Review the public DNS records that support web routing and email authentication. This tool checks A, NS, MX, SPF, DMARC, common DKIM selectors, and available reputation signals. It does not currently validate DNSSEC or CAA, and it cannot guarantee inbox placement.
SPF authorizes sending infrastructure for the message's envelope domain. We find and parse the published record, but the current grade does not recursively evaluate every include and redirect against SPF's lookup limit.
DKIM adds a cryptographic signature that receivers can verify with a public DNS key. We check a set of common selectors. A clean result cannot rule out a custom selector, so verify a real message's DKIM-Signature header.
DMARC tells receiving servers what to do when SPF or DKIM fails: do nothing, quarantine, or reject. We check your DMARC policy and report settings.
MX records identify a domain's inbound mail exchangers and priorities. We report the published records; we do not perform an end-to-end SMTP delivery test.
A records map the domain to IPv4 addresses, while NS records identify its authoritative nameservers. The current grade reports these records but does not validate DNSSEC, delegation consistency, or the complete zone.
We show domain and resolved-IP reputation results where configured providers return usable data. Some DNS-based providers restrict cloud queries, and a shared CDN IP can make a result inconclusive.
Common configuration issues include:
Authentication is one input to delivery. Also review message alignment, sender and IP reputation, complaints, bounces, content, sending patterns, and the receiving provider's current requirements.
SPF authorizes infrastructure for the envelope identity. DKIM signs selected message content. DMARC evaluates alignment with the visible From domain and publishes a requested policy. Provider requirements vary by volume and message type, and passing all three does not guarantee delivery.
There is no fixed worldwide propagation or reputation-recovery window. DNS timing depends on the previous TTL, negative caching, delegation, and resolver behavior. Verify authoritative answers and real message headers, then monitor provider dashboards and delivery results.