01 / Network

Email DNS Health

Validate published MX, SPF, DMARC, DKIM, MTA-STS, and TLS reporting records.

$ mail dns
Server diagnostic

Checks published DNS configuration—not inbox placement, reputation, or complete deliverability.

MX, SPF, DMARC, DKIM, MTA-STS, and TLS reporting are queried concurrently.

email-dns-health.outputidle

waiting for a target

Guide

About the Email DNS Health

The email DNS health checker collects the public records commonly used to route and authenticate domain email. It reviews MX, SPF, DMARC, optional DKIM, MTA-STS, and TLS reporting signals in one diagnostic.

How to use this tool

Enter the domain used after the @ in an email address. If you want to check DKIM, provide the selector configured by your mail provider; selectors cannot be discovered reliably from DNS alone. Run the check after publishing mail records and compare each returned value with the provider's documented requirement. Correct syntax is only one part of delivery health, so send controlled test messages and review your provider's authentication results as a separate step.

How to read the result

MX records identify inbound mail servers. SPF lists authorized sending sources, while DMARC states how receivers should handle messages that fail aligned SPF or DKIM checks and can publish reporting destinations. DKIM exposes the public key for a named selector. MTA-STS advertises a policy for protected SMTP delivery, and TLS-RPT publishes a reporting address. Findings should distinguish absent optional controls from malformed or conflicting records that can disrupt mail.

Limits and privacy

This tool checks published DNS data; it does not send email, test SMTP delivery, validate a private DKIM key, or guarantee inbox placement. Forwarding, alignment, reputation, provider behavior, and message construction remain important. DNS caches can delay changes, and a selector must be supplied for DKIM. The domain and optional selector are submitted to buffer.lol's diagnostics API for the requested lookups.

FAQ

Common questions

Can the checker find my DKIM selector automatically?
No reliable DNS enumeration exists for selectors. Enter the selector supplied by your mail service, such as selector1 or google.
Does passing these checks guarantee email delivery?
No. Authentication records help, but reputation, content, alignment, receiver policy, and provider configuration also affect delivery.