Deliverability
DNS Checker
Looks up the DNS records a sending domain needs (MX, SPF, DKIM, DMARC and the rest) and checks the website certificate on the way.
- Runs on our server
- 1 unit per run
- You enter
- A domain, the record types to check and, for DKIM, a selector.
- You get
- Every record found, a pass or warning per check and an overall verdict.
- A good result
- SPF that includes Ecomail, DKIM found for your selector, DMARC present and a valid certificate.
On this page
#What it is for
Use it first whenever mail from a domain is rejected, lands in spam or fails authentication, and after every DNS change during onboarding. It answers one question quickly: is the domain set up to send through Ecomail?
#What you enter
- Domain:
example.com. A pasted URL is fine, the address and path are removed. - Record types: A, AAAA, CNAME, MX, TXT, NS, SOA, SRV, CAA, SPF, DKIM and DMARC. Email defaults ticks MX, TXT, SPF, DKIM and DMARC; Check all and Check none do what they say. Everything except DKIM is ticked at first.
- DKIM selector: used only when DKIM is ticked. The chips fill common ones (
ecomail,google,default,k1,selector1).
Your selection and the last selector are remembered in this browser. A link with ?domain=example.com runs the check straight away; selectedRecords= and dkimSelector= preset the rest.
#How it works
- One live DNS query per record type. Only records for exactly the name you typed are kept, so a CNAME is shown, not followed.
- SPF is read from the TXT records. DKIM is looked up as TXT and CNAME at
selector._domainkey.example.com. DMARC is the TXT record at_dmarc.example.comthat starts withv=DMARC1. - Alongside, it opens the website over HTTPS to check the certificate, whether HSTS is sent, and whether a proxy such as Cloudflare sits in front.
#Reading the results
The verdict at the top is "Everything looks great", "Mostly good" (only warnings) or "N issues found" (at least one failure). Below it come Security, Email authentication, Domain records and the raw JSON.
| Check | Pass | Warning | Fail |
|---|---|---|---|
| SPF | Includes Ecomail (ecomail or sparkpostmail.com) | A record exists but without Ecomail | No SPF record |
| DKIM | TXT with v=DKIM1, or a CNAME, at the selector | Nothing at the selector | |
| DMARC | Record present | No record | |
| Other types | Records found | Ticked but none found | |
| HTTPS | Valid certificate, HSTS sent | No HSTS | Certificate invalid or unreachable |
A "Next" hint may appear after the check: check the tracking domain, add a DKIM selector, or read how to add DMARC.
#Adding a DMARC record
DMARC tells receiving servers what to do with mail that fails SPF and DKIM alignment. Without it, many mailbox providers treat bulk mail with more suspicion. Add a TXT record at _dmarc of your domain. Start with monitoring only:
Name: _dmarc.example.com
Type: TXT
Value: v=DMARC1; p=none; rua=mailto:dmarc@example.comAfter a few weeks of clean reports, tighten the policy to p=quarantine and later p=reject. Run the DNS Checker again after the change; DNS can take from minutes to a few hours to update.
#Example
Checking ecomail.cz with Email defaults and the selector ecomail:
Domain: ecomail.cz
Records: MX, TXT, SPF, DKIM, DMARC
Selector: ecomailA healthy result shows the MX hosts, an SPF record with an Ecomail include marked pass, a DKIM key found at ecomail._domainkey, a DMARC record and a valid certificate.
#Limits and gotchas
- DKIM is skipped without a selector. If you do not know it, look at
DKIM-Signature: s=in the headers of a real email (the Email Header Analyzer shows it). - Results are live and never cached, but your DNS provider may still serve an old answer for a while after a change.
- The SPF verdict only says whether Ecomail is included. Whether the record stays under the 10-lookup limit is the job of the SPF Checker.
- Queries time out after 3 seconds and the certificate check after 10; a slow DNS host can show as missing records. Run it again before you escalate.