Email Health Check

🩺 Diagnostics

Enter a domain to score its inbound email setup — routing, authentication, transport security and operational readiness — in one report.

No sign-up required Runs on our own infrastructure Also available via API
Try:

Runs on our diagnostic API. We don’t attach your input to an account for these free tools; short-lived rate-limit/security logs may exist, and requests are rate-limited per IP.

Inbound vs outbound — what this checks

An MX lookup identifies the servers that receive mail for a domain — not the servers that send it. So this is an inbound health report built entirely from public DNS and your receiving server. It does not measure outbound sender reputation (your sending-IP blocklists, PTR/FCrDNS, or the real SPF/DKIM/DMARC alignment of your messages) — that requires your sending IP or a test email, so it’s shown as “Not tested.” To check it, run the Outbound Deliverability Test.

What the score measures

The score is the percentage of the tested categories you pass — a high score does not by itself guarantee inbox placement:

  • Inbound routing (20) — MX records exist and resolve to real mail servers.
  • Authentication (30) — SPF and DMARC are published and valid. DKIM is scored where a selector can be discovered; a domain-only scan often can’t find the selector, in which case it’s marked “Not testable from domain alone.”
  • Transport security (20) — the receiving server offers STARTTLS with a valid certificate, plus MTA-STS and TLS-RPT.
  • Operational readiness (10) — DMARC is enforced (quarantine/reject) and aggregate reporting is on.
  • Outbound sender reputation — Not tested by a domain-only scan (run the Deliverability Test).

How to use it

Fix the critical (red) findings first, then the warnings. Each finding links to the underlying tool where you can dig into the exact record and copy a corrected value.

Frequently asked questions

Why does my MX provider differ from my sending provider?
MX = who receives your mail (e.g. Microsoft 365); you often send through a different service (SES, SendGrid). Normal — but it’s why this scan is inbound-only.
Why is outbound reputation “Not tested”?
A domain scan can’t see your sending IP or real message authentication, so we mark it Not tested instead of a false zero. Use the Outbound Deliverability Test to measure it.
Why can’t the checker find my DKIM selector?
The selector lives in each message’s DKIM-Signature and can’t be guessed from the domain. Enter it on the DKIM Checker or send a test email.
Does a high score guarantee inbox placement?
No — the score is the % of tested inbound/DNS categories. Inbox placement also depends on outbound reputation and engagement, which this scan doesn’t measure.