Free check
Type your domain.See what a receiver sees.
The same checks we run for a client, deeper than a record lookup: SPF, DKIM, DMARC, the MTA-STS policy over HTTPS, a real STARTTLS handshake with the mail servers, the certificates behind it, and the reputation of the server that sends. No account, nothing stored. The report is yours to keep.
The domain goes to our DNS resolver and to the mail servers it names, for the handshake. Nothing is stored, and the report is generated from the answer.
For machines: the report is JSON at /api/mail?d=yourdomain. Assistants can run this check themselves: add https://fyzno.com/mcp as a connector in ChatGPT or Claude and ask them to check a domain. See the FAQ below for the two-minute setup.
What the check reads
01
Mail routing
The MX records, the fallback when there are none, and whether any of them answer.
02
SPF
Who may send from the domain, and whether the list actually closes.
03
DKIM
The signing key, its size, and whether the selector receivers try first is published.
04
DMARC
What receivers are told to do with spoofed mail, and where the reports go.
05
MTA-STS
The policy over HTTPS, and whether TLS between servers is enforced.
06
SMTP TLS
A real STARTTLS handshake with the mail servers, and what it negotiates.
07
Certificates
The certificate behind each connection, its issuer, and its expiry.
08
TLS-RPT
Whether TLS failures between servers are reported anywhere.
09
Reputation
The sending server, checked against Spamhaus ZEN.
10
BIMI and web headers
The logo a receiver can verify, and the security headers the site sends.
Questions
What does the mail health check check?
Mail routing, SPF, DKIM, DMARC, the MTA-STS policy fetched over HTTPS, TLS-RPT, a live STARTTLS handshake with the mail servers, the certificates behind that connection, and the sending server's listing on Spamhaus ZEN. BIMI, IPv6, web security headers, and DNS hygiene are checked for information and never move the score.
Is the mail health check free?
Yes. No account, no trial, nothing to install. The domain goes to our DNS resolver and to the mail servers it names, and the report is generated from the answer.
What does the score out of 100 mean?
Nine core checks add up to 100: routing 10, SPF 15, DKIM 15, DMARC 15, MTA-STS 10, TLS-RPT 5, SMTP TLS 15, certificates 10, reputation 5. A check that cannot be tested from our network earns zero and is marked not tested, so a score is only as good as the network that ran it.
Does the check store my domain?
No. The domain goes to our DNS resolver and to the mail servers it names, for the handshake. Nothing is stored, and the report is generated from the answer.
Why does it say the SMTP handshake was not tested?
Some networks, including many home networks, block outbound port 25. When our check cannot reach the mail servers on port 25, the SMTP TLS and certificate checks report not tested rather than guess, and the score reflects only what could be verified.
What is MTA-STS?
MTA-STS (Mail Transfer Agent Strict Transport Security) tells mail servers to deliver to a domain only over TLS, and names the host to use. The check reads the _mta-sts DNS record, fetches the policy file over HTTPS, and reports whether the mode is testing or enforcing.
A score is not a fix.
The check reads what is published and says plainly what is missing. Changing any of it is a short list of record changes, and we would rather you made it with us than against a wall of documentation.