Email Compliance Checker

The Email Compliance Checker runs a comprehensive audit of your domain's email authentication configuration in one click. It checks DMARC, SPF, DKIM, MX records, BIMI readiness, MTA-STS, TLS-RPT, and blacklist status — and gives you a prioritized list of what to fix.

Tool URL:/tools/email-compliance

What does the checker verify?

The tool checks eight areas of your email security configuration:

  1. DMARC — Does a DMARC record exist? Is the policy set to quarantine or reject (not just "none")? Is alignment configured correctly?
  2. SPF — Does an SPF record exist? Is it valid? Does it stay within the 10 DNS lookup limit?
  3. DKIM — Are DKIM records found for common selectors used by popular email providers?
  4. MX Records — Are there valid MX records for the domain?
  5. BIMI — Is the domain ready for BIMI (Brand Indicators for Message Identification), which displays your logo next to emails in supporting inboxes?
  6. MTA-STS — Is there an MTA-STS policy configured? This standard enforces TLS encryption for email delivery to your domain.
  7. TLS-RPT — Is TLS-RPT configured? This provides reporting on TLS encryption failures.
  8. Blacklists — Is your domain or any of your MX server IP addresses listed on major DNS blacklists (DNSBL)?

How to run a compliance check

Step 1 — Enter your domain

Open the Email Compliance Checker at /tools/email-compliance. Type your domain name into the input field (e.g. yourdomain.com). Do not include https:// or www. — just the bare domain.

Step 2 — Click "Check Compliance"

Click the Check Compliance button. The tool will run all checks against your domain. This typically takes 5–15 seconds, as it needs to query multiple DNS records and check blacklists.

While the check is running, you will see a loading indicator on the button.

Step 3 — Review the scorecard

The results display a scorecard showing each check with a pass or fail status. Each row shows the check name and a brief description of what was found.

A check marked as pass means the configuration for that area is present and correctly configured. A check marked as fail means the configuration is missing or has a problem that needs attention.

Step 4 — Review the recommendations

Below the scorecard, the tool shows a Recommendations section listing every check that failed, with a description of the issue and a recommended action.

For DMARC, SPF, and DKIM failures, the tool provides a direct link to the relevant generator or setup guide:

Work through the recommendations in order, starting with the ones that have the greatest impact on email deliverability and security.

Understanding each check

DMARC

The checker verifies that a DMARC record exists at _dmarc.yourdomain.com and that the policy is set to quarantine or reject. A policy of none is considered a partial pass — the record exists but provides no protection.

If this check fails, use the DMARC Generator to create and publish a record.

SPF

The checker verifies that an SPF record exists at the root domain and is syntactically valid. It also checks that the total number of DNS lookups stays within the 10-lookup limit required by the SPF standard.

If this check fails, use the SPF Generator to build a valid record.

DKIM

Because DKIM selectors vary by provider, the checker tests a set of commonly used selectors: google, selector1, selector2, k1, s1, s2, default, and mail.

If at least one DKIM record is found using these selectors, the check passes. If none are found, it fails — which may mean DKIM is not configured, or your provider uses a non-standard selector. Use the DKIM Setup Guide to configure DKIM for your provider.

Note: this check may show a false failure if your provider uses a selector not in the list above. If you know your DKIM selector, use the DKIM Checker to verify it directly.

MX Records

The checker verifies that your domain has at least one valid MX record. MX records tell sending servers where to deliver email for your domain. Without MX records, your domain cannot receive email.

If this check fails, contact your email provider or hosting company — MX records are typically managed when you set up a business email account.

BIMI

BIMI (Brand Indicators for Message Identification) allows your brand logo to appear next to emails in Gmail, Yahoo, and other supporting inboxes. To qualify for BIMI:

  • Your DMARC policy must be set to reject.
  • A BIMI record must exist at default._bimi.yourdomain.com.
  • The BIMI record must point to an SVG logo file hosted publicly.
  • For Gmail, a Verified Mark Certificate (VMC) is also required.

If this check fails but BIMI is not your current priority, it is safe to address later. BIMI is an enhancement, not a requirement for email delivery.

MTA-STS

MTA-STS (Mail Transfer Agent Strict Transport Security) is a standard that forces other mail servers to use TLS encryption when delivering email to your domain. It requires:

  • A DNS TXT record at _mta-sts.yourdomain.com.
  • A policy file hosted at https://mta-sts.yourdomain.com/.well-known/mta-sts.txt.

MTA-STS provides protection against downgrade attacks where an attacker forces email to be sent in plain text. This check is a best-practice indicator — failing it does not mean your email is broken.

TLS-RPT

TLS-RPT (TLS Reporting) sends you reports about TLS connection failures when other servers try to deliver email to your domain. It requires a TXT record at _smtp._tls.yourdomain.com.

Like MTA-STS, this is a best-practice check that provides visibility into delivery issues rather than preventing email from being sent or received.

Blacklists

The checker tests your domain and the IP addresses of your MX servers against major DNS-based blocklists (DNSBL), including Spamhaus and Barracuda. Being listed on a blacklist means some email providers may refuse to accept email from your domain.

If this check fails, identify which blacklist you are listed on (the recommendation will specify this). Each blacklist has its own delisting request process — follow the link in the recommendation to request removal.

Blacklisting often indicates that your domain or a server associated with it was used to send spam. Review your email sending practices and investigate whether any accounts have been compromised before requesting delisting.

Common questions

How often should I run this check?

Run it whenever you make changes to your email configuration, and periodically (monthly) to catch any issues that may have developed. DMARC Examiner's paid plans provide continuous monitoring with automated alerts so you do not need to check manually.

All my checks pass but emails are still going to spam. Why?

DMARC, SPF, and DKIM configuration is one factor in deliverability. Spam filtering also considers your sending reputation, email content, list hygiene, and sending volumes. Passing all compliance checks is a necessary foundation, but not a complete guarantee of inbox delivery.

The DKIM check failed but I know DKIM is configured. Why?

The compliance checker tests a fixed set of common selectors. If your provider uses a different selector, the check will show a failure even though DKIM is working correctly. Use the DKIM Checker with your specific selector to confirm.

Do I need an account to use this tool?

No. The tool is free and requires no signup.

Related tools