Why this matters now
In February 2024 Google and Yahoo started requiring authenticated email: SPF or DKIM for everyone, and SPF, DKIM, DMARC, alignment and one-click unsubscribe for bulk senders. Microsoft followed for Outlook.com in May 2025, rejecting non-compliant high-volume mail with error 550 5.7.515. In November 2025 Gmail started rejecting non-compliant traffic instead of just filtering it.
If you run a small business or manage domains for clients, the setup is a handful of DNS records — but it's easy to get one subtly wrong. That's what this report finds.
How to read the report
| Mark | Meaning |
|---|---|
| Pass | Correct. Nothing to do. |
| Warning | Works today, but weak or fragile — fix when you can. |
| Fail | Broken or missing; likely to hurt delivery. Fix first. |
| Info | Optional, or context such as the provider we detected. |
| Check yourself | Depends on your messages or sending volume, which DNS can't show. |
The score weighs what the mailbox providers require: DMARC, SPF and DKIM make up 80 of 100 points; MX, MTA-STS, TLS-RPT and BIMI the rest. A failing SPF or DMARC caps the grade at C, whatever else is right.
Questions
Is this email checker free?
Yes. The domain check, every individual checker and both record generators are free, with no account. A paid monitoring tier for agencies (scheduled checks, alerts, DMARC report parsing) is planned.
Do you see or store the domains I check?
DNS lookups go straight from your browser to Cloudflare's and Google's public DNS-over-HTTPS resolvers, so we don't receive them. Only the MTA-STS policy file and BIMI logo/certificate are fetched by our server, because browsers can't, and nothing is stored.
Why don't you check blocklists?
The main blocklists refuse lookups through public resolvers (Spamhaus returns an error code for Cloudflare's resolver) or forbid use in products without a licence. A free browser-based tool would show you false “not listed” results, so we don't pretend. Licensed blocklist monitoring is planned for the paid tier.
Can you check alignment and one-click unsubscribe?
Not from DNS: they're properties of each message. The report shows them as “check yourself” with instructions — open a sent message in Gmail, choose Show original, and look for DMARC: PASS and the List-Unsubscribe-Post header.
My DKIM wasn't found. Is it broken?
Not necessarily. DKIM keys live at a selector name that can't be listed, so we try the common ones. Find s= in a sent message's DKIM-Signature header and enter it as a custom selector.
Sources
- Google — Email sender guidelines
- Google — Email sender guidelines FAQ
- Yahoo Sender Hub — Best practices
- Microsoft — Outlook's new requirements for high-volume senders (April 2025)
- Microsoft — Fix NDR error 550 5.7.515 in Outlook.com
- Spamhaus — Queries via public resolvers like Cloudflare return 127.255.255.254