×Atomic Mail

Atomic Mail

Productivity

Get
Products
↓
Features
↓
BusinessPricingBlogContact usSupport
Sign InSign Up
Download app
Sign inCreate a free account
  1. Home
  2. Free email tools
  3. Email domain checker
Free tool · No signup

Free Email Domain Checker

Check a domain’s email setup in seconds. See its MX, SPF, DKIM and DMARC records, what each one means, and what to fix.

  • Free, no account needed
  • Public DNS records only
  • Nothing is stored
What it checks

What does an email domain checker test?

Four DNS records decide whether a domain can receive mail and whether other servers can trust mail that claims to come from it. The checker reads each one, explains it and flags what’s missing or wrong.

MX: where your mail goes

MX records name the servers that receive mail for the domain, in order of priority. We check that each one resolves and recognise the email provider behind them.

Receiving mail

SPF: who may send

SPF lists the servers allowed to send mail as your domain. We follow every include, count DNS lookups against the limit of 10 and check the policy at the end.

Sender authorization

DKIM: a signature on every message

DKIM publishes a public key that receivers use to verify your messages weren’t altered. We look up your selector, read the key type and size, and spot revoked or weak keys.

Message integrity

DMARC: what happens on failure

DMARC tells receivers what to do with mail that fails SPF and DKIM, and where to send reports. We read every tag and follow the current standard, RFC 9989.

Spoofing protection

MTA-STS and TLS reporting

Optional records that ask senders to deliver over encrypted connections only, and to report when they can’t. We show whether they’re published.

Encrypted delivery

Nameservers, DNSSEC and BIMI

Where the domain’s DNS is hosted, whether its answers are cryptographically signed, and whether it publishes a brand logo record for supporting inboxes.

Additional insights
How it works

How to check your domain’s email setup

It takes a few seconds. You don’t need an account or access to the domain’s settings, because the records are public.

  1. Enter the domain

    Type a domain like yourcompany.com. You can also paste a website address or an email address; we use only the domain.

  2. Read the report

    Each check gets a status: Pass, Warning, Problem, Not checked or Not applicable. Open the raw records to see exactly what DNS returned.

  3. Fix and check again

    Make the suggested changes at your DNS host, wait for them to take effect (usually minutes, sometimes a few hours), then run the check again.

Example with a sample domain.
Troubleshooting

Common email DNS problems and how to fix them

Most issues come from adding a new service without updating the records that are already there.

SPF

Two SPF records

A second v=spf1 record for a new service makes SPF fail for all your mail.

Fix

Merge them into one record with a single all at the end.

v=spf1 include:a.com include:b.com ~all
SPF

More than 10 SPF lookups

Every include, a, mx and redirect costs a lookup, and includes nest. Over 10, SPF fails.

Fix

Drop services you no longer use, or replace includes with their IP ranges.

DMARC

No DMARC record

Receivers decide alone what to do with spoofed mail, and you get no reports.

Fix

Publish a starter record with a report address.

v=DMARC1; p=none; rua=mailto:dmarc@you.com
DMARC

DMARC stuck on p=none

p=none only monitors. Mail that spoofs your domain still gets delivered.

Fix

When reports show your services pass, move to quarantine, then reject.

DKIM

DKIM never switched on

Many providers don’t sign your mail until you turn DKIM on and publish their key.

Fix

Microsoft 365: add two selector CNAMEs. Google Workspace: add the TXT key.

MX

MX points to an old provider

After a switch, old MX records still send some mail to the service you left.

Fix

Keep only your current provider’s MX records and remove the rest.

Sender requirements

What Gmail, Yahoo and Microsoft require

Since 2024 the largest mailbox providers have required email authentication. Google started rejecting more non-compliant mail in November 2025, and Microsoft’s rules for Outlook.com took effect in May 2025.

Everyone who sends to Gmail

  • SPF or DKIM set up for your sending domain.
  • Valid forward and reverse DNS for your sending servers.
  • TLS when delivering mail.
  • A low spam rate, below 0.3% as reported in Google Postmaster Tools.

Bulk senders (5,000+ a day)

  • Both SPF and DKIM for the sending domain.
  • A DMARC record with at least p=none.
  • Alignment: the From domain matches the SPF or DKIM domain.
  • One-click unsubscribe in marketing mail.
Limits

What this checker can’t tell you

DNS shows how a domain is configured, not how a particular message was handled.

  • DMARC alignment

    Whether your mail is actually DKIM-signed and passes alignment. That shows in the Authentication-Results header of a real message.

  • Inbox placement

    Whether mail reaches the inbox. That also depends on sending reputation, content and how recipients engage.

  • Blocklists

    Whether your domain or sending servers are listed on a spam blocklist.

  • Server health

    Whether your mail servers are online and accept encrypted connections.

FAQ

Frequently asked questions

What does an email domain checker do?

It reads a domain’s public DNS records that control email (MX, SPF, DKIM and DMARC) and tells you whether they’re present, valid and set up in a way receivers expect. It’s a configuration check: it shows how the domain is set up, not how a particular message was handled.

Is it free, and do you store the domains I check?

It’s free and needs no account. The lookups run in your browser and go to Google Public DNS, or Cloudflare DNS if Google doesn’t answer. We don’t store the domains you check. If you enter an email address, only the part after the @ is used.

Why does DKIM say “Not checked”?

DKIM keys are published under a name called a selector, which your email provider chooses. DNS doesn’t list them, so no tool can find every key from the domain alone. We try the selectors common providers use. If none match, enter your selector: it’s in your provider’s DKIM settings, or after s= in the DKIM-Signature header of an email you sent.

Should my SPF record end with ~all or -all?

Both are fine. -all asks receivers to reject mail from servers you didn’t list, and ~all asks them to accept it but treat it as suspicious. With DMARC in place, receivers mostly act on your DMARC policy instead. Avoid +all, which allows any server to send as you.

Is p=none a good DMARC policy?

It’s the right first step, and it’s all Gmail and Yahoo require from bulk senders. But p=none only monitors: spoofed mail is still delivered. Use the reports to confirm your legitimate mail passes, then move to quarantine and reject.

What is the SPF 10-lookup limit?

To evaluate SPF, receivers may make at most 10 DNS lookups, counting include:, a, mx, ptr, exists and redirect, including those inside included records. Beyond 10, SPF returns a permanent error and fails. The checker counts them for you and shows the full include tree.

I changed a record. Why don’t I see it yet?

DNS answers are cached for the time set in each record (its TTL), often between a few minutes and a day. If you just made a change, wait and check again. Also confirm you edited the DNS host your nameservers point to, which the report lists under Additional insights.

If everything passes, will my email reach the inbox?

Not necessarily. Correct DNS records let receivers verify your mail, which you need to reach the inbox, but filtering also depends on your sending reputation, your content and how recipients interact with your messages.

What does “null MX” mean?

A null MX record (0 .) says a domain doesn’t accept email (RFC 7505). It’s the correct setup for domains that never use email. Pair it with “v=spf1 -all” and a DMARC record with p=reject so nobody can send mail as that domain either.

Free email tools

More free email tools

Free, with no signup. They all run in your browser.

Atomic Mail Business

Email on your own domain, set up the right way

When you connect your domain, Atomic Mail shows you the MX, SPF, DKIM and DMARC records to add. Mail between your team is end-to-end encrypted, with no ads and no tracking.

Get business emailFree email signature generator