Email DNS Health Check — SPF, DKIM, DMARC & MX Score
Holistic 0–100 email DNS health score from SPF, DKIM, DMARC validity and MX presence
How to Use This Tool
- Enter the domain that sends or receives mail.
- Parallel checks fetch SPF, DKIM, DMARC via checkEmailDns and MX records.
- Each authentication type contributes up to 25 points when found and valid.
- Partial credit applies when records exist but fail validation.
- MX adds up to 25 points when at least one MX exists.
- Review score, overall label, emailDns detail, and mxRecords together.
About This Tool
Email DNS health is the combination of MX routing plus SPF, DKIM, and DMARC authentication — one missing piece sinks deliverability and raises spoofing risk. VSPIC email DNS health check calls email-deliverability for the domain you submit, runs checkEmailDns with default selector fallback for DKIM, fetches MX in parallel, and returns score 0–100, overall good/fair/poor, structured emailDns.records for each authentication type, and mxRecords list.
This page targets operators who want a single health verdict before campaigns, after migrations, or during quarterly mail hygiene reviews — not deep single-record tooling. Use SPF, DKIM, and DMARC checker pages when you need focused remediation copy on one record type.
Common use cases
- •View all DNS records of a domain after migration
- •Confirm DNS records after domain changes
- •Test for DNS leaks when using a VPN
- •Debug email delivery with MX and TXT records
Why use VSPIC for ?
- Single health score across four mail DNS pillars.
- good, fair, poor labels for executive reporting.
- Structured emailDns breakdown per authentication type.
- MX list confirms inbound routing targets.
- DKIM tries default then common alternate selectors.
- Free read-only audit — no test email required.
What email DNS health means
Healthy mail DNS means receivers can route to your MX, authorize sending IPs via SPF, verify signatures via DKIM, and apply domain policy via DMARC. Weakness in any pillar causes spam placement, bounces, or spoofing exposure.
Our health check scores all four areas in one pass — the same backend as email-deliverability-checker with health-oriented positioning for this missing-tool slug.
Score calculation and overall labels
SPF, DKIM, and DMARC each contribute up to 25 points — full when found and valid, partial when found but invalid, zero when missing. MX adds 25 when any record exists. Maximum 100.
overall good at 80+, fair at 50–79, poor below 50. Fair usually means fixable gaps. Poor indicates missing MX or multiple broken records.
Reading emailDns.records
Each row includes type, found, valid, host, value, message, details, and optional warnings. SPF warnings may cite lookup limits. DMARC details parse p= and rua. DKIM message notes when an alternate selector was discovered.
Use messages as first remediation hints before opening DNS panels.
MX and inbound health
mxRecords lists exchangers with priorities. Health scoring awards points for presence, not whether targets match your documented mail host. Verify primary MX after Google or Microsoft cutovers.
Sending-only domains may use null MX — expect lower scores by design even when outbound authentication is perfect.
DKIM selector behavior in health check
checkEmailDns starts at default._domainkey then tries common alternates if default is empty. Health score may credit DKIM when dkim-record-checker on default alone shows found false.
Confirm active selector with dkim-key-checker when JSON cites a non-default selector.
Remediation by score band
Poor: fix MX if missing, publish SPF with -all, enable DKIM signing, add _dmarc at least p=none with rua. Fair: tighten invalid records, move DMARC toward quarantine. Good: maintain quarterly rechecks and monitor after DNS edits.
Re-run after TTL propagation following fixes.
Relationship to focused checker pages
SPF record checker, DMARC record checker, and DKIM record checker share APIs but emphasize single-record workflows. email-dns-health-check is the umbrella audit.
Pair with smtp-server-lookup for MX IPv4 detail and email-spoofing-test for attacker-centric risk scoring.
Compliance and vendor questionnaires
Export score, overall, and emailDns snapshot for SOC2 and vendor security forms. Document queriedAt from underlying lookups in evidence binders.
Health check proves DNS intent — pair with Authentication-Results on test messages for live signing proof.
Limits of DNS-only health
IP blacklists, content spam triggers, and engagement metrics affect inbox placement beyond this score. Run IP reputation on outbound SMTP hosts.
A score of 100 does not guarantee marketing deliverability if list hygiene is poor.
API automation
GET /ip-tools/api/extended?action=email-deliverability&domain=example.com returns score, overall, emailDns, mxRecords. Fail CI when score drops below threshold after DNS changes.
Respect rate limits on scheduled health polling.
Important notes & limitations
- DNS configuration only — not IP reputation or content filters.
- DKIM selector not configurable on this form — uses default with alternates.
- Does not verify PTR or TLS on MX hosts.
- Score is heuristic — receivers weight factors differently.
- Null MX domains score low on MX by design.
Frequently Asked Questions
Yes. VSPIC offers this email DNS health check at no cost with no account required. Results load in real time.
We do not permanently store your queries on our servers. Some tools run entirely in your browser; others fetch public data for the request only.
Yes. Open the page in any modern phone or tablet browser. Results work on Wi‑Fi and mobile data.
Same email-deliverability API and JSON shape. This page targets email DNS health check search intent and holistic health language.
80+ good with valid SPF, DKIM, and DMARC is baseline. Also verify sending IP reputation and list practices.
checkEmailDns tries alternate selectors when default is empty. See message text for the selector used.
No. Public DNS analysis only.
Yes. Enter the domain that appears in From or Return-Path when providers use subdomain signing.
email-deliverability with a domain parameter.
Next step for your check
Continue with email deliverability checker on VSPIC.
Related Tools
Explore more free VSPIC tools for IP, DNS, security, and network diagnostics.
Email Deliverability Checker
Analyze SPF, DKIM, DMARC, MX, and deliverability score
Use Free →SPF Record Checker
SPF Record Checker — free online tool
Use Free →Mail Server Lookup
Mail Server Lookup — free online tool
Use Free →Email Spoofing Test
Score domain spoofing risk from SPF, DKIM, and DMARC policy gaps
Use Free →DNS Lookup Tool — DNS Checker
Free DNS lookup tool and DNS checker — query A, AAAA, MX, TXT, NS, CNAME, and SOA records for any domain.
Use Free →Reverse DNS Lookup
Resolve IP addresses to hostnames via PTR records
Use Free →
Trusted by Users Who Value Privacy
Always Free
No premium plan ever
100% Private
Files processed in browser
Instant Results
Convert in seconds
Works Everywhere
Any device, any OS