ITSC / LIVE DIAGNOSTIC
Email DNS & Authentication Checker
Inspect MX, SPF, DKIM, and DMARC records and identify authentication or delivery risks.
Runs on demandNo account requiredActionable output
LIVE EMAIL DNS DIAGNOSTICS
Is your domain ready to send email
that arrives and authenticates correctly?
Inspect MX, SPF, DMARC, and DKIM directly from DNS. The report explains what is correct, what needs attention, and what may affect delivery or enable domain spoofing.
- Live check without an account
- No permanent usage log
- Clear analysis with the original records
MXSPFDKIMDMARC
IDENTITY · AUTHORIZATION · POLICY · DELIVERY
Start with the domain
One check. Four layers.
Enter the domain alone. Add a DKIM selector to inspect a specific key; DNS does not provide a reliable way to discover every selector automatically.Collecting and analyzing DNS records…The check may take a few seconds.
What do we inspect?
Each record answers a different question.
Where does the domain receive email?
MX defines the receiving servers and their priority. Without it, the domain is not configured for standard email reception.
Who is allowed to send?
SPF declares authorized senders. We review duplicate records, the all mechanism, and DNS lookup count.
Does the message carry a trusted signature?
DKIM checks the published key for the selector you provide. The selector is assigned by the email provider and cannot be guessed reliably.
What happens when authentication fails?
We review policy, enforcement percentage, report addresses, and alignment between the visible domain and SPF/DKIM results.
Tool privacy
We inspect data that is already public.
DNS records are public by design. The tool never asks for a password, accesses a mailbox, sends a test message, or creates a permanent usage record. A short cache prevents duplicate queries.
Important: The result diagnoses published records; it does not test a real message, IP reputation, or each provider’s delivery decision.
Quick questions
Before changing DNS.
Why can’t the tool discover DKIM automatically?
DKIM is published under a selector chosen by the provider, and no public DNS list exposes every selector in use. Enter the selector shown in Microsoft 365, Google Workspace, Zoho, or your provider.
Should I publish more than one SPF record?
No. Multiple TXT records beginning with v=spf1 on the same domain almost always cause a permanent error. Authorized senders belong in one SPF record within the DNS lookup limit.
Does DMARC p=none protect the domain?
It is useful for monitoring and reports, but does not ask receivers to quarantine or reject failures. Moving to quarantine or reject requires understanding every legitimate sender first.
Does the result guarantee inbox delivery?
No. Authentication is essential, but delivery also depends on server reputation, content, sending behavior, blocklists, and receiver policy.