Email Health Check is ToolTrusted’s free, all-in-one domain scan — and this page holds the free email tools behind it, the individual checks that make up your Email Health Score. Look up, fix and generate the DNS records your email depends on, fast and accurate, each paired with a plain-English guide. Setting up authentication for the first time, or debugging why mail bounces? Start with the Email Health Check for one overall score out of 100, then drill into any individual tool below. Every tool is built and maintained by our deliverability team and runs right in your browser.
Start with a free Email Health Check — a free email tools suite and email deliverability test that acts as an SPF DKIM DMARC checker and returns your email health score in seconds.
Email Health Check
Start here. Enter any domain and we run every authentication check at once – SPF (with its DNS-lookup count), DKIM, DMARC (with its policy, defined in RFC 7489), MTA-STS, TLS-RPT and BIMI – then return your Email Health Score out of 100, with the exact fixes ranked. New to the result? See how to read your Email Health Score – the bands, the points ledger, and exactly what to fix first.
Enter a domain for its Email Health Score — one grade out of 100 across SPF, DKIM, DMARC, MTA-STS, TLS-RPT and BIMI, with the exact fixes ranked.
Free tool from ToolTrusted. Lookups query public DNS; generators run in your browser.
What we analyze
Your Email Health Score out of 100 is built from four measurable dimensions – every check is a real DNS or blacklist lookup, never a guess:
Authentication
Proves your mail is really from you, so receivers can reject spoofed messages sent in your name.
Infrastructure
Your mail routing and transport security – that mail reaches the right servers over encrypted connections.
Security
Your anti-spoofing posture – whether your policies actually block abuse instead of only monitoring it.
Reputation
Whether your sending domain or IPs appear on the major blocklists right now – checked live, never cached.
Which tool should I use?
You’ve got the full Email Health Check above. To re-check a single record or debug one specific issue, jump straight to the individual tool you need below – each focuses on one signal and pairs with a plain-English guide.
DNS lookups
Check what a domain has published right now. Enter any domain to see its mail servers (MX), its SPF policy (now with a lookup count), or its DMARC policy (now with a plain-English breakdown) – the same records receiving mail servers check on every message.
See which mail servers receive email for a domain, in priority order.
Free tool from ToolTrusted. Lookups query public DNS; generators run in your browser.
Read a domain’s published SPF record and the senders it authorizes.
Free tool from ToolTrusted. Lookups query public DNS; generators run in your browser.
Find a domain’s DMARC policy and reporting address.
Free tool from ToolTrusted. Lookups query public DNS; generators run in your browser.
Look up a domain’s DKIM public key by selector.
Free tool from ToolTrusted. Lookups query public DNS; generators run in your browser.
Look up a domain’s A, TXT or NS records.
Free tool from ToolTrusted. Lookups query public DNS; generators run in your browser.
Diagnostics
Debug a delivery problem: analyze a message’s raw headers to see its path and authentication results, check whether a sending IP or domain is blacklisted, confirm reverse DNS on a sending IP, and – after you change a record – check whether the update has propagated by comparing what Google, Cloudflare and AdGuard each return.
Paste raw email headers to see the delivery path and SPF/DKIM/DMARC results — nothing leaves your browser.
Free tool from ToolTrusted. Lookups query public DNS; generators run in your browser.
Check whether an IP or domain is on a major email blacklist.
Free tool from ToolTrusted. Lookups query public DNS; generators run in your browser.
Find the hostname an IP address points back to.
Free tool from ToolTrusted. Lookups query public DNS; generators run in your browser.
Check whether a DNS change has gone live by comparing answers from Google, Cloudflare and AdGuard.
Free tool from ToolTrusted. Lookups query public DNS; generators run in your browser.
DMARC report parser (RUA). Drop a DMARC aggregate report (.xml or .xml.gz) to see sending IPs and SPF/DKIM alignment – parsed entirely in your browser, never uploaded. Full guide: DMARC report parser.
Drag in a DMARC aggregate (RUA) XML report to see sending IPs and SPF/DKIM alignment — parsed entirely in your browser.
Free tool from ToolTrusted. Lookups query public DNS; generators run in your browser.
Record generators & fixers
Build correct records from scratch – entirely in your browser, with nothing sent anywhere – or flatten an SPF record that has grown past the 10-lookup limit. Generate the record, publish it as a TXT record at your DNS host, then confirm it with the lookups above.
Build a valid SPF record from the services you send with.
Free tool from ToolTrusted. Lookups query public DNS; generators run in your browser.
Create a DMARC record at the right policy level, with reporting.
Free tool from ToolTrusted. Lookups query public DNS; generators run in your browser.
SPF flattener. Over the 10-lookup limit? Resolve your includes to plain ip4:/ip6: entries to fix an SPF permerror – provider ranges kept verbatim. Full guide: SPF flattener.
Resolve every include and count your SPF DNS lookups against the 10-lookup limit, then build a flattened record.
Free tool from ToolTrusted. Lookups query public DNS; generators run in your browser.
BIMI generator & checker. Build a BIMI record for your logo (and optional VMC), or check the one a domain already publishes. Full guide: BIMI generator.
Build a valid BIMI record for your logo (and optional VMC), or check the BIMI record a domain already publishes.
Free tool from ToolTrusted. Lookups query public DNS; generators run in your browser.
Save & monitor your Email Health
Every tool on this page is free, forever, with no account – and we never hold the result back. Your Email Health Check isn’t a one-off, though: save any scan to a shareable link at no cost, and if the domain matters, a monitoring plan (from $9.99/mo) re-checks it automatically and emails you the moment SPF, DKIM, DMARC or reputation drifts – with the fix.
Continue across the platform
ToolTrusted covers the whole email stack. Wherever you go next, it connects back here:
- The ToolTrusted Platform – continuous monitoring, incidents, analytics, recommendations, benchmarking and automation.
- How It Works – the whole Email Health journey – check, report, save, track and monitor.
- Research & Benchmarks – original data on SPF, DKIM and DMARC across 10,000 domains.
- Compare ToolTrusted – honest, side-by-side comparisons with MXToolbox, DMARCian, EasyDMARC and more.
- For Agencies – watch every client domain from one independent, white-label portfolio.
- Email Deliverability – reputation, warm-up, blacklists and inbox placement.
- Email Authentication – SPF, DKIM, DMARC, BIMI and the full DNS stack.
- SMTP Services – SES, Mailgun, Postmark and more, ranked on deliverability.
- Email Verification – list cleaning and inbox-placement testing tools.
- Email Security – stop spoofing and phishing, and encrypt delivery.
- Email APIs – transactional and marketing APIs for developers.
- Email Marketing – hands-on platform reviews, comparisons and best-of roundups.
Frequently asked questions
Are these free email tools really free?
Yes – every tool on this page is free to use with no sign-up required. They are part of ToolTrusted’s mission to be the trusted resource for email technology, and they pair with our free guides so you can fix issues yourself.
Do the lookup tools store my domain or data?
No. The lookups query public DNS records the same way any mail server does, and we do not store the domains you check. The record generators run in your browser and never send your inputs anywhere.
Is this a domain trust checker?
In effect, yes. The Email Health Check works as a free domain trust checker: it measures the public signals receiving mail servers use to decide whether to trust a domain – SPF, DKIM, DMARC, MTA-STS and live blacklist status – and returns one Email Health Score out of 100. It reflects your domain’s email posture, not a private or proprietary “trust rating”.
How do I check SPF DKIM and DMARC all at once?
Run the Email Health Check at the top of this page. Enter your domain once and it checks SPF, DKIM, DMARC, MTA-STS, TLS-RPT, BIMI and live blacklist status together, then returns a single score with the fixes ranked – instead of running each lookup separately.
What is a good Email Health Score?
Scores map to A-F bands out of 100: broadly, 90+ (A) means strong, enforced authentication; 70-89 (B-C) means the basics are in place with room to tighten; below 70 signals gaps worth fixing soon. The score is deterministic – the same domain always scores the same. See how to read your Email Health Score for the full band and ledger breakdown.