Check your domain's email records
We look at your MX, SPF, DKIM, DMARC, MTA-STS and TLS-RPT records and tell you what is missing and what to do. It's free and needs no sign-up.
What we check
Six records work together so that your email reaches the inbox and nobody can send email in your name.
MX
20 pointsReceiving mail
Tells senders which server accepts email for your domain. Without MX, email can't reach you.
What is MX?SPF
20 pointsAuthorized senders
Lists the servers allowed to send email for your domain. Receivers distrust senders that aren't on the list.
What is SPF?DKIM
20 pointsDigital signature
The public key for the signature added to outgoing messages. It proves a message came from you and wasn't changed on the way.
What is DKIM?DMARC
25 pointsIdentity policy
Tells receivers what to do with messages that fail SPF and DKIM, and asks them to send you reports.
What is DMARC?MTA-STS
10 pointsEncrypted delivery
Asks senders to deliver email to your domain only over an encrypted, verified connection.
What is MTA-STS?TLS-RPT
5 pointsDelivery reports
Gives the address where problems with encrypted delivery are reported.
What is TLS-RPT?
Frequently asked questions
What does this tool check?
It reads your domain's public DNS records: the servers that receive your email (MX), the servers allowed to send for you (SPF), the digital signature key (DKIM), the identity policy (DMARC), the encrypted delivery policy (MTA-STS) and delivery reports (TLS-RPT). For each one it shows the status and what you should do.
Does the check change anything on my domain?
No. The tool only reads public DNS records and changes nothing on your domain. The domain you look up isn't stored in a database; if the same domain is checked again shortly, the result is kept in memory for a few minutes.
Why doesn't a record I just added show up?
Lookups go to your domain's authoritative name servers, so changes usually show up quickly. Because the result for a domain is kept for 5 minutes, check again a few minutes after adding a record. Adding the record under the wrong name is another common cause; see the name field notes in the guides.
Why does DKIM show as not found?
A DKIM key sits under a selector name chosen by the provider (for example google._domainkey). The tool tries the selectors used by Google Workspace, Microsoft 365, Yandex, Zoho, common hosting companies and Mühür Mail. If your provider uses a different selector, the key may exist but not be found, which is why the result is shown as info.
How is the score calculated?
MX is worth 20 points, SPF 20, DKIM 20, DMARC 25, MTA-STS 10 and TLS-RPT 5. A check that is OK earns its full points; one that can improve or is shown as info earns half. 80 or more is good, 50 or more has room to improve.
Let Mühür Mail prepare your records
When you add your domain to Mühür Mail, the MX, SPF, DKIM, DMARC, MTA-STS and TLS-RPT records you need are ready for you. They are checked regularly, and you are told if something breaks. If your DNS is on Cloudflare, the records are added automatically with your approval.