What items does the email DNS check cover?

It covers 10 email-related DNS records: SPF, DKIM, DMARC, MX, PTR, BIMI, MTA-STS, TLS-RPT, DNSSEC and DANE, queried in real time via DNS-over-HTTPS (DoH), to determine whether each configuration is complete and compliant.

Why check the PTR record?

The PTR reverse-DNS record is an important basis for mail server reputation evaluation. Major recipients (Gmail, Outlook, etc.) require the sending server IP to have a correct PTR record matching the EHLO hostname; missing it leads to rejection or spam-folder delivery.

What problems does the SPF check flag?

Common issues: missing SPF record, multiple SPF records (only one allowed), DNS lookups exceeding the 10-lookup limit (RFC 7208 §4.6.4), a permissive +all policy, and missing -all or ~all terminator.

What problems does the DMARC check flag?

Common issues: missing _dmarc record, p=none policy (monitoring only), missing rua reporting address (no aggregate reports), and SPF/DKIM not configured so DMARC cannot take effect.

Email DNS Diagnostic Tool

Enter a domain to check SPF, DKIM, DMARC, MX, PTR, BIMI, MTA-STS, TLS-RPT, DNSSEC and other email-related DNS records in one click. Based on the RFC standard system with authoritative fix suggestions.

Quick demo: google.com qq.com ztpop.net

DKIM Selector (optional, comma-separated):

Check Report

About This Tool

This tool queries email-related DNS records of a domain in real time via DNS-over-HTTPS (DoH). All queries run in your browser; no query data is recorded or stored.

Checks cover SPF (RFC 7208), DKIM (RFC 6376), DMARC (RFC 7489), MX (RFC 5321 §5), PTR (RFC 1912 §2.1), BIMI (RFC 9608), MTA-STS (RFC 8461), TLS-RPT (RFC 8460), DNSSEC (RFC 9364) and DANE (RFC 7672).

For deeper system-level diagnostics or mail system architecture optimization, please see the Knowledge Base or contact us via the footer.

Why Run Regular Checks

A mail system DNS configuration is a combination punch: MX decides delivery routing, SPF/DKIM/DMARC decide authentication trust, MTA-STS/DANE decide transport encryption, PTR reverse DNS affects some anti-spam policies, and DNSSEC guarantees the integrity of all the DNS queries above.

Any missing or broken piece can cause delivery failure, spam-folder placement, or man-in-the-middle attacks. DNS troubleshooting is often the most time-consuming, because errors hide in details like TTL, record types, and even case sensitivity.

This tool queries 10 categories of critical records in one pass and gives a combined diagnosis across three dimensions — authentication, transport and delivery — helping you locate the problem area quickly before digging deeper.

Interpreting Results

Check	Purpose	Impact if missing/broken
MX	Mail routing	Delivery fails or goes to the wrong server
SPF	Sending authorization	Authentication fails, mail rejected
DKIM	Content signing	Integrity cannot be verified, reputation drops
DMARC	Authentication policy	Forged mail cannot be handled uniformly
PTR	Reverse DNS	Some anti-spam policies reject IPs without PTR
MTA-STS	TLS enforcement	Transport can be downgraded to plaintext
TLS-RPT	TLS reporting	TLS failures go unnoticed
DANE	Certificate pinning	Certificates can be forged
DNSSEC	DNS integrity	The queries above could be tampered with
BIMI	Brand identity	Authenticated mail cannot show the brand logo

Common Configuration Errors & Fixes

Missing MX: add an MX record pointing to your mail server, starting with priority 10
Missing SPF: add v=spf1 mx ~all or extend per your sending architecture
Missing DMARC: start with p=none, observe reports, then upgrade gradually
Missing PTR: contact the ISP owning the IP to add reverse DNS; it must match forward resolution
DNSSEC disabled: enable DNSSEC at your registrar/host, watch DS record synchronization

Email DNS Diagnostic Tool

About This Tool

Why Run Regular Checks

Interpreting Results

Common Configuration Errors & Fixes

📚 Authoritative References