Email infrastructure tools

Correctness-led checks for publicly observable email infrastructure. Every finding explains what it found, why it matters, and how to fix it.

Domain health 1
Authentication 6
  • SPF checker

    Validate an SPF record, count the 10-lookup and 2-void limits, and test whether an IP would pass.

  • DMARC checker

    Read the DMARC policy, resolve the organisational domain, and check report authorisation.

  • DKIM checker

    Read a DKIM key by selector, follow CNAME chains, and report the exact key size.

  • DKIM selector finder

    Probe a list of common DKIM selectors for a domain.

  • SPF dependency tree

    Expand every include and redirect into a tree and see where the 10-lookup budget goes.

  • DMARC record builder

    Build a correct RFC 9989 record, checked against what the domain already publishes.

Routing and encryption 8
  • MX lookup

    List MX records, resolve each mail host, and identify the likely provider.

  • DNS lookup

    Look up a domain's DNS records: A, AAAA, MX, TXT, NS, SOA and CAA at once, or a single type you choose. Shows the raw records and their DNSSEC state.

  • MTA-STS checker

    Read the record and policy, and cross-validate the policy against the real MX records.

  • TLS-RPT checker

    Check the TLS reporting record and its endpoints.

  • DANE/TLSA checker

    Check TLSA records and their DNSSEC state for every mail host, against the SMTP profile.

  • Reverse DNS checker

    Check the PTR record and forward-confirmed reverse DNS for an IP address.

  • Mail infrastructure hardening

    The modern-hosting signals under your mail, from public DNS: DNSSEC on the domain and mail hosts, IPv6 on the mail hosts and name servers, and CAA certificate-issuance control.

  • Route authorisation (RPKI) checker

    Check whether the mail-host and name-server IP addresses are announced with valid Route Origin Authorisations, using public RIPEstat routing data. Reports RPKI-valid, invalid and unknown, hedged.

Reputation and senders 6
  • Who sends and handles email for a domain

    The email services a domain reveals in public DNS: SPF-authorised senders, DKIM configurations, MX inbound hosts, and DMARC report receivers, each identified by typed evidence and hedged.

  • Bulk sender readiness check

    The DNS-observable half of the Gmail, Yahoo, Microsoft and GMX, WEB.DE and mail.com bulk sender rules, honestly separated from the half DNS cannot see.

  • Non-sending domain checker

    Verify a domain that never sends mail is locked down: null MX, SPF -all and DMARC at reject.

  • Tracking domain health check

    Check an ESP tracking domain: the CNAME chain, dangling-record risk and HTTPS.

  • Domain age and registration lookup

    Registration date, age and registrar from RDAP, the registry's own data service.

  • BIMI checker

    Read the BIMI record, check DMARC eligibility, and safely inspect the logo.

Analyse a message or link 7

What these tools deliberately do not do

No generic blocklist checks. We do not run DNSBL lookups through public or open resolvers and present the output as authoritative. Several major list operators either prohibit unattributable resolver access, require approved access methods, or may return policy or error responses instead of reputation data. Public DNS services can also alter DNS answers, creating false positives or false negatives. Until a list is queried through an operator-approved, attributable method, we do not report a result we cannot trust.

No live SMTP probing. We do not connect to mail servers uninvited. Most hosts block outbound port 25 and probing third-party servers is poor citizenship.

We never fetch unsubscribe links or tracked links from pasted content. A single request could unsubscribe or track a real person.