Read a domain's mail DNS configuration
Enter the domain used by your mail provider and choose Google or Cloudflare. The tool queries MX and root TXT records, plus TXT at _dmarc.domain. Supplying a DKIM selector adds a fourth TXT query at selector._domainkey.domain. Each query has a ten-second timeout and does not send cookies. Query inputs and results are not saved automatically.
What the checks cover
MX records are sorted by preference and null MX combinations are checked. SPF checks include duplicate policy records, common mechanism syntax, permissive all qualifiers, duplicate modifiers and the direct DNS lookup-term count. TXT character strings are concatenated within each record, while separate records remain separate.
DMARC checks duplicate records, required policy, selected alignment tags and policy percentage, and displays report destinations. DKIM checks selected tag structure, key publication, revoked keys and basic Base64 encoding. Download the full report to preserve findings and normalized DNS responses.
Interpret findings within their limits
SPF includes, redirect targets, macros, void lookups and MX expansion are not resolved; the direct term count is not a final SPF lookup total. DMARC organizational-domain fallback and external report authorization are not checked. DKIM key structure, key strength and message signatures are not validated. No findings means only that the supported checks found no issue.
A domain without MX may use SMTP address fallback. A valid null MX, 0 ., explicitly declares that inbound mail is not accepted. Resolver errors are kept separate from missing records. Use DNS Lookup to compare answers from multiple resolvers.
Protocol references
SPF (RFC 7208), DMARC (RFC 7489), DKIM (RFC 6376), and null MX (RFC 7505).
Frequently asked questions
Does this verify that my email will be delivered?
No. It inspects DNS publication and selected policy rules. It does not send mail, verify sender authorization, evaluate SPF recursively, check DKIM signatures or measure reputation.
How do I find my DKIM selector?
Use the selector supplied by your mail provider, or inspect the s= tag of a DKIM-Signature message header. It is queried at selector._domainkey.domain. No selector guessing is performed.
What happens if one DNS query fails?
Other query results remain visible. A timeout or DNS error is reported as incomplete, rather than interpreted as a missing record. Editing the inputs or choosing Cancel aborts the active report.
Is a missing DMARC record proof that no policy applies?
No. This tool queries _dmarc at the entered domain only. Organizational-domain fallback and public suffix discovery are not performed; a subdomain may inherit a policy.