Email Configuration Checker

Validate your MX, SPF, DKIM and DMARC records for errors.

Start monitoring
See all checkers

Email authentication lives in a handful of DNS records, and the rules around them are unforgiving: two SPF records instead of one breaks SPF entirely, an SPF that needs more than ten DNS lookups silently fails, an MX pointing at a host that no longer resolves drops your mail. None of this produces an obvious error — your email just quietly starts going to spam or bouncing. An email configuration checker validates these records against the rules and tells you exactly what is wrong.

What it checks
  • MX records present, and every mail host actually resolves (no dangling MX)
  • Exactly one SPF record (multiple is an error that breaks SPF)
  • SPF within the 10 DNS-lookup limit, with an "all" mechanism
  • A single valid DMARC record with a policy
  • DKIM signing key published, plus optional MTA-STS and TLS-RPT

Why it matters

These are correctness rules, not preferences — break one and authentication fails outright, no matter how good the rest of your setup is. The failures are invisible until deliverability drops, and they often appear right after a routine DNS change or adding a new sending tool. Validating the records continuously means a broken change is caught in hours, not after weeks of mail quietly landing in spam.

How BrandSentryPro does it

Add your domain and BrandSentryPro validates your MX, SPF (including a recursive count of its DNS lookups), DMARC, DKIM and modern TLS records, flags every error and weakness with how to fix it, and re-checks on a schedule — alerting you the moment a record breaks or changes.

Frequently asked questions

Why does having two SPF records break email?
The SPF specification (RFC 7208) allows only one SPF record per domain. When a receiver finds two, the result is a permanent error (permerror) and SPF is treated as failing — so a second record, often added by accident when onboarding a new sender, silently breaks authentication.
What is the SPF 10-lookup limit?
An SPF record may trigger at most 10 DNS lookups (from include, a, mx, ptr, exists and redirect mechanisms). Exceeding it causes a permerror and SPF fails. Stacking up several "include:" entries from different mail services is the usual cause; flattening or trimming includes fixes it.
What is a dangling MX record?
A dangling MX is an MX record pointing at a hostname that no longer resolves to an IP. Mail to the domain can fail or be delayed, and a dangling host can sometimes be claimed by an attacker. A checker flags MX hosts that do not resolve so you can fix or remove them.

Related checkers

Mixed Content Checker
Find insecure HTTP resources loaded on your HTTPS pages.
Security Headers Checker
Check for HSTS, CSP, X-Frame-Options and the other headers that protect your users.
Vulnerability Scanner
Detect outdated software and known, exploitable vulnerabilities.
Domain Expiration Checker
Never lose a domain to a missed renewal again.
IP Blacklist Checker
See if your server IP has landed on spam or malware blacklists.
Server Hardening Checker
Check Fail2Ban, rate limiting, hidden version tokens and OS updates.
OpenVAS Vulnerability Scan
Run a deep network vulnerability assessment across every exposed service.
Nameserver Checker
Track your domain's authoritative nameservers and get alerted the moment they change.
TLS Version Checker
See which TLS versions your site offers — and get alerted if a deprecated one comes back.
Certificate Chain Checker
Catch a missing intermediate before it breaks mobile apps and APIs.
Typosquatting Checker
Find the lookalike domains attackers register to phish your customers.
Subdomain Takeover Checker
Find dangling subdomains an attacker could hijack to impersonate you.
DNS Record Change Checker
Get alerted the moment your A, MX, NS or TXT records change.
Phishing Domain Checker
Catch the brand + "login" domains attackers register to phish your customers.
Dependency Vulnerability Checker
Find outdated jQuery, Bootstrap and other libraries with known CVEs on your site.
Email Blacklist Checker
See if your domain or mail server is on an email blacklist.
Email Spam Rating Checker
See how likely your email is to be marked as spam — and why.
Malware Blacklist Checker
See if your site is flagged for malware, phishing or botnet activity.
Google Safe Browsing Checker
Check if your site triggers the browser malware/phishing warning.
Trustpilot Monitoring
Track your Trustpilot TrustScore and get warned when it drops.
Leaked Credential Checker
See if your domain has appeared in a known data breach.
Google Business Profile Monitoring
Track your Google star rating and get warned when it drops.
Brand Mention Monitoring
Get alerted when your brand is mentioned somewhere new on the web.
All in one place

Run this check automatically

Add a monitor and BrandSentryPro keeps every check running for you — with alerts the moment something needs attention.

Get started