Email check
Check a domain’s email setup
MX, SPF, DKIM and DMARC in a few seconds. See whether a business can receive email, and whether anyone can fake it.
Public DNS records only, read from your browser. Nothing is sent to the domain or kept by us.
- MX
Receives email
Whether the domain can receive email, and which service handles it.
- SPF
Allowed senders
Which servers may send email for the domain.
- DKIM
Signed email
Whether outgoing email is signed, so it can’t be changed on the way.
- DMARC
Protection from fakes
What receivers should do with email that fakes the domain.
The records
Four records, one answer
Each one answers a question a mail server asks before it trusts an email.
SPF, DKIM and DMARC explainedMX: where email goes
Mail exchanger records name the servers that receive the domain’s email. Without one, email sent to the business bounces. A “null MX” says on purpose that the domain takes no email.
SPF: who may send
One TXT record on the domain lists the servers allowed to send its email, and ends with what to do with the others: ~all marks them as suspicious, -all fails them. Only one SPF record is allowed, within 10 DNS lookups.
DKIM: a signature on each email
The sending service signs each message; receivers check it with a public key published at selector._domainkey. DNS can’t list selectors, so a key under a custom name doesn’t show up here.
DMARC: what to do with fakes
A TXT record at _dmarc tells receivers what to do with email that fails SPF and DKIM for the domain: nothing (p=none), spam (quarantine) or refuse it (reject), and where to send reports.
Questions
About the email check
No. The check only reads public DNS records, the same ones every mail server reads before it accepts an email. Your browser asks Cloudflare’s public DNS (Google Public DNS if Cloudflare doesn’t answer); no email is sent and no mailbox is touched. RadiusPilot receives nothing.
DNS can’t list a domain’s DKIM keys: you have to know a key’s name, its selector, to look it up. The check tries 22 names that common services use (google, selector1, k1…). A service that uses a custom name looks like “not found”, which is why the result is Unknown and not Missing. To be sure, open an email from the domain and read s= in its DKIM-Signature header.
Start with p=none and a reports address (rua=) to see who sends as the domain, fix the senders the reports show, then move to p=quarantine and later p=reject. p=none alone only watches: fake emails are still delivered.
Every include, a, mx, ptr, exists and redirect in an SPF record costs a DNS lookup, and the services it includes add theirs. Past 10, receivers stop and treat SPF as an error (a “permerror”), so the record protects nothing. The check counts the lookups in the record itself.
Yes, since February 2024: every sender needs SPF or DKIM, and bulk senders (around 5,000 messages a day to Gmail) need SPF, DKIM and DMARC, with a From domain that matches. Our guide to SPF, DKIM and DMARC links to their pages.
Get started
The same check on every business you find
In RadiusPilot, Email health is part of the website audit: the result is saved on the business, counts in its opportunity score and becomes a line for your first email.