Email Deliverability Checker
Pre-flight your sender config before you bounce
The IP of the server sending your mail, used to check DNSBL blacklists. Leave empty to skip. Find it in email headers (Received: from) or ask your SMTP provider.
The DKIM public key lookup prefix, used to verify email signatures. Leave empty to auto-detect common selectors (google, default, s1, k1…). Find yours in any sent email header: DKIM-Signature: s=...
Email deliverability determines whether your messages reach the inbox or get rejected and buried in spam. It hinges on a set of DNS records — MX proves your domain exists and has mail servers, SPF declares who can send as you, DKIM uses cryptographic signatures to prove mail wasn't tampered, and DMARC ties them together with enforcement policy. If your outgoing IP is on a DNSBL blacklist, even perfect authentication won't save you.
Misconfiguration gives no warning — you just see bounces, low inbox rates, and registration emails vanishing into spam. A missing SPF lets anyone spoof your domain; a stagnant DMARC p=none lets spoofed mail sail through; a blacklisted outgoing IP sinks every message. Worst of all, these problems are often discovered only after you've lost users.
This tool runs the same checks recipients perform — before you send. Enter your sending domain (and optionally your outgoing IP and DKIM selector) to verify the four key DNS records are published correctly and your IP is clean. Each result maps directly to a real bounce code, telling you exactly what's wrong and how to fix it.
Pre-flight before sending, not after bouncing — check yourself before recipients do
Five checks in one run: DNS resolution, SPF, DKIM, DMARC, IP blacklist
Zero trace: pure DNS queries, no emails sent, no domain or IP stored
Maps directly to bounce codes: each check result maps to a real bounce error, so you know what to fix
When to use
Before first send from a new domain — confirm MX, SPF, DKIM, DMARC are all published
When mail bounces — match the bounce code to pinpoint DNS, auth, or IP issues
After DNS changes — verify the update propagated and introduced no new problems
After switching mail servers or SMTP providers — check the new IP is clean
Bounce error reference
Common bounce errors and the check that catches them:
| Bounce error | Root cause | This tool checks | Fix direction |
|---|---|---|---|
| 554 5.1.8 Domain not found | Sending domain has no DNS records | Domain DNS resolution | Add MX/A/AAAA records |
| 550 DNSBL (e.g. r1401) | Outgoing IP on a real-time blacklist | IP blacklist | Request delisting or change IP |
| 550 5.7.26 Authentication failed | SPF/DKIM/DMARC missing or failing | SPF + DKIM + DMARC | Publish and tighten auth records |
DNS record templates
Templates for the four key DNS records. Replace yourdomain.com and provider includes as needed.
MX (at yourdomain.com MX):
yourdomain.com. IN MX 10 mail.yourdomain.com.
SPF (at yourdomain.com TXT):
v=spf1 include:_spf.google.com include:mail.zoho.com -all
DMARC (at _dmarc.yourdomain.com TXT):
v=DMARC1; p=reject; rua=mailto:[email protected]; adkim=s; aspf=s
DKIM (at <selector>._domainkey.yourdomain.com TXT):
v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC...
Start DMARC with p=none to collect reports, then escalate to quarantine, then reject.
DNS & email auth knowledge
The DNS records this tool checks and why they matter for email delivery:
Domain DNS resolution (MX / A / AAAA)
MX tells recipients which mail servers handle your domain. A/AAAA map your domain to an IPv4/IPv6 address. If a sending domain has zero DNS records, recipients reject with 554 5.1.8 Domain not found — the domain simply does not exist in DNS.
SPF (Sender Policy Framework)
A TXT record at your domain listing the IPs/servers allowed to send mail as you. Recipients check the sending IP against this list. Without SPF, anyone can spoof your domain.
- -all
- Hard reject: unauthorized senders are blocked. Best practice, highest security.
- ~all
- Soft fail: marked as suspicious but not rejected. OK for transition, lowers domain trust long-term.
- ?all
- Neutral: no assertion. Equivalent to no SPF. High spoofing risk.
- +all
- Allow all: any IP can send as you. Extremely dangerous, never use.
DKIM (DomainKeys Identified Mail)
A cryptographic signature added to outgoing mail. The public key is published as a TXT record at <selector>._domainkey.yourdomain.com. Recipients verify the signature against this key. Unlike SPF, you must know the selector to look up the key.
- v=DKIM1
- Version identifier, required. Without it the record is not recognized as DKIM.
- k=rsa
- Key type, RSA most common. Defaults to rsa if missing.
- p=...
- RSA public key, required. Empty or missing p= revokes the selector.
- t=s
- Strict mode: signature must match domain exactly. Prevents subdomain signing abuse.
DMARC (Domain-based Message Authentication)
A policy TXT record at _dmarc.yourdomain.com that ties SPF and DKIM together. Tells recipients what to do when both fail. Also specifies where to send aggregate reports.
- p=none
- Monitor only: no action, just collect reports. Safe starting point but zero protection — spoofed mail still reaches inbox.
- p=quarantine
- Quarantine: failed auth goes to spam folder. Moderate protection, good for validation phase.
- p=reject
- Reject: failed auth is blocked outright. Strongest protection, the end goal. Skipping this level lets spoofed mail through.
- rua=
- Aggregate report destination. For monitoring delivery failures, no enforcement but helps troubleshooting.
- adkim=s / aspf=s
- Strict alignment: requires DKIM/SPF domain to match From header exactly. Prevents subdomain spoofing.
DNSBL (DNS-based Blackhole List)
Real-time IP blacklists queried via DNS. Recipients check your outgoing IP against lists like Spamhaus, Barracuda, SpamCop. If listed, mail is rejected (550 DNSBL).
- zen.spamhaus.org
- Largest public blacklist, widest coverage. Highest impact — nearly all recipients check it.
- b.barracudacentral.org
- Enterprise-grade blacklist, used by many security appliances. Moderate impact.
- bl.spamcop.net
- User-report driven. May have false positives, but moderate impact.
- dnsbl.sorbs.net
- Smaller blacklist, limited impact but still queried.