Inboxes decide whether to trust your email in part by reading four public records on your domain. Enter your domain or work email, and we’ll check them in a few seconds and show the biggest problems first.
Check a domain
Live lookups through Cloudflare’s public DNS
Before an inbox accepts your message, it looks up a handful of public records on your domain. These are the four records we check, and what each one tells a receiving mail server.
MX records tell other mail servers where to deliver email for your domain, so without them, customer replies can bounce. We confirm that a mail server record exists, but we don’t send a test message through it to prove delivery.
SPF lists the services allowed to send email as your domain, such as Google Workspace or your newsletter tool. We check that it ends with a clear rule for everyone else and stays within the 10-lookup limit.
DKIM is a digital signature your email provider adds to each message, which proves nobody changed it on the way. We look for keys under the 15 selector names that common providers such as Google and Microsoft use. Some providers pick a custom name we can’t guess, so a warning here isn’t always a problem.
DMARC tells receivers what to do with mail that fails SPF and DKIM, and where to send reports about it. A policy of none only watches, while quarantine or reject asks inboxes to filter or refuse fake mail.
Every check gets one of three results, and the color tells you how urgent it is.
Your score weighs each record by how much it matters to delivery, so it isn’t a simple count. MX, SPF and DMARC each carry more weight in the score than DKIM does. A missing DKIM result can just mean we didn’t find the selector name your email provider chose.
A DMARC policy of none shows as Improve rather than Good, because it only collects reports. It doesn’t ask receiving inboxes to filter or refuse the fake email that someone sends in your name.
When you press the button, we look up your domain’s public DNS records through Cloudflare’s DNS service. These are the same records that any mail server reads before it accepts a message from you.
The check never sends any messages from your mailbox or to it, so nobody receives anything while it runs. If you enter a full email address, we only use the domain after the @ sign.
You can only have one SPF record per domain, which trips up businesses that add a record per tool. Combine every service that sends email for you into a single record instead of adding new ones. For Google Workspace on its own, the record looks like this.
v=spf1 include:_spf.google.com ~allEach include in your SPF record can trigger more lookups, and the record breaks once it passes 10. Remove services you no longer send from, and ask your providers whether they offer a shorter include for your plan.
Many email providers leave DKIM switched off until you generate a key and publish it in your DNS. In Google Workspace, open the Admin console, go to Gmail, then Authenticate email, and generate a key. In Microsoft 365, turn it on under email authentication settings in the Microsoft Defender portal.
If you have no DMARC record yet, start with a policy of none and an address for reports, using your own domain in the record below. Once the reports show that all your real senders pass, move the policy to quarantine and then to reject.
v=DMARC1; p=none; rua=mailto:[email protected]Check your mobile Core Web Vitals and see what is slowing your site down.
Run the checkCheck the on-page SEO basics of any page, from the title tag to structured data, in one pass.
Run the checkCheck the security basics any visitor can see, from HTTPS and security headers to your PHP and WordPress versions.
Run the check