MailCheck
SPF · DKIM · DMARC · Blacklists · SMTP · WHOIS · and more
Free email security check — 13 checks in one scan
MailCheck analyses your domain's full email security posture in seconds. Enter any domain to check SPF, DKIM, DMARC, MX records, DNS blacklists, SMTP connectivity, MTA-STS, TLS-RPT, DANE, BIMI, IP reputation, and WHOIS — no account or signup required.
What each check covers
SPF Record Check
Retrieves and parses your Sender Policy Framework record, recursively expands every include: directive, and counts DNS lookups against the hard 10-lookup limit. A permerror here causes legitimate email to be rejected.
DKIM Check
Looks up the DKIM public key for your selector, validates the record syntax, and confirms the key length meets current security recommendations. Supports custom selectors for Google Workspace, Microsoft 365, and others.
DMARC Policy Check
Parses your DMARC record and flags weak configurations — p=none gives zero protection, missing rua means you receive no failure reports. Includes a record generator to help you move to p=reject.
MX Records
Looks up and validates your domain's MX records, checks priorities, and verifies the mail servers are reachable. Missing or broken MX records mean no one can send you email.
Email Blacklist Check (24+ RBLs)
Tests your domain and sending IPs against 24+ DNS-based blacklists including Spamhaus ZEN, Barracuda, SURBL, and SpamCop. A single blacklist listing can cause widespread delivery failures at major providers.
SMTP TLS & Open Relay
Opens live TCP connections to your mail server on ports 25, 587, and 465 to verify STARTTLS is advertised. Also tests for open relay and catch-all configurations that expose your infrastructure to abuse.
MTA-STS & TLS-RPT
Checks for a published MTA-STS policy that enforces TLS on inbound mail, and a TLS-RPT record that enables failure reporting. These two standards close the security gap DMARC leaves on the inbound side.
DANE / TLSA
Queries TLSA records for each MX host to detect DANE deployment — the strongest available mechanism for authenticating mail server TLS certificates via DNSSEC, independent of public CAs.
BIMI Check
Retrieves your Brand Indicators for Message Identification (BIMI) record, validates the SVG logo URL, and checks for a VMC certificate — the prerequisites for displaying your brand logo in Gmail and Apple Mail.
IP Reputation & WHOIS
Resolves each MX host to its IP address, then looks up organisation, ASN, ISP, city, and hosting/proxy flags. Also checks domain registration age, registrar, expiry, and DNSSEC status — factors spam filters weigh heavily.
Why email authentication matters
Without SPF, DKIM, and DMARC correctly configured, anyone can send email that appears to come from your domain — impersonating your business to phish customers, partners, and staff. A DMARC policy of p=reject stops domain spoofing entirely. MailCheck shows you exactly where your configuration stands and what needs fixing, with inline record generators to help you deploy the right DNS records.
Frequently asked questions
- Is MailCheck free?
- Yes — all 13 checks are free with no account required. Enter any domain and run a full scan instantly.
- How do I check if my domain is on an email blacklist?
- Enter your domain in the search bar above and click Run Checks. The Blacklists (RBL) check tests 24+ DNS blacklists and shows any active listings with direct removal links.
- Why is my email going to spam?
- The most common causes are a missing or failing SPF record, no DKIM signature, a weak DMARC policy, a sending IP on a blacklist, or a mail server without STARTTLS. A full MailCheck scan identifies which checks are failing and what to fix.
- What is the difference between SPF, DKIM, and DMARC?
- SPF specifies which servers may send email for your domain. DKIM cryptographically signs each message so recipients can verify it was not altered. DMARC ties them together and tells receivers what to do when either check fails — and sends you reports. All three are required for strong email authentication.
- What is a good DMARC policy?
p=rejectis the strongest setting — receiving servers discard any message that fails SPF or DKIM alignment. Start withp=noneto collect reports without affecting delivery, move top=quarantine, thenp=rejectonce all legitimate senders are covered.- What is MTA-STS and do I need it?
- MTA-STS forces other mail servers to use validated TLS when delivering email to your domain, preventing downgrade attacks on inbound mail. It requires a DNS TXT record and a policy file served over HTTPS. It's recommended for any domain that cares about inbound mail security.
- How often should I check my email security?
- Run a check any time you change mail providers, add a sending service, or see deliverability problems. For active domains, a monthly scan is a good baseline — blacklist listings can appear without warning and cause immediate widespread failures.