Domain health score →
One check, six lookups, one score out of 100. Run DMARC, SPF (with lookup-chain count), DKIM (auto-probed), MTA-STS, BIMI, and DNSSEC against your domain in parallel — and see exactly what to fix first.
Or run an individual check
DMARC checker
Look up the DMARC record for any domain, parse the policy, and see whether reporting is configured.
Run check →SPF checker
Validate the SPF record for any domain and count the DNS lookups against the 10-lookup limit.
Run check →DKIM checker
Look up the DKIM public key for a selector — verify the key exists, isn’t revoked, and is at least 2048 bits.
Run check →MTA-STS checker
Verify the MTA-STS TXT record. Encrypted-mail-in policy is increasingly required by major receivers.
Run check →BIMI checker
Look up the BIMI record and verify the logo URL plus VMC certificate. Required for branded inbox display.
Run check →DNSSEC checker
Verify DS records exist at the parent zone and that the DNSSEC chain validates correctly.
Run check →