Email domain health check
Enter the domain you send from. We run nine live checks on its mail records and blocklist status, score them on a published rubric, and list what to fix first.
The rubric, in full
Each check scores 2 for a pass, 1 for improve and 0 for fix. Nine checks make 18 points. A check whose lookup failed shows as not checked and drops out of the total, so the score only ever reflects answers we actually received.
| Check | Pass (2) | Improve (1) | Fix (0) |
|---|---|---|---|
| MX records | MX hosts, all resolving | A host with no address, A fallback, or null MX | No MX and no A record |
| SPF | One record, 10 lookups or fewer, ends -all or ~all | No all, or ?all | Missing, duplicated, over 10 lookups, or +all |
| DMARC policy | p=reject, or p=quarantine at 100% | p=none, or pct under 100 | No record |
| DMARC reports | rua= address set | Record with no rua= | No record |
| DKIM | Key found on a common selector | No key on the common selectors | Key under 1024 bits |
| Domain blocklists | Clear on every list that answered | Listed on any list | |
| MTA-STS | Enforce mode, every MX covered | No policy, or testing mode | Policy unreachable or an MX left out |
| TLS-RPT | Record at _smtp._tls | No record | |
| BIMI | Record at default._bimi | No record |
Thresholds from RFC 7208 (SPF), RFC 7489 (DMARC), RFC 8461 (MTA-STS) and RFC 8460 (TLS-RPT).
What Gmail and Yahoo require of senders
Since February 2024, Gmail and Yahoo require bulk senders to authenticate with SPF and DKIM, publish a DMARC record, and keep spam complaints low. Gmail counts you as a bulk sender at 5,000 or more messages a day to its users. The SPF, DKIM and DMARC lines in the rubric map straight onto those rules.
The rest go further. MTA-STS stops your inbound mail being read in transit, TLS-RPT tells you when that protection fails, and a BIMI record puts your logo in the inbox once DMARC is at enforcement.
How to raise your score
Work from the top of your result down. A missing SPF or DMARC record is a single TXT record to publish, and it moves the score by two points at once. Start DMARC at p=none with a rua= address, read a week of reports in our DMARC report analyzer, then move to quarantine once every real sender passes.
DKIM is set up in each sending service, not in DNS alone. Your email provider gives you the record to publish, and the key only counts once mail is actually signed with it.
MTA-STS and TLS-RPT come last. They take a small web file and two TXT records, and the MTA-STS checker walks through each one. Run the test again after each change; DNS updates reach our resolver within minutes of their TTL expiring.
A healthy domain still needs a healthy list
Perfect records get your mail accepted for checking. After that, receivers judge how you behave, and bounces are one of the loudest signals. A send where every tenth address is dead undoes a lot of careful DNS work. Check your domain reputation if that's already happened.
ZapBounce checks each address with its own SMTP check on port 25, closing before DATA so no mail is sent. Every address comes back valid, invalid, catch-all or unknown, and unknowns and duplicates are never billed. See the pricing: 1,000 checks for $5, and credits that never expire.
Questions people ask
What does a domain health check test?
Nine things that decide whether your mail is accepted: MX records, SPF, DMARC policy, DMARC reporting, DKIM, domain blocklists, MTA-STS, TLS-RPT and BIMI. Each is a live DNS lookup, and each result links to the full tool for that record.
How is the domain health score calculated?
Each check scores 2 points for a pass, 1 for something to improve and 0 for something to fix. The total is shown out of 2 points per check. A check whose lookup failed is shown as not checked and left out of both numbers, so a timeout never lowers or raises your score.
What should I fix first?
Anything marked Fix, starting with SPF and DMARC. Google and Yahoo require SPF, DKIM and DMARC from bulk senders since February 2024, so a failure there costs delivered mail today. MTA-STS and BIMI improve security and branding once the basics pass.
Why does the DKIM check say no key was found?
DKIM keys live at a selector you choose, and DNS has no way to list them. We try the common selectors, such as google, selector1 and k1. If your provider uses another one, check it by name in the DKIM checker.
Your records pass. Now check the list.
Verify every address before your next send, with 100 free checks every month and no card required.