once, use the bulk email authentication checker.
Who uses this tool, and for what?
- Founders and marketers
- Check the company domain before a launch email or a new newsletter, and hand the fix list to whoever manages DNS.
- Agencies and consultants
- Audit a new client's domain in one run, with the reasons and fixes written in plain English to paste into the onboarding notes.
- IT and email admins
- Confirm a DNS change landed: SPF still under 10 lookups after adding a vendor, DMARC moved to quarantine, MTA-STS switched to enforce.
- Cold emailers
- Check each sending domain's records and blocklist status before warming it up or after a drop in replies.
What can’t this tool tell you?
- It measures DNS setup and blocklist status, not sender reputation, content or list quality.
- DKIM is checked on common selectors only; account-specific selectors can't be found from DNS.
- Blocklists are checked for IPs the domain names as its own; shared provider IPs aren't scored.
- The weights are our judgment, not a published mailbox-provider formula.
- One domain a run. For a list of domains, use the bulk email authentication checker.
Common questions
- How do I check my email domain health for free?
- Enter the domain in the checker above. It reads MX, SPF, DKIM, DMARC, MTA-STS, TLS-RPT and BIMI from public DNS, checks the domain's own sending IPs against public blocklists, and returns a score out of 100 with a fix list. No account is needed and no email is sent.
- What is a good email domain health score?
- 85 or more with no broken MX, SPF, DMARC or blocklist result is marked Healthy. A domain with SPF, DKIM and DMARC at p=quarantine or p=reject, and no blocklist listing, gets there without MTA-STS, TLS-RPT or BIMI. The score measures setup, not sender reputation.
- Can a domain with a perfect score still land in spam?
- Yes. The records show mail is really from you; mailbox providers then judge what you send and who you send it to. High bounce rates, spam complaints and sudden volume spikes hurt a domain with perfect records. Verifying the list keeps the bounce part low.
- Does the checker send email or connect to my mail server?
- No. Every check is a DNS lookup, apart from one HTTPS request for the MTA-STS policy file at mta-sts.yourdomain, which is how sending servers read it too. No SMTP connection is made to the domain.
- Why is my blocklist check not scored?
- Your domain sends through a large provider's shared servers and its SPF record lists no IP of your own, so there's no IP that is yours to check. Copy the sending IP from a sent message's Received header into the IP blacklist check to test it directly.
- Do I need MTA-STS, TLS-RPT and BIMI?
- No. They are optional and weigh 10 points together. MTA-STS makes servers sending to you require TLS, TLS-RPT sends you reports when that fails, and BIMI shows your logo in Gmail, Yahoo and Apple Mail once DMARC is at quarantine or reject.
Sources
You audited one domain. Cold outreach means thousands.
This tool checks a domain you type in. It will not tell you which addresses at that domain are real.
- Bulk mailbox verification with real SMTP checks
- The email finder — name plus company to a verified address
- Website enrichment for emails, owner names and socials
One plan, cancel anytime, no contract. Sign in with Google and your first 100 email checks are free, no card. The free tools stay free either way.