Mail server check
Checks MX, SPF, DMARC and 61 DKIM selectors on a domain. Grades deliverability.
How this tool works
The mail server check evaluates all four critical email security standards in one pass: MX records (which servers receive mail?), SPF (which IPs may send?), DMARC (how should recipients handle unauthenticated mail?) and DKIM (is the signature being served?). Since DKIM selectors can be named arbitrarily, the check probes 61 common selector names — "default", "google", "mail", "selector1", "k1", "mailgun" and more. Result: an A-to-F score plus concrete hardening hints.
Typical use cases
- Before email migration (Microsoft 365, Google Workspace, new ESP), document the baseline
- For spam complaints ("our mail goes to spam"), audit SPF and DMARC specifically
- After setup of a new sender (newsletter tool, CRM), verify all three records are clean
- Before BIMI rollout, ensure DMARC policy is at p=quarantine or p=reject
- Audit external vendors (agency, print provider) for spoofing risk
Frequently asked questions
Why does the check not find my DKIM selector?
We try the 18 most common selector names. If your ESP uses an exotic one (e.g. "20231215"), it is not in our list — check a real email header for "DKIM-Signature: s=...".
SPF, DKIM, DMARC — what is each for?
SPF authorises sending IPs. DKIM cryptographically signs that the message was unaltered. DMARC ties both together and tells receivers what to do on failure (none/quarantine/reject).
Which DMARC policy is the right one?
p=none only during the observation phase (max. 4 weeks). Then p=quarantine pct=10 → 25 → 50 → 100, then p=reject. Below p=quarantine DMARC prevents no spoofing.
Do I need both SPF and DKIM?
Yes. Forwarding scenarios (mailing lists, auto-forwards) break SPF — only DKIM survives. Conversely SPF protects the envelope address, which DKIM does not cover. They complement each other.
What does "SPF -all" vs "~all" mean?
-all = hardfail (mails from unauthorised IPs are rejected). ~all = softfail (marked but delivered). -all is safer but should be set only after a thorough inventory of all sending systems.
Are BIMI records checked?
Yes — we read `default._bimi.<domain>`, parse the logo URL and VMC cert URL. BIMI requires DMARC with p=quarantine or p=reject as a prerequisite, which we check in parallel.
Related tools
Continuous monitoring vs. one-shot?
XICTRAQ monitors uptime, SSL, security headers, GDPR and performance 24/7. Free plan, no credit card.