Email Health Checker

Checks the DNS records that actually control whether your domain's email is trusted or gets bounced to spam — MX, SPF, DKIM, DMARC, and a couple of the newer ones (MTA-STS, BIMI) that are increasingly expected rather than optional.

What each record is doing

• MX — which servers receive mail for the domain. No MX record, no incoming email, full stop.
• SPF — the list of servers authorised to send mail as your domain. Without it, anyone can forge a "from" address that looks like yours.
• DKIM — a cryptographic signature on outgoing mail that lets receivers verify it wasn't altered in transit.
• DMARC — tells receiving servers what to actually do when a message fails SPF or DKIM. This is the record that turns detection into enforcement — without it, failures are noted but nothing happens.
• MTA-STS — enforces TLS for mail in transit, closing off downgrade attacks that would otherwise let mail be intercepted or read in the clear.
• BIMI — shows your verified logo in supporting email clients, which requires the SPF/DKIM/DMARC foundation to already be solid first.

Why this is worth checking on a schedule, not just once

Missing or misconfigured SPF, DKIM and DMARC is the single most common reason legitimate email lands in spam — and worse, it's an open door for someone to spoof phishing emails that look like they came from your domain, which does real damage to your reputation with recipients who have no way to tell the difference. A DMARC policy of p=reject, backed by properly aligned SPF and DKIM, is the actual bar to clear here — p=none only monitors and reports, it doesn't stop anything, and a lot of domains get stuck at that stage indefinitely because moving to enforcement feels risky. It's worth doing anyway, deliberately, rather than leaving it at monitoring-only by default.