Will your email reach the inbox? Check your domain's setup
A free check of the DNS records Gmail, Yahoo and Microsoft look at before they accept your mail, including SPF, DKIM and DMARC. Every problem is explained in plain English and ranked, with the exact record to add. It runs in your browser.
Check your domain's email setup
Runs in your browser. Lookups go straight from your browser to Cloudflare's public DNS resolver (Google Public DNS if Cloudflare fails). MailSetupCheck has no server and never sees the domain you check.
What the checker looks at
| Record | Where it lives | What it does | What the checker tests |
|---|---|---|---|
| MX | Your domain | Names the servers that receive your mail | Present or not, null MX, which provider runs it |
| SPF | TXT record on your domain | Lists the servers allowed to send as you | Exactly one record, valid syntax, the 10-lookup limit, how it ends |
| DKIM | TXT or CNAME at selector._domainkey | Publishes the key that proves your mail was not forged | Key found, key size, test mode |
| DMARC | TXT record at _dmarc | Tells receivers what to do when SPF and DKIM fail, and where to send reports | Policy, reporting, subdomains, permission to send reports elsewhere |
| MTA-STS | TXT at _mta-sts, plus a policy file | Makes other servers use encrypted delivery when they send to you | Record valid, policy host exists |
| TLS-RPT | TXT at _smtp._tls | Asks for daily reports on failed encrypted deliveries | Record valid |
| BIMI | TXT at default._bimi | Shows your logo in supporting inboxes | Record valid, DMARC at enforcement, certificate |
The methodology lists every rule, the DKIM selectors the checker tries, and the standards each rule comes from.
What a DNS check cannot see
DNS is public; your messages are not. Several of the Gmail, Yahoo and Microsoft sender rules depend on how each message is sent, so no DNS check can confirm them:
- Alignment. DMARC passes only when the domain in your From address matches the domain that SPF or DKIM checked. That depends on your sending service's settings. To see it, send a message to a Gmail address, open it, choose "Show original", and look for
dmarc=passin theAuthentication-Resultsheader. - Your sending servers. Gmail and Yahoo also require reverse DNS (PTR) records and encrypted connections from the servers that send your mail. Google Workspace, Microsoft 365 and the large sending services handle both.
- Spam rate. Gmail asks for under 0.1% and acts at 0.3%. Google Postmaster Tools shows your rate once you send enough mail to Gmail users.
- Unsubscribe headers. Marketing mail to Gmail and Yahoo users needs one-click unsubscribe, which is a header in each message, not a DNS record.
- DKIM keys at names nobody can guess. DKIM keys sit under a name the sender picks. The checker tries the common ones; if yours is unusual, enter it under Options. The
s=value in theDKIM-Signatureheader of a message you sent is your selector.
Guides
- Gmail and Yahoo bulk sender requirements explained: what each mailbox provider requires, who counts as a bulk sender, and what happens when you miss.
- SPF too many DNS lookups: how to fix: why the limit is 10, how many lookups common services cost (measured), and the safe fixes.
- DMARC p=none to reject: a safe rollout: how to move from monitoring to protection without blocking your own mail.
- Cold email that stays legal: CAN-SPAM in plain English, with the mailbox providers' rules on top.
- Cold email cost calculator: inboxes, domains, warmup time and monthly cost for a sending target.
How the checker works
Your browser asks a public DNS resolver for each record: Cloudflare's DNS-over-HTTPS service, and Google Public DNS if Cloudflare does not answer. MailSetupCheck has no server in that path, so the domain you check is never sent to this site (privacy). The rules that turn records into fixes are plain JavaScript, tested against recorded DNS answers before every deploy, and each one links to the standard or mailbox-provider page it comes from.
More free tools and guides
-
Cold email cost calculator
Inboxes, domains, warmup weeks and monthly cost for a daily sending target, with sourced prices for Google Workspace, Microsoft 365, Instantly, Smartlead, lemlist and three verification services.
-
Cold email that stays legal
CAN-SPAM's seven requirements in plain English, the $53,088 per-email penalty, and the mailbox-provider rules on top.
-
DMARC rollout, p=none to reject
Monitoring to protection without blocking your own mail, updated for RFC 9989 (pct removed, t=y added).
-
Gmail and Yahoo sender rules
Who counts as a bulk sender, what Gmail, Yahoo and Outlook.com require, and what happens when you miss, from each provider's own pages.
-
SPF too many DNS lookups
Why the limit is 10, what each common service costs (measured from live DNS), and the fixes in order of safety.
Also available as Markdown.