Help / Email health
Email health
Checks a domain’s email setup in one go: MX, SPF, DKIM, DMARC, MTA-STS, TLS-RPT and BIMI, with a pass/warn/fail summary.
How to use it
- Type a domain, or paste an email address and the domain is taken from it.
- Optionally enter your DKIM selector (from your email provider). Without one, 12 common selectors are tried.
- Press Check. The summary at the top lists the most important issue for each part.
Reading the results
- SPF
- A TXT record listing the servers allowed to send as your domain. It may trigger at most 10 DNS lookups.
- DKIM
- A signature on each message, checked against a public key at selector._domainkey.yourdomain.
- DMARC
- Your policy for mail that fails SPF/DKIM (none, quarantine or reject) and where reports go.
- MTA-STS
- Tells other mail servers to require TLS when delivering to you.
- TLS-RPT
- Where to send reports about TLS delivery problems.
- BIMI
- Your logo in supporting inboxes (needs DMARC enforcement, and usually a certificate).
- Null MX
- A record saying the domain never receives mail.
Examples
- gmail.com A large provider
- github.com SPF right at the 10-lookup limit
From the command line
curl "https://tools.nexayori.com/email?q=gmail.com" curl "https://tools.nexayori.com/email?q=gmail.com&format=json"
| q | Domain or email address |
| selector | DKIM selector(s), comma-separated (optional) |
| format | text, json or html |
Questions
DKIM says not found but my mail is signed.
Your provider uses a selector we don’t guess. Find it in a received message’s DKIM-Signature header (s=...) and enter it.
What DMARC policy should I use?
Start at p=none with a rua address to collect reports, fix what fails, then move to quarantine and reject.
Why does going over 10 SPF lookups matter?
Receivers treat SPF as a permanent error, so it stops protecting you. Remove unused includes or flatten them.
Limitations
- Mail servers themselves aren’t contacted (port 25 is blocked from here), only DNS and the MTA-STS policy file.