Email infrastructure tools
Correctness-led checks for publicly observable email infrastructure. Every finding explains what it found, why it matters, and how to fix it.
Pick a check, then enter a domain, IP address or URL.
Featured tools
Email domain health check
A single public readiness view of a domain, composed from every individual check.
Who sends and handles email for a domain
The email services a domain reveals in public DNS: SPF-authorised senders, DKIM configurations, MX inbound hosts, and DMARC report receivers, each identified by typed evidence and hedged.
Bounce code explainer
Explain an SMTP bounce code or message, temporary or permanent, with next steps.
Non-sending domain checker
Verify a domain that never sends mail is locked down: null MX, SPF -all and DMARC at reject.
Bulk sender readiness check
The DNS-observable half of the Gmail, Yahoo, Microsoft and GMX, WEB.DE and mail.com bulk sender rules, honestly separated from the half DNS cannot see.
DMARC aggregate report explainer
Paste a RUA XML report and get it in plain English: volumes, pass rate, and which failing sources deserve attention.
Domain health 1
-
Email domain health check
A single public readiness view of a domain, composed from every individual check.
Authentication 6
-
SPF checker
Validate an SPF record, count the 10-lookup and 2-void limits, and test whether an IP would pass.
-
DMARC checker
Read the DMARC policy, resolve the organisational domain, and check report authorisation.
-
DKIM checker
Read a DKIM key by selector, follow CNAME chains, and report the exact key size.
-
DKIM selector finder
Probe a list of common DKIM selectors for a domain.
-
SPF dependency tree
Expand every include and redirect into a tree and see where the 10-lookup budget goes.
-
DMARC record builder
Build a correct RFC 9989 record, checked against what the domain already publishes.
Routing and encryption 8
-
MX lookup
List MX records, resolve each mail host, and identify the likely provider.
-
DNS lookup
Look up a domain's DNS records: A, AAAA, MX, TXT, NS, SOA and CAA at once, or a single type you choose. Shows the raw records and their DNSSEC state.
-
MTA-STS checker
Read the record and policy, and cross-validate the policy against the real MX records.
-
TLS-RPT checker
Check the TLS reporting record and its endpoints.
-
DANE/TLSA checker
Check TLSA records and their DNSSEC state for every mail host, against the SMTP profile.
-
Reverse DNS checker
Check the PTR record and forward-confirmed reverse DNS for an IP address.
-
Mail infrastructure hardening
The modern-hosting signals under your mail, from public DNS: DNSSEC on the domain and mail hosts, IPv6 on the mail hosts and name servers, and CAA certificate-issuance control.
-
Route authorisation (RPKI) checker
Check whether the mail-host and name-server IP addresses are announced with valid Route Origin Authorisations, using public RIPEstat routing data. Reports RPKI-valid, invalid and unknown, hedged.
Reputation and senders 6
-
Who sends and handles email for a domain
The email services a domain reveals in public DNS: SPF-authorised senders, DKIM configurations, MX inbound hosts, and DMARC report receivers, each identified by typed evidence and hedged.
-
Bulk sender readiness check
The DNS-observable half of the Gmail, Yahoo, Microsoft and GMX, WEB.DE and mail.com bulk sender rules, honestly separated from the half DNS cannot see.
-
Non-sending domain checker
Verify a domain that never sends mail is locked down: null MX, SPF -all and DMARC at reject.
-
Tracking domain health check
Check an ESP tracking domain: the CNAME chain, dangling-record risk and HTTPS.
-
Domain age and registration lookup
Registration date, age and registrar from RDAP, the registry's own data service.
-
BIMI checker
Read the BIMI record, check DMARC eligibility, and safely inspect the logo.
Analyse a message or link 7
-
Email header analyser
Parse pasted email headers: the Received chain, authentication results and platform clues.
-
Authentication-Results explainer
Explain SPF, DKIM, DMARC and ARC results from a pasted Authentication-Results header.
-
DMARC aggregate report explainer
Paste a RUA XML report and get it in plain English: volumes, pass rate, and which failing sources deserve attention.
-
List-Unsubscribe checker
Check List-Unsubscribe and one-click headers. We never fetch the unsubscribe link.
-
Bounce code explainer
Explain an SMTP bounce code or message, temporary or permanent, with next steps.
-
BIMI SVG validator
Validate a logo against the SVG Tiny PS profile: structure, scripting, references and size.
-
URL redirect chain checker
Follow a link you own hop by hop: statuses, http downgrades, loops and dead ends.
What these tools deliberately do not do
No generic blocklist checks. We do not run DNSBL lookups through public or open resolvers and present the output as authoritative. Several major list operators either prohibit unattributable resolver access, require approved access methods, or may return policy or error responses instead of reputation data. Public DNS services can also alter DNS answers, creating false positives or false negatives. Until a list is queried through an operator-approved, attributable method, we do not report a result we cannot trust.
No live SMTP probing. We do not connect to mail servers uninvited. Most hosts block outbound port 25 and probing third-party servers is poor citizenship.
We never fetch unsubscribe links or tracked links from pasted content. A single request could unsubscribe or track a real person.
