Email deliverability
Inspect SPF, DMARC and receiving MX records to narrow down possible causes. This DNS check cannot verify a message's authentication result or confirm delivery.
Instructions, guides and related tools
Result
Diagnostic results will appear here
Related checks and services
Planning email for your own domain? Explore Google Workspace features and service terms.
What this check does
Checks SPF, DMARC, and MX in one pass. DKIM needs a selector, so use its dedicated page.
How to read the result
Check SPF, DKIM and DMARC for sending, and MX for receiving. Healthy DNS does not guarantee delivery. p=none requests no DMARC quarantine or rejection; it does not disable authentication.
Glossary
- MX
- A DNS record naming the servers that receive mail for the domain.
- DKIM
- A digital signature on mail that verifies integrity and origin (needs a selector).
FAQ
- DNS looks healthy but mail still does not arrive
- Check the bounce error code, spam folder, mailbox capacity, forwarding and blocking rules, then compare the sending service's delivery logs. This page does not verify a message signature or make an SMTP connection.
- Can I check SMTP or DNSBL?
- These checks are not available here yet. Unchecked does not mean healthy; use the sending service's logs and the receiving service's administration tools.
Updated:
What to check next
This checks published DNS settings. It does not send email, upload message bodies, or connect to receiving mail servers. Check DKIM separately with the selector from each signature.
1. Separate sending from receiving
For outgoing mail, check the sending service and bounce response. For incoming mail, start with the recipient domain's MX and mailbox settings.
2. Identify one failed message
Record the time, timezone, Message-ID and returned SMTP error code, then compare the sending service's logs. Share only the necessary details with support; keep message bodies and recipient lists out of public posts.
3. Inspect authentication on a received message
Read Authentication-Results added by the receiving service. DMARC requires an authenticated domain aligned with the visible From, as well as SPF or DKIM passing. Record existence alone does not establish that result.
4. Verify actual mail after a change
Record the previous values and TTL, then follow the provider's change procedure. Allow for cached DNS answers, rerun the lookup, and check a small test message and delivery logs for each legitimate sending stream.
Specifications and review date
Guidance reviewed:
