Domain Health
One-shot report: MX, SPF, DKIM, DMARC, DNSSEC & blacklists.
Enter a value above to run Domain Health
e.g. example.com
Quick answer
Domain Health runs one combined check of a domain's MX, SPF, DKIM, DMARC and DNSSEC records plus mail blacklist status, so you can spot email and DNS problems in a single report. Each item is flagged as present and valid or missing/misconfigured, and any blacklist hit points to a deliverability issue that needs fixing.
Domain Health runs a single sweep across the DNS records that decide whether your email is delivered and trusted. In one pass it checks your MX hosts, SPF and DMARC policies, DKIM signing key, DNSSEC status, and whether your sending IPs appear on public blacklists. Instead of querying five separate tools and stitching the answers together, you get one consolidated report that shows which parts of your email and DNS setup are solid and which need attention before they cause bounces or spam folder placement.
How it works
You enter a domain and the tool resolves its authoritative records live. It looks up MX records to find your mail servers, reads the SPF TXT record, queries common DKIM selectors, and fetches the _dmarc TXT record. It checks whether the zone is signed with DNSSEC (RRSIG and DS records) and tests each mail-related IP against several DNSBL blacklists. Every check is a real-time query, so the report reflects your DNS exactly as resolvers see it right now.
How to read the results
Each section is pass, warning, or fail. A green MX means mail can be routed; SPF and DMARC greens mean receivers can verify your senders. A DKIM warning often means the selector you use was not found, not that signing is broken. DNSSEC is optional but shown so you know if it is active. A blacklist hit is the most urgent item: it directly blocks delivery. Fix fails first, then warnings.
Why it matters
MX, SPF, DKIM, and DMARC work as a chain. A single missing or malformed record can send legitimate mail to spam or reject it outright, and you rarely notice until customers complain. A blacklisted IP can silently kill outbound mail for a whole domain. Running one combined check makes these gaps visible in seconds, so you can catch a broken SPF include or an expired DKIM key before it damages your deliverability.
Frequently asked questions
- Why does DKIM show as missing when I have signing enabled?
- DKIM keys live under a selector name that varies by provider, such as google, k1, or s1. The tool probes common selectors, but if yours is custom it may not be found. Check the DKIM-Signature header of a real outgoing message for the s= value, then confirm that selector exists in your DNS. Signing can be fine even if the report cannot guess the selector.
- My IP is on a blacklist. What should I do?
- First confirm the listing is your actual sending IP, not a shared or forwarding host. Identify why it was listed: compromised account, open relay, or a spam complaint. Fix the root cause, then use the delisting form on the specific blacklist. Delisting before fixing the source usually results in a fast relisting, so clean up first.
- Do I need DNSSEC for email to work?
- No. Email delivery relies on MX, SPF, DKIM, and DMARC, which all work without DNSSEC. DNSSEC protects your DNS answers from tampering and enables DANE for TLS, so it strengthens overall security, but a DNSSEC warning will not stop mail from flowing. Treat it as a hardening step to address after your core email records pass.