Free check
Type your domain.See what a receiver sees.
The same checks we run for a client, deeper than a record lookup: SPF, DKIM, DMARC, the MTA-STS policy over HTTPS, a real STARTTLS handshake with the mail servers, the certificates behind it, and the reputation of the server that sends. No account, nothing stored. The report is yours to keep.
The domain goes to our DNS resolver and to the mail servers it names, for the handshake. Nothing is stored, and the report is generated from the answer.
For machines: the report is JSON at /api/health?d=yourdomain. Assistants can run this check themselves: add https://fyzno.com/mcp as a connector in ChatGPT or Claude and ask them to check a domain. See the FAQ below for the two-minute setup.
What the check reads
01
Mail routing
The MX records, the fallback when there are none, and whether any of them answer.
02
SPF
Who may send from the domain, and whether the list actually closes.
03
DKIM
The signing key, its size, and whether the selector receivers try first is published.
04
DMARC
What receivers are told to do with spoofed mail, and where the reports go.
05
MTA-STS
The policy over HTTPS, and whether TLS between servers is enforced.
06
SMTP TLS
A real STARTTLS handshake with the mail servers, and what it negotiates.
07
Certificates
The certificate behind each connection, its issuer, and its expiry.
08
TLS-RPT
Whether TLS failures between servers are reported anywhere.
09
Reputation
The sending server, checked against Spamhaus ZEN.
10
BIMI and web headers
The logo a receiver can verify, and the security headers the site sends.
Questions
What does the mail health check check?
Mail routing, SPF, DKIM, DMARC, the MTA-STS policy fetched over HTTPS, TLS-RPT, a live STARTTLS handshake with the mail servers, the certificates behind that connection, and the sending server's listing on Spamhaus ZEN. BIMI, IPv6, web security headers, and DNS hygiene are checked for information and never move the score.
Is the mail health check free?
Yes. No account, no trial, nothing to install. The domain goes to our DNS resolver and to the mail servers it names, and the report is generated from the answer.
What does the score out of 100 mean?
Nine core checks add up to 100: routing 10, SPF 15, DKIM 15, DMARC 15, MTA-STS 10, TLS-RPT 5, SMTP TLS 15, certificates 10, reputation 5. A check that cannot be tested from our network earns zero and is marked not tested, so a score is only as good as the network that ran it.
Does the check store my domain?
No. The domain goes to our DNS resolver and to the mail servers it names, for the handshake. Nothing is stored, and the report is generated from the answer.
Why does it say the SMTP handshake was not tested?
Some networks, including many home networks, block outbound port 25. When our check cannot reach the mail servers on port 25, the SMTP TLS and certificate checks report not tested rather than guess, and the score reflects only what could be verified.
Can ChatGPT or Claude run this check for me?
Yes. Fyzno publishes a Model Context Protocol (MCP) server at https://fyzno.com/mcp, which lets an assistant run the check itself and read the result. In Claude, open Settings, then Connectors, choose Add custom connector, and paste https://fyzno.com/mcp. In ChatGPT, open Settings, then Connectors, and add the same URL as an MCP server. You add it once; afterwards you can simply ask in any conversation, for example: check the mail setup for example.com. Custom connectors are a paid-plan feature on both, and neither can add one on your behalf, so the setup has to be done by you.
What can the assistant actually do once it is connected?
Seventeen read-only tools. One, mail_health_check, runs the whole report. Thirteen more return a single finding each (check_spf, check_dkim, check_dmarc, check_mta_sts, check_tls_rpt, check_smtp_tls, check_certificates, check_reputation, check_routing, check_bimi, check_ipv6, check_web_security, check_dns_hygiene), which is useful when you only care about one thing. The last three read the site itself: status, public facts, and the page index. Nothing writes, no tool accepts a URL, and the only input any of them takes is a domain name.
Is it safe to connect an assistant to it?
It is read-only and public. Every tool returns something any visitor to this site could already read, so connecting it grants an assistant no access to your systems, your mail, or your account, and there is nothing for it to change. Your domain is not stored. Judge any connector on that basis: what can it read, what can it change, and who can see the result. Here the answers are public information, nothing, and only you.
Do I need to install anything to use it with a local tool?
No. For editors and desktop apps that run tools locally (Claude Code, Claude Desktop, Cursor, Windsurf, Zed), add a server with the command npx and the arguments -y @fyzno/mcp, and it fetches on first use. The hosted https://fyzno.com/mcp URL is for ChatGPT and claude.ai in the browser, which cannot run a local process. Both routes expose the same seventeen tools and return identical results.
What is MTA-STS?
MTA-STS (Mail Transfer Agent Strict Transport Security) tells mail servers to deliver to a domain only over TLS, and names the host to use. The check reads the _mta-sts DNS record, fetches the policy file over HTTPS, and reports whether the mode is testing or enforcing.
A score is not a fix.
The check reads what is published and says plainly what is missing. Changing any of it is a short list of record changes, and we would rather you made it with us than against a wall of documentation.