Domain and email health checker

Check email authentication (SPF, DMARC, DKIM) and basic DNS and HTTPS hygiene for any domain in a few seconds.

DNS lookups use Cloudflare DNS-over-HTTPS. DKIM is checked on common selectors only (google, selector1, selector2, default, k1, s1, s2, mail, dkim), so a "not found" may just mean your provider uses a different selector.

Monitoring many domains? A bulk Domain Health Checker on Apify, with expiry, SSL and a 0–100 score, is coming soon. Get notified.

Why it matters

Since 2024, Gmail and Yahoo have required SPF or DKIM from all senders, and DMARC from bulk senders. Without them, your mail goes to spam. DMARC p=none only monitors; quarantine or reject actually protects your domain from spoofing.

FAQ

What does the domain health checker test?

SPF, DMARC policy, DKIM on common selectors, MX, nameservers, A/AAAA records, DNSSEC, CAA, HTTPS availability, HSTS and the HTTP-to-HTTPS redirect, with a suggested fix for each issue and a 0-100 score.

Is DMARC p=none enough?

No. p=none only monitors. To protect your domain from spoofing, move to p=quarantine and then p=reject once your aggregate (rua) reports look clean.

Why does it say DKIM was not found?

DKIM keys live under a selector chosen by your email provider. The checker tries common selectors (google, selector1, selector2, default, k1, s1, s2, mail, dkim). If your provider uses a different one, check its DKIM settings.

Do Gmail and Yahoo require SPF, DKIM and DMARC?

Since 2024, Gmail and Yahoo require SPF or DKIM from all senders, and SPF, DKIM and DMARC from bulk senders. Without them, mail is more likely to be rejected or sent to spam.