Free, no signup
See why mail misses the inbox
Free SPF, DKIM, and DMARC tools that read the live DNS records receivers check before they deliver a message.
Each tool answers one question: who may send, what happens when authentication fails, and whether a sending IP is on a blacklist.
Live DNS nothing is stored One domain at a time The fix written out
Email audit
MX, SPF, DKIM, DMARC, TLS-RPT, MTA-STS, and BIMI in one score, with the DNS change for each miss.
Open toolSPF checker
Read the SPF TXT record and count DNS lookups. The 11th lookup returns PermError.
Open toolDMARC checker
Read p=none, quarantine, or reject, plus the rua address that receives daily reports.
Open toolPostmaster audit
The SPF, DKIM, and DMARC records Gmail and Outlook require from bulk senders.
Open toolRisk scan
A pre-send score for a missing DMARC policy, an SPF PermError, and a domain with no mail history.
Open toolHeader analyzer
Paste a raw header. Read whether SPF, DKIM, and DMARC passed for that email.
Open toolBlacklist checker
See whether the domain’s sending addresses appear on public DNS blacklists.
Open toolDMARC report
Open an aggregate report and see which IPs sent as your domain, with pass and fail counts.
Open toolDirect answer
What decides whether an email is delivered?
Receivers decide before they read the message. They look up three DNS records: SPF says which servers may send for the domain, DKIM proves the message was not changed, and DMARC says what to do when those checks fail. A missing record, two SPF records, or a DMARC policy of p=none with failing mail is a common reason a message is rejected or filed as spam.
- SPF is one TXT record starting with v=spf1. More than 10 DNS lookups makes it fail with PermError.
- DKIM is a public key at selector._domainkey. The sending server signs the message; receivers verify the signature.
- DMARC is a TXT record at _dmarc. The p= tag is none (monitor), quarantine, or reject.
- Gmail and Yahoo require SPF, DKIM, and a DMARC record from bulk senders. A record alone does not build a sending reputation.
Questions people ask
Do these tools send email or store the domain?
No. Each check reads public DNS, or a header or XML file you paste. Nothing is written to an account, and there is no signup.
Will a perfect score put mail in the inbox?
Passing SPF, DKIM, and DMARC is required, and it is not sufficient. A new domain, a sudden jump in volume, or a high complaint rate can still land mail in spam. Warm the domain after the records pass.
Which tool should I run first?
Start with the email audit. It reads every record in one pass. Use the SPF checker when the audit reports a lookup limit, and the DMARC checker when the policy is still p=none.
What is the difference between the audit and the postmaster audit?
The email audit scores the full authentication set, including MX, MTA-STS, TLS-RPT, and BIMI. The postmaster audit checks only the records Gmail and Outlook require from bulk senders. Neither tool can see the reputation score inside Google Postmaster Tools.
The records are only half of inbox placement.
Once SPF, DKIM, and DMARC pass, a cold domain still needs a slow sending history. iSend warms the domain and sends with the same authentication these tools just checked.