Question 1

What records does this tool check?

Accepted Answer

It analyzes SPF (including DNS lookup count), DKIM, DMARC, MTA-STS, BIMI, TLS-RPT, MX, FCrDNS, DNSBL blacklists, DNSSEC, CAA, DANE/TLSA, and Aggregate Performance Reporting (APR). The core authentication records (SPF, DKIM, DMARC, MTA-STS, BIMI, TLS-RPT) contribute to your security score. All others are informational.

Question 2

What is DNSBL and how does the blacklist check work?

Accepted Answer

DNSBL (DNS Blacklist) checks your domain's MX server IPs against major blocklists including Spamhaus ZEN, Barracuda, PSBL, and SORBS. Being listed can cause your emails to be rejected outright by receiving servers. This check is informational and does not affect your score.

Question 3

What does DMARC do and how is it different from SPF and DKIM?

Accepted Answer

DMARC builds on SPF and DKIM by telling receiving mail servers what to do when authentication fails — either monitor, quarantine (spam folder), or reject the message. It also enables aggregate and forensic reports so you can see who is sending email for your domain.

Question 4

Do I need to sign up to check my domain?

Accepted Answer

No. A single-domain DNS check is completely free with no account required. Create a free account to unlock bulk checking (up to 100 domains), continuous monitoring, and weekly digest alerts.

Question 5

What is DKIM and how do I find my selectors?

Accepted Answer

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to outgoing emails. Your email provider publishes a public key in DNS under a "selector" subdomain. Check your ESP's documentation for the correct selector names, or use the DKIM selector lookup on this page.

Question 6

What is MTA-STS and do I need it?

Accepted Answer

MTA-STS (Mail Transfer Agent Strict Transport Security) forces other mail servers to use encrypted TLS connections when delivering email to your domain. It prevents downgrade attacks. While not mandatory, it is recommended for domains that handle sensitive communications.

Question 7

How often should I check my email authentication records?

Accepted Answer

DNS records can change accidentally during infrastructure updates or ESP migrations. We recommend setting up continuous monitoring so you are alerted the same day a record goes missing or changes unexpectedly.

Email Authentication DNS Checker

Frequently Asked Questions