TinyPingTinyPing

Email Health Check

Check a domain's email setup in one go: MX, SPF, DMARC, DKIM and MTA-STS, scored out of 100 with the critical issues and fixes listed. Enter a domain such as example.com, and a DKIM selector if you know it.

What is an email health check?

An email health check reads the DNS records that decide whether your mail is delivered and whether others can send mail pretending to be you. Each one has a job. MX says which servers receive mail for the domain. SPF lists the servers allowed to send it. DKIM adds a cryptographic signature that receivers verify with a public key published in DNS. DMARC ties SPF and DKIM to the address in the From line and tells receivers what to do when a message fails.

The score weighs these records by how much they matter. A missing MX or a broken SPF record costs the most, a DMARC policy of none costs a little, and MTA-STS is informational. DKIM keys live at a name made of a selector and the domain, and there is no way to list them all, so DKIM is only checked when you enter a selector. Without one it shows as not checked, not failed.

MTA-STS lets a domain tell sending servers to deliver mail only over verified TLS. It is optional, but useful once the basics are in place.

example.com.                  MX   10 mail.example.com.
example.com.                  TXT  "v=spf1 include:_spf.google.com -all"
google._domainkey.example.com TXT  "v=DKIM1; k=rsa; p=MIIBIjANBg..."
_dmarc.example.com.           TXT  "v=DMARC1; p=quarantine; rua=mailto:[email protected]"

Common email deliverability problems

No SPF or DMARC record

Without them, receiving servers cannot tell your real mail from a forgery, so your messages are more likely to be filtered and your domain is easier to spoof. Gmail and Yahoo require SPF, DKIM and a DMARC record from bulk senders. Publish an SPF record listing every service that sends for you, then a DMARC record starting at p=none.

Two SPF records on the same domain

This usually happens when a new provider's setup guide says "add this TXT record" and you add it next to the existing one. Receivers treat two SPF records as a permanent error, which means SPF fails for every message. Merge them into one record with one v=spf1 and one all at the end.

SPF over the 10 DNS lookup limit

Each include, a, mx, ptr, exists and redirect costs a lookup, and nested includes count too. Past 10, SPF returns a permanent error. Remove services you no longer use, and replace a and mx mechanisms with ip4 or ip6 ranges where they rarely change.

DMARC stuck at p=none

p=none only asks receivers to report, so spoofed mail claiming to be you is still delivered. Read the aggregate (rua) reports for a few weeks, fix any legitimate sender that fails, then move to p=quarantine and later p=reject.

DKIM not set up for every sender

Your mailbox provider may sign with DKIM while your newsletter tool, CRM or helpdesk sends unsigned mail, or signs with its own domain. Turn on custom-domain DKIM in each tool and check its selector here.

MX records missing or pointing to an old provider

After a migration, leftover MX records can send part of your incoming mail to a mailbox nobody reads. Make sure only the current provider's MX hosts are listed, with the priorities it gives you.

How to check your email health

  1. Enter the domain you send email from, for example example.com.
  2. Optionally add a DKIM selector (google for Google Workspace, selector1 for Microsoft 365, or the one your sending tool shows).
  3. Click Check email health.
  4. Fix the critical issues first, then work through the recommendations and check again.

When to run an email health check

Setting up Google Workspace or Microsoft 365

After switching providers, confirm the new MX records are live, the old ones are gone, SPF includes the new provider and DKIM signing is turned on.

Your emails started landing in spam

Customers say invoices or password resets go to junk. Check for a broken SPF record, a missing DMARC record or a sender that is not signing with DKIM before you look anywhere else.

Adding a newsletter or transactional email service

Mailchimp, SendGrid, Postmark, Amazon SES and similar tools each need an SPF include or a DKIM record. Check that adding one did not create a second SPF record or push you over 10 lookups.

Auditing a client's domain

Agencies and IT consultants can get a quick score and a list of fixes for a new client before touching their DNS.

Check something else

Frequently asked questions

What is a good email health score?

Aim for no critical issues first: an MX record, exactly one valid SPF record and a DMARC record. A domain with SPF, DKIM and DMARC at p=quarantine or p=reject scores near the top. The remaining points come from details such as DMARC reports and MTA-STS.

Why does DKIM show as not checked?

DKIM keys are published at <selector>._domainkey.<domain>, and DNS has no way to list every selector a domain uses. Enter the selector from your provider (google for Google Workspace, selector1 or selector2 for Microsoft 365) to check it.

How do I find my DKIM selector?

Open the headers of an email you sent and look for the DKIM-Signature line. The s= value is the selector and d= is the signing domain. Your email provider's DKIM settings page also shows it.

Do I need DMARC if I already have SPF and DKIM?

Yes. SPF and DKIM can pass for a domain other than the one in the From line, which is what spoofers rely on. DMARC checks that they align with the From domain and tells receivers what to do when they do not. Gmail and Yahoo require a DMARC record from bulk senders.

Does this check send a test email?

No. It only reads public DNS records for the domain. It does not connect to your mail server or send anything, so it is safe to run on any domain.

Is MTA-STS required?

No. It is an optional standard (RFC 8461) that tells other servers to deliver mail to you only over verified TLS. It needs a TXT record at _mta-sts and a policy file served over HTTPS, so set up the basics first.

Email records are set. Now watch the rest.

TinyPing does not monitor email DNS, so recheck it here after changes. For the parts of your domain that can fail any minute, TinyPing checks every 5 minutes and alerts you when:

  • your website returns an error, times out or stops resolving
  • your own mail server stops accepting connections on its port (for example 587)
  • an expired certificate breaks HTTPS
Start monitoring free for 7 days

US$6.99 a month or US$47 a year per 50 monitors, team members free. 7-day free trial, no card needed.

Want alerts in team chat? Follow the guide for Slack or Google Chat.