Domain health checker
Use this free email domain health checker tool for an SPF, DKIM and DMARC check of your published DNS records.
Check email domain health across SPF, DKIM and DMARC
Combined DNS audit
Use this domain health checker tool to inspect SPF, DKIM and DMARC DNS records together. Find syntax issues, policy gaps and lookup-limit problems in one report. For ongoing visibility, use Suped's DMARC monitoring to track authentication results and sender changes over time. For a focused lookup, open the SPF checker, DKIM checker or DMARC checker for the protocol you are investigating.
Get started
SPF, DKIM and DMARC check: what's included
Review SPF syntax and lookup limits, DKIM keys at common selectors, and DMARC policy and reporting. Separate results help locate the DNS issue.
Email health checker: read your authentication results
Counts summarize DNS checks, not mail authentication rates. If the common-selector scan finds no key, get the selector from your provider or message headers and run a targeted lookup.
How to check email domain health before sending
Check each sender's documented setup, fix missing or invalid records, and recheck DNS. Then send a test message to verify signing and alignment, not just published configuration.
Email authentication checks in one report
Review published email-authentication records before a launch or after a DNS change. This report does not test website uptime, SSL certificates, mail-server performance or complete sender reputation. A real-message test is needed to verify signatures and alignment.
7/7
DMARC
16/16
SPF
7/7
DKIM
Combined health score
See DMARC, SPF and DKIM pass counts together before opening each detailed section.
DMARC policy
SPF record
DKIM selectors
Authentication coverage
Confirm the domain has the core records receivers need to authenticate mail.
Priority fix
Move DMARC from monitoring to quarantine after sender alignment passes.
Failure summary
Summarize failing authentication checks and their risks before reviewing the detailed results.
DMARCvalid
SPFvalid
DKIMfound
DMARC, SPF and DKIM checks
Inspect policy, lookup limits, duplicate records, selectors, keys and reporting setup.
DNS provider
Managed in Cloudflare
DNS provider context
Identify where records are managed so fixes happen in the right DNS account.
Health report
Copy link
Shareable audit
Send the same report to a client, vendor or teammate without screenshots.
Email domain health checker FAQs
Answers to common questions about checking domain health, reading authentication results, and deciding what to fix next.
No. It performs live DNS lookups and reports what is currently published.
It inspects published SPF, DKIM and DMARC DNS configuration and shows separate pass counts. It is an email-authentication check, not a website availability, domain-age, MX-server or complete reputation scan.
The checker looks for a DMARC record, confirms there is only one record, validates syntax, checks the main and subdomain policy, checks aggregate-report destinations, and checks external reporting authorization.
The checker looks for an SPF record, confirms there is only one record, validates syntax, checks DNS lookup and void lookup limits, detects include loops, checks record length, verifies the all mechanism, flags +all, PTR, duplicate includes, empty includes, macros, and records with no authorized senders.
The checker scans common selectors and inspects discovered records for duplicates, syntax, key type, acceptable hashes, key strength and testing mode. It cannot discover every possible selector or verify a real email's signature from DNS alone.
Separate checklist counts show which protocol needs investigation. They are not a standardized security grade, a message-authentication pass rate or a guarantee of inbox delivery; some recommendations depend on whether the domain sends mail.
On a real message, DMARC needs a passing SPF or DKIM result aligned with the visible From domain. Valid DNS records do not establish that result. Use the email tester to inspect the actual sending IP, signature and authenticated domains.
Knowing where DNS is managed helps you route fixes to the right account or team. The checker shows provider context when nameservers make it possible to identify.
Fix missing or invalid DMARC, SPF, and DKIM records first. Then address SPF lookup limits, weak DMARC policies, missing reporting, and weak DKIM keys.
Yes. Run a check and use the share link to send the same report to a teammate, client, or vendor.
No. The domain health checker validates DNS records. To inspect whether a real email passed SPF, DKIM and DMARC alignment, use the email tester. Check SPF, DKIM and DMARC on a real message.
A one time check is useful for audits and troubleshooting. For ongoing visibility into authentication failures, sender changes and DMARC reports, use DMARC monitoring.
How MONEYME proactively strengthens domain security and unlocks higher email engagement with Suped
See how MONEYME uses Suped
How cybersecurity specialist Jam Cyber delivers scalable DMARC protection with Suped
See how Jam Cyber uses Suped
How Vision Australia maintains full DMARC enforcement across a large domain portfolio with Suped
See how Vision Australia uses Suped
How The POP Team turns domain checks and DMARC visibility into client ready delivery work
See how The POP Team uses Suped
How DigiBean simplified DMARC monitoring and improved email security for their MSP clients
See how DigiBean uses Suped
How Alliance Group moved from reactive guesswork to proactive email management with Suped
See how Alliance Group uses Suped
Start monitoring your DMARC reports today
What you'll get with Suped
Real-time DMARC report monitoring and analysis
Automated alerts for authentication failures
Clear recommendations to improve email deliverability
Protection against phishing and domain spoofing