Paste your MX, SPF, DKIM and DMARC records for a scored deliverability report with a fix for every problem — checked on your device, never uploaded.
Email Domain Health Check
Paste your MX, SPF, DKIM and DMARC records for a scored deliverability report with a fix for every problem — checked on your device, never uploaded.
The Email Domain Health Check runs entirely in your browser. The records you paste are analysed on your device — no DNS lookups are made and nothing is uploaded or stored.
Email Domain Health Check reads the DNS records that decide whether mail from your domain lands in the inbox or in spam, then grades them. Paste the output of dig or nslookup, or any zone-file lines, and the tool sorts out MX, SPF, DKIM, DMARC, MTA-STS, TLS-RPT and BIMI on its own. Each record is validated against its specification and then cross-checked against the others: a DMARC policy with no SPF or DKIM behind it, an MTA-STS policy that misses one of your MX hosts, a BIMI logo without an enforcing DMARC policy. You get a score out of 100, a letter grade and a plain-English fix for every finding. Everything is parsed on your device; no DNS query is made and nothing is uploaded.
Features
Detects MX, SPF, DKIM, DMARC, MTA-STS, TLS-RPT and BIMI records in a single paste
Reads zone-file lines, dig output, nslookup output and bare TXT values
Scores 0–100 with a letter grade and a fix written out for each finding
Cross-checks records: DMARC without SPF or DKIM, MX hosts missing from an MTA-STS policy, BIMI without enforcement
Catches records published at the wrong name, such as DMARC at the root instead of _dmarc
Flags duplicate SPF and DMARC records, +all, oversized ip4 ranges and short DKIM keys
Recognises common mail providers from MX hosts and points out a missing SPF include
Copies the whole report as plain text for a ticket or a client
How to use the Email Domain Health Check
Run the dig commands listed under “How to get these records” and copy what they print
Paste the output into the box; the domain is inferred, or type it to check where each record is published
Read the score, then open each card to see its findings, errors first
Fix the records at your DNS host, wait out the TTL, and paste again to confirm
Example
Input
3 MX records at Google Workspace · SPF with SendGrid ~all · DKIM 2048-bit · DMARC p=none
Output
Score 83/100, grade B — SPF pass · DKIM pass · MX pass · DMARC review: p=none only monitors
Every record exists and is valid; the grade is held back only by a monitoring-only DMARC policy.
Common errors & troubleshooting
DMARC shows as not pasted even though you published it. — DMARC is read only at _dmarc.yourdomain, as a TXT record. A record added at the bare domain, or at dmarc without the underscore, is never found. Many DNS panels append the domain for you, so enter just _dmarc as the host.
SPF is reported as failing with two records. — A domain may have exactly one SPF record. Two make receivers return a permanent error and ignore SPF altogether. Merge every include, ip4 and ip6 mechanism into a single v=spf1 string and delete the other.
The DKIM check finds nothing. — Verifiers look up <selector>._domainkey.<domain>, and the selector is the s= value in the DKIM-Signature header of a message you actually sent. A guessed selector returns an empty answer, so copy the real one from a message's headers.
The grade stays at B with every record present. — A DMARC policy of none only monitors, so the report marks DMARC for review. Read your aggregate reports, fix any sender that fails, then move the policy to quarantine and finally reject.
Frequently asked questions
What does an email domain health check actually test?
It tests the DNS records mail systems consult before trusting your domain: MX for where mail is received, SPF for which servers may send, DKIM for the signing key, DMARC for the policy when those fail, and optionally MTA-STS, TLS-RPT and BIMI. Each is checked for syntax and for how it fits the others.
Why do I paste records instead of typing my domain?
Looking a domain up would mean sending its name to an outside DNS resolver, and ArrayKit keeps what you work on on your device. Pasting takes seconds with the dig commands shown on the page, and it also lets you check records you have not published yet.
Which records do Gmail and Yahoo expect from bulk senders?
Since February 2024 both have required bulk senders, roughly 5,000 or more messages a day to their users, to publish SPF and DKIM and a DMARC record that is at least p=none, with the From domain aligned to one of them. Smaller senders are not exempt from spam filtering.
What do MTA-STS and TLS-RPT add on top of SPF, DKIM and DMARC?
SPF, DKIM and DMARC prove who sent a message. MTA-STS tells other servers to deliver to you only over validated TLS, which blocks downgrade attacks, and TLS-RPT sends you reports when that fails. They protect delivery to your domain rather than mail from it.
How do I find the DKIM selector to paste?
Send a message to any mailbox, open its original source and find the DKIM-Signature header. The s= value is the selector and d= is the domain. Your mail provider's admin console also lists the selectors it has set up, such as google or selector1.
Related tools
SPF Record Generator — Build and validate the SPF TXT record that stops others sending mail as your domain.
DMARC Record Generator — Build and validate a DMARC DNS TXT record with policy, reporting and alignment.
DKIM Record Generator — Build and inspect the DKIM TXT record that publishes your mail signing key.
DNS TXT Record Splitter — Split a long TXT value into 255-byte strings for DKIM, SPF and verification.
WHOIS Record Parser — Turn a raw WHOIS response into dates, registrar, name servers and decoded status codes.
CAA Record Generator — Build the DNS record that names which certificate authorities may issue for your domain.
Reverse DNS Generator — Turn IPs and prefixes into PTR names, zone files and RFC 2317 delegations.