Free tool

DNS and mail check

Enter a domain. We read the most important records, check DNSSEC and mail protection and compare what three large resolvers answer right now.

Free, no sign-up
No tracking, no ads
Three resolvers compared

What is checked

Records: A, AAAA, CNAME, NS, MX, TXT, CAA and SOA. DNSSEC: whether the domain is signed and the signature is valid at a validating resolver"broken" means that validating resolvers no longer resolve the domain at all. Mail: SPF (with the number of DNS lookups, more than ten make SPF invalid), DMARC policy, DKIM under common selectors or your own, MTA-STS policy (fetched from mta-sts.your-domain) and TLS-RPT.

Finally we compare the answers of Cloudflare, Google and Quad9. If they differ, a change has usually not arrived everywhere yet, records have a lifetime (TTL) up to which resolvers may keep old answers.

Why SPF, DKIM and DMARC?

Without SPF and DKIM anyone can send mail in your domain's name, and large mailbox providers put your real mail into spam. DMARC tells receivers what to do with mail that passes neither check"none" only observes, "quarantine" and "reject" really protect. MTA-STS makes sure mail to you is only delivered encrypted.

FAQ

Which resolvers do you ask?

Cloudflare (1.1.1.1), Google (8.8.8.8) and Quad9 (9.9.9.9) via DNS over HTTPS. The domain being checked learns nothing about you.

Why don't you find my DKIM key?

DKIM keys live under a selector chosen by your mail provider. We try common names; if yours is not among them, enter it under "Advanced"you will find it in the header of a sent mail (DKIM-Signature: … s=selector).

Is the result up to date?

Yes, to within a minute: we query the same domain at most once per minute. Resolvers may cache older answers until the TTL expires.

More free tools

Game server statusIs your Minecraft, CS2, Rust or Valheim server online? Players, version and map at a glance.Check now Website checkIs the site down: just for you or for everyone? Checks from all monitoring locations at once.Check now Port checkIs a port reachable from outside? Checks your own IP, for port forwarding, game servers and homelabs.Check now My IPWhat is your IP address right now? IPv4 or IPv6, with reverse DNS.Check now IP infoWhere is an IP from? Country, network, operator (AS) and abuse contact of an address.Check now Domain checkIs the domain still available? Registrar, expiry date, name servers and DNSSEC of a domain.Check now SSL checkCheck a website's certificate: valid, issuer, expiry date, chain and host name.Check now Blacklist checkIs your mail server on a blocklist? Checks an IP against 11 public blacklists.Check now Subnet calculatorCalculate IPv4 and IPv6 networks: network address, broadcast, first and last address, count.Check now

Domains with DNSSEC and our own name servers

Domains with us run on our own name servers with DNSSEC. You manage records and redirects in the customer area.

View domains