Type your domain.See what receivers see.
A free email checker that tests SPF, DKIM, DMARC, MTA-STS over HTTPS, a real STARTTLS handshake, certificates and server reputation, and says in plain words what to fix. No account, nothing stored.
For machines: the report is JSON at /api/mail?d=yourdomain. Assistants can run this check themselves: add https://fyzno.com/mcp as a connector in ChatGPT or Claude and ask them to check a domain. See the FAQ below for the two-minute setup.
What the check reads
- Mail routing
- MX records, fallback when none exist, and whether any answer.
- SPF
- Who may send from the domain, and whether the list closes.
- DKIM
- The signing key, its size, and whether the first selector is published.
- DMARC
- Instructions for receivers on spoofed mail, and where reports go.
- MTA-STS
- The policy over HTTPS, and whether TLS between servers is enforced.
- SMTP TLS
- A real STARTTLS handshake with mail servers, and what it negotiates.
- Certificates
- The certificate behind each connection, its issuer, and expiry.
- TLS-RPT
- Whether TLS failures between servers are reported anywhere.
- Reputation
- The sending server, checked against Spamhaus ZEN.
- BIMI and web headers
- The logo a receiver can verify, and the security headers the site sends.
How to fix what it finds
- Why your email goes to spam, and what to check firstMail from your domain lands in spam? Check these in order: SPF, DKIM, DMARC, reverse DNS, blocklists and TLS. What each one is and how to fix it.
- How to set up DMARC, step by stepSet up DMARC without breaking your mail: publish p=none with reports, fix what fails, then move to quarantine and reject. With example records.
- SPF 'too many DNS lookups' (PermError): how to fix itSPF allows at most 10 DNS lookups. Over that, SPF fails with a PermError. What counts, what does not, and how to get back under the limit.
- What MTA-STS is, and how to set it upMTA-STS makes other mail servers use encryption when they send to you. A DNS record, a small policy file over HTTPS, and TLS-RPT to watch it.
- Email bounce codes explained: 550 5.7.26, 5.7.1, 5.1.1 and moreWhat an email bounce code means and how to fix it: 550 5.7.26, 554 5.7.1, 550 5.1.1, 421 4.7.0 and more, grouped by cause and in plain words.
- DKIM setup: how to turn it on and check that it worksHow to set up DKIM for your domain: where the key comes from, the DNS record to add, how to find your selector, and how to check signing works.
Asked often
What does the mail health check check?
Mail routing, SPF, DKIM, DMARC, the MTA-STS policy fetched over HTTPS, TLS-RPT, a live STARTTLS handshake with mail servers, certificates, and the sending server's listing on Spamhaus ZEN. BIMI, IPv6, web security headers, and DNS hygiene are checked for information and never move the score.
Is the mail health check free?
Yes. No account, no trial, nothing to install. The domain goes to our DNS resolver and the mail servers it names. The report is generated from the answer.
What does the score out of 100 mean?
Nine core checks add up to 100: routing 10, SPF 15, DKIM 15, DMARC 15, MTA-STS 10, TLS-RPT 5, SMTP TLS 15, certificates 10, reputation 5. A check that cannot be tested from our network earns zero and is marked not tested. A score is only as good as the network that ran it.
Does the check store my domain?
No. The domain goes to our DNS resolver and the mail servers it names, for the handshake. Nothing is stored. The report is generated from the answer.
Why does it say the SMTP handshake was not tested?
Some networks, including many home networks, block outbound port 25. When our check cannot reach mail servers on port 25, SMTP TLS and certificate checks report not tested rather than guess. The score reflects only what could be verified.
What is MTA-STS?
MTA-STS (Mail Transfer Agent Strict Transport Security) tells mail servers to deliver to a domain only over TLS, and names the host to use. The check reads the _mta-sts DNS record, fetches the policy file over HTTPS, and reports whether the mode is testing or enforcing.
A score is not a fix.
The check reads what is published and states what is missing. Changing it is a short list of record updates. We would rather you made it with us than against documentation.