01
Keep the subdomain you intend to inspect
Enter a domain, not an email address or URL. The checker does not silently replace a subdomain with its root: SPF and _dmarc at those names can differ. Example fills a domain but sends no request.
Email DNS
Email DNS checkerfor live records
Enter one domain; add a DKIM selector only when you know it. A lookup starts when you choose Check.
Email DNS checker
Leave the selector empty to skip DKIM. Find s= in a signed message header or in your mail provider's setup.
Enter a domain or load the example, then start a check.
Only after you check, this browser sends the domain and optional selector name to Cloudflare Public DNS over HTTPS; no mail is sent.
Enter a domain or load the example, then start a check.
After changing a mail provider, the website may load while mail DNS records still point elsewhere. This email DNS checker reads what a public resolver currently sees for the exact domain you enter, including subdomains.
The email DNS checker separates missing records from resolver errors. It keeps the MX lookup, SPF policy, DMARC TXT and optional DKIM key beside their raw answers, so you can review a migration without treating a green badge as an email authentication check.
Why use this email DNS checker?
A live answer is useful only when its scope and failure mode are visible.
Know which checks actually ran
This email DNS checker reports MX, SPF and the exact _dmarc name on every run. DKIM remains explicitly untested until you enter a selector; it never guesses a few common names and labels the rest absent.
Follow SPF dependencies with a stop line
An include or redirect can hide another SPF TXT value. The checker reveals a bounded tree of extra names, marks a timeout or missing branch, and announces when its five-level, twelve-name budget cuts the exploration short.
Read the exact name before editing DNS
02
Supply the signing selector when known
A DKIM key is under selector._domainkey.domain. Leave selector blank if you do not know s= from a signed header. Each DNS request is manual; Ctrl/Cmd+Enter also starts one.
03
Compare states, TTL and the expansion cap
A missing answer differs from SERVFAIL or a blocked HTTPS request. Query time and TTL explain when to retry after a change. Changing either input disables copying the old result; rerun before sharing it.
What the live lookup displays
MX routing beside authentication TXT
The MX lookup sorts priorities and identifies a null MX. SPF, DMARC and a selected DKIM record keep their exact DNS names and raw answers beside parsed values, useful when mail DNS records changed during a provider migration.
SPF terms and bounded dependencies
The SPF view lists direct DNS lookup mechanisms, then queries reachable include and redirect targets with cycle protection. Twelve extra names and five levels are a request budget, not a claim that RFC 7208's ten-lookup test passed.
Per-record outcome and timing
Each section identifies found, missing, failed or not checked, with query time and available TTL. A resolver failure never becomes an invented empty record; copying remains disabled once input or selector changes.
What a public DNS snapshot cannot prove
- A manual network request shares the name
- The page makes no lookup while you type or load an example. Clicking Check sends the domain and any selector-derived DNS name directly from your browser to Cloudflare Public DNS. Its availability and privacy policy apply; this site stores no scan history.
- A blank selector means DKIM was not checked
- DKIM selectors are not enumerable from one universal DNS record. If you leave the field blank, this email DNS checker says Not checked; if a chosen selector has no answer, it says only that the exact name was missing.
- Records do not show message authentication or delivery
- The email authentication check reads published data, not a sender IP, message signature, From alignment, reputation or a receiving mailbox. Even valid SPF, DKIM and DMARC records cannot promise inbox placement.
- DMARC and MX have narrower meanings here
- The DMARC lookup checks only _dmarc under the input name, not RFC 9989's full DNS tree walk. No MX alone does not prove mail cannot arrive because SMTP has a fallback; a null MX is an explicit no-mail signal.
- SPF exploration stops before full evaluation
- Includes and redirects are expanded only within the request budget. Macros need sender context and are skipped. A truncated tree or a direct lookup count is not a definitive SPF pass or a ten-lookup compliance verdict.
Email DNS checker questions
What is a DKIM selector and where do I find it?
It is the s= value in a DKIM-Signature header or the selector shown by your mail provider. Enter that value to query selector._domainkey.domain. A key at a different selector will not appear in this result.
Why can the checker not discover every DKIM selector automatically?
DNS has no list of all DKIM selector names. Guessing common ones can miss a provider-specific key, so a blank selector is Not checked rather than an unreliable negative result.
Can a domain publish multiple SPF records?
Several unrelated TXT values are normal, but multiple values beginning v=spf1 at the same name are a policy problem. This email DNS checker flags that count and shows the matching raw records rather than merging them.
Does DMARC p=none mean the configuration is wrong?
No. p=none is a valid monitoring policy. This tool displays the published value; it cannot decide when your real mail streams are ready for quarantine or reject.
Why can MX be missing while the website works?
Web and mail routing use different DNS records. An absent MX does not change the website, and SMTP can fall back to address records. A null MX, shown as 0 ., explicitly says the domain does not accept mail.
Will this check send email or change my DNS?
No message is sent and no zone is edited. The browser makes read-only HTTPS queries to Cloudflare Public DNS only after you start the scan; its results reflect that resolver's current view.
Still have a DNS question?
Run the email DNS checker
Start a fresh email DNS checker scan after a mail provider change, then compare each exact DNS name and its timestamp with the settings you intended to publish.
The public resolver sees queried names; this is a configuration snapshot, not a delivery test.