Email DNS Health

Check MX, SPF, DMARC, DKIM, MTA-STS discovery and TLS-RPT reporting records. Review email DNS findings and limitations with My Secure Labs.

How to use Email DNS Health

Enter a domain and optionally the DKIM selector supplied by your email provider. Browser verification is shared with the other tools.

Understanding the results

Review mail routing and DKIM publication, SPF include dependencies and potential DNS lookup limits, and the published DMARC policy. Missing exact-domain DMARC does not rule out an inherited policy. These checks do not test email delivery or authorize a particular sender. MTA-STS and TLS-RPT checks inspect DNS discovery and reporting syntax; they do not verify the HTTPS policy, mail-server encryption or report delivery.

Do published SPF, DKIM and DMARC records prove email delivery works?

No. These checks inspect DNS publication. Delivery also depends on sender configuration, message authentication and receiving-server policies. Supply your provider’s DKIM selector to inspect that record.

Does an MTA-STS record prove email encryption is enforced?

No. This tool checks the DNS discovery record. The HTTPS policy and mail-server TLS must also be verified to establish enforcement. TLS-RPT checks show reporting configuration, not successful report delivery.