Review public DNS for mail routing, sender authentication and transport-security policy. The free checker can query A/AAAA, CNAME, MX, SPF, DMARC, MTA-STS, TLS reporting and DNSSEC records, plus optional DKIM selectors, after you click.
Mail exchangers tell sending systems where a domain says inbound email should be delivered. A Null MX (0 .) explicitly says the domain does not accept mail. If no MX record is returned, SMTP may fall back to the domain’s A/AAAA records; neither result proves that a server accepts email. See RFC 7505 and RFC 5321. The lookup shows public DNS answers and their resolver-reported TTL.
An SPF TXT record describes which sending hosts a domain authorizes. The checker finds the published record at the entered name; it does not expand and evaluate the full include/redirect chain or enforce lookup limits. Paste one result into the local SPF record explainer to review terms without a DNS request.
DKIM public keys are published beneath a selector name. Ask the mail administrator for the selector, then query up to three selector names. Use the local DKIM public-key record explainer to read a pasted record. A DNS answer does not prove a message signature is valid.
DMARC TXT policy is usually published at _dmarc.example.com. The checker displays that record; use the local DMARC record inspector to read its tags. Neither tool parses aggregate reports or confirms that every receiver applies the policy. Current DMARC specifications changed older record tags; consult RFC 9989.
The _mta-sts TXT record advertises an MTA-STS policy version and identifier. The policy itself is a separate HTTPS file; this DNS checker displays the TXT discovery record but does not fetch or validate that policy.
The _smtp._tls TXT record advertises where participating senders may report TLS delivery statistics. Seeing the record does not confirm reports arrive or that every sender honors the policy.
The checker can display DS and DNSKEY answers and whether Cloudflare’s resolver reports DNSSEC validation. Record presence alone is not proof that every delegation and signature validates.
Do not copy a policy from another organization or tighten a sending policy until every legitimate mail source is understood. These public checks are evidence for an administrator's review, not a deliverability verdict or a change recommendation.
Open the local email authentication header helperNo. It shows answers returned by one public resolver. It does not connect to mail servers, send a message, verify a signature, or confirm that recipients accept the policy. Use a controlled test and review its received headers with the mail administrator.
The panel may show the configured zone while public resolvers still have cached answers or have not received the change. Compare the returned TTL, authoritative DNS and the resolver view again after the change has propagated; do not make repeated changes just to chase a cached answer.
Ask the administrator or provider that configured outbound mail. The selector is provider-specific and forms part of the DNS name before ._domainkey; guessing a selector cannot establish that a DKIM key is missing.
No. A policy must reflect this domain's legitimate senders and mail flows. Inventory approved services, check provider guidance, keep the current record for rollback and agree on any change with the domain owner.
The DNS request goes directly from your browser to Cloudflare’s public DNS-over-HTTPS resolver after you click the lookup button. Cloudflare receives your IP address and queried domain/record names; Cloudek does not receive or store them. DNS answers can be cached. This is not a complete deliverability test, SPF-chain validator, DKIM signature check, live certificate inspection or DNS change recommendation. CAA is checked only at the entered domain; parent-domain policy is not evaluated. The DNSSEC indicator is reported by Cloudflare’s resolver, not a full independent chain validation.
Use the published records as evidence, then review mail flow and message headers with your authorised Microsoft 365 or mail-provider tools. Our paid Email Authentication & Delivery Review provides a written, bounded assessment when you need operator analysis.
