Email setup of google._domainkey.github.com.
Everything that decides whether a domain's mail arrives and whether its name can be faked, checked at once and explained.
Looking up…
What the report checks.
- MX: where mail to the domain is delivered.
- SPF: which servers may send mail as the domain.
- DKIM: the keys that sign outgoing mail, so receivers can tell it was not changed or forged.
- DMARC: what receivers should do with mail that fails, and where they send reports.
- MTA-STS and TLS reporting: encrypted delivery to the domain, and reports when it fails.
- BIMI: the brand logo some inboxes show next to authenticated mail.
What most domains need.
A domain that sends mail needs SPF, DKIM and DMARC. Since February 2024 Gmail asks every sender to set up SPF or DKIM, and anyone sending more than 5,000 messages a day to Gmail accounts to have all three. MTA-STS, TLS reporting and BIMI are extras that larger senders add once the basics work.
A domain that sends no mail.
Even a domain that never sends mail can be used to fake mail. Protect it with three records: v=spf1 -all (no server may send), a DMARC record with p=reject, and a null MX (0 .) if it should receive nothing either.
Questions people ask.
What does the email deliverability checker test?
The DNS setup that decides whether a domain's mail is trusted: mail servers (MX), SPF, DKIM, DMARC, MTA-STS, TLS reporting and BIMI, with what to fix. It reads public records only and sends no email.
Why do my emails go to spam?
Common causes are missing SPF, DKIM or DMARC records, a broken SPF record, or a sending IP address without reverse DNS. Content and sending reputation matter too, but a broken setup fails first.
Do I need SPF, DKIM and DMARC?
For a domain that sends mail, yes. Since February 2024 Gmail asks every sender for SPF or DKIM, and senders of more than 5,000 messages a day to Gmail for all three.
Does this tool send a test email?
No. It only reads the domain's public DNS records and its MTA-STS policy file.
Hivex index
Short names, still free to register.
Starting something new? Hivex keeps a live index of short, brandable .si names nobody has claimed yet, each checked with the registry.
From code, or an AI assistant.
Hivex's free JSON API and MCP server check domains, DNS and registration records from your own code or from AI assistants that speak MCP. No key needed.
More Email tools
- SPF checkerEvery include followed, the 10-lookup limit counted, mistakes named.
- DKIM checkerFinds keys at common selectors and checks their type and size.
- DMARC checkerPolicy, alignment and report addresses, checked and explained.
- SPF generatorPick your mail services, get one record that stays under 10 lookups.
- DMARC generatorPolicy, reports and alignment, with a safe rollout path.
- MTA-STS checkerPolicy record, policy file, MX match and TLS reports.
- BIMI checkerRecord, DMARC, SVG logo and VMC or CMC, with a preview.
- Email blacklist checkerAn IP or a domain against live email blocklists.
- Email header analyzerWho sent it, SPF, DKIM, DMARC and every hop, in your browser.
- SMTP testGreeting, STARTTLS and sign-in methods on 587 and 465.
- Domain checkerIs a name free to register? Checked live on any extension.
Sources
- RFC 7208: Sender Policy Framework (SPF)
- RFC 6376: DomainKeys Identified Mail (DKIM)
- RFC 7489: DMARC
- RFC 8461: SMTP MTA Strict Transport Security (MTA-STS)
- RFC 8460: SMTP TLS reporting
- Google: Email sender guidelines (since 1 February 2024)
By Hivex. Updated 10 October 2026. Lookups run live through Cloudflare's public resolver and are kept for at most five minutes.