--- title: "Free Email Deliverability Test & Domain Health Check | Prosyo" description: "Test your email deliverability free: MX, SPF, DKIM, DMARC, BIMI and blacklists in one check, scored out of 100 with the exact fix for every issue." url: "https://prosyo.com/es/tools/domain-health-checker/" image: "https://prosyo.com/wp-content/uploads/2026/10/cropped-Prosyo-Icon-Transparent-1.png" language: "es" --- Free Tools # Email Domain Health Checker Score your sending domain in one click: MX, SPF, DKIM, DMARC, BIMI, MTA-STS and blacklists, with the exact fix for anything that fails. Email Domain Health Checker Instant · free ## What is an email domain health check? An email domain health check reads the public DNS records that mailbox providers look at before they decide where your email goes: the inbox, the spam folder or nowhere at all. In one run, this free checker looks at your **MX records** (can the domain receive mail?), **SPF** (which servers may send for you?), **DKIM** (is your mail signed?), **DMARC** (what should receivers do with mail that fails?), the optional extras **BIMI**, **MTA-STS** and **TLS reporting**, and a set of widely used **DNS blocklists**. It turns all of that into one score out of 100 and a plain-English fix for anything that is wrong. If you send cold email, this is the first thing to run on every sending domain, before the first campaign and again whenever something changes: a new tool that sends on your behalf, a new mailbox provider or a sudden drop in replies. Most deliverability problems that look mysterious turn out to be one missing or broken record. ## How to use the domain health checker 1. **Enter the domain you send from**, not your personal address. Type `yourcompany.com` or paste a full email address; the tool keeps only the domain. 2. **Press “Check domain health”.** The checks run in your browser against public DNS-over-HTTPS resolvers, so results usually arrive in two to five seconds. 3. **Read the score and verdict.** 90 and above means the domain is ready for cold email. 75 to 89 is good with a few improvements. Below 75, fix the red items before you send. 4. **Work through the red items first.** Each failed check tells you what is wrong and gives the exact record or setting to change. Amber items are improvements; blue items are optional extras. 5. **Run it again after your changes.** DNS updates usually show within minutes, though some DNS hosts take a few hours. ## What the score is made of Not every record matters equally, so the score is weighted by how much each one affects inbox placement for outbound email. | Check | Points | Why it matters | | --- | --- | --- | | DMARC | 25 | Required by Gmail, Yahoo and Microsoft for anyone sending at volume, and the record that ties SPF and DKIM to your visible From address. | | SPF | 20 | Lists the servers allowed to send as you. Missing, duplicated or over-complex SPF records cause authentication failures. | | DKIM | 20 | A cryptographic signature that proves the message was not changed and came from an authorised sender. | | MX | 15 | A domain that cannot receive email looks suspicious, and replies to your outreach have nowhere to go. | | Blocklists | 15 | A listing on a major blocklist can stop delivery outright, whatever else is right. | | BIMI, MTA-STS, TLS-RPT | 5 | Optional. They add brand trust and transport security but rarely decide placement on their own. | ## The checks, one by one ### MX: can the domain receive email? MX (mail exchanger) records name the servers that accept email for a domain. Mailbox providers expect a legitimate sending domain to receive mail too, and every reply to your cold email depends on it. If the check fails, publish the MX records your email provider gives you; Google Workspace and Microsoft 365 both show them in their setup screens. If you see a “null MX”, the domain has deliberately declared that it accepts no email, which is wrong for a domain you send from. For a full breakdown of priorities and providers, use the [MX Lookup](https://prosyo.com/tools/mx-lookup/). ### SPF: who may send as you? SPF (Sender Policy Framework) is a single TXT record that starts with `v=spf1` and lists the services allowed to send email for your domain. The health check confirms there is exactly one SPF record, counts its DNS lookups against the hard limit of 10, and reads the ending: `~all` (soft fail) or `-all` (hard fail) are both fine, `?all` gives receivers almost nothing, and `+all` lets anyone on the internet send as you. The most common breakages in outbound setups are a second SPF record added by a new tool, and too many `include:` mechanisms pushing the record over 10 lookups. The [SPF Checker](https://prosyo.com/tools/spf-checker/) shows the full include tree so you can see exactly which service is costing the lookups. ### DKIM: is your mail signed? DKIM (DomainKeys Identified Mail) adds a signature to each message, and receivers check it against a public key published at `selector._domainkey.yourdomain.com`. Because the selector name varies by provider, the health check scans more than 40 common selectors, including `google` for Google Workspace and `selector1` and `selector2` for Microsoft 365. If it finds none, DKIM may still be set up under a custom selector. Open an email you sent, view the original message, find the `DKIM-Signature` header and note the value after `s=`; then check that selector in the [DKIM Checker](https://prosyo.com/tools/dkim-checker/). Keys of 2048 bits are the current recommendation. ### DMARC: what happens to mail that fails? DMARC is a TXT record at `_dmarc.yourdomain.com` that tells receivers what to do when a message claiming to be from you fails SPF and DKIM alignment, and where to send reports. Since February 2024, Gmail and Yahoo require a DMARC record from anyone sending more than about 5,000 messages a day to their users, and Microsoft introduced similar rules for Outlook.com in 2025. Even below those volumes, a missing DMARC record is a negative signal. Start with `p=none` and a reporting address, then move to `quarantine` and `reject` once the reports show only your own services sending. The [DMARC Checker](https://prosyo.com/tools/dmarc-checker/) explains every tag in your record. ### Blocklists: is the domain or its mail servers listed? DNS blocklists (DNSBLs) are lists of IP addresses and domains associated with spam. The health check looks up your domain on domain-based lists and the IP addresses of your mail servers on IP-based lists. One honest caveat: Spamhaus and URIBL refuse queries from public DNS resolvers, which is what a browser-based tool has to use, so those rows may show as “not checkable” rather than clean. The [Blacklist Checker](https://prosyo.com/tools/blacklist-checker/) shows each list separately, with removal steps. ### BIMI, MTA-STS and TLS reporting These are optional. **BIMI** lets supporting inboxes show your logo next to your messages; it requires DMARC at quarantine or reject, and Gmail also requires a verified mark certificate. **MTA-STS** tells other servers to deliver mail to you only over encrypted connections, and **TLS-RPT** sends you reports when that fails. They are worth adding once the core four are solid, but they will not rescue a domain with broken SPF or no DMARC. ## Common problems this check finds, and how to fix them ### “SPF: more than one record” A domain may publish only one SPF record. When a new sending tool tells you to “add this SPF record”, it usually means add its `include:` to your existing record, not create a second one. Merge them: `v=spf1 include:_spf.google.com include:sendgrid.net ~all`. ### “SPF: over 10 DNS lookups” Every `include`, `a`, `mx`, `exists` and `redirect` costs a lookup, including those nested inside other providers’ records. Above 10, SPF returns a permanent error and fails for every message. Remove services you no longer use, replace `a` and `mx` with the actual `ip4:` ranges when they are stable, or move some senders to a subdomain with its own SPF record. ### “DMARC: missing” Publish a TXT record at `_dmarc.yourdomain.com` with `v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com`. Nothing changes for your mail on day one; you start receiving reports showing which services send as you. That is the safe first step. ### “DKIM: not found at common selectors” Turn DKIM signing on in your email provider. In Google Workspace it is under Apps, Google Workspace, Gmail, Authenticate email. In Microsoft 365 it is in the Defender portal under Email authentication settings. Publish the record the provider gives you, then switch signing on. ### “MX: no mail servers” Common on brand-new secondary domains bought for outreach. Set up mailboxes with your provider and publish its MX records so replies arrive and the domain looks like a real business. ## Domain health for cold email: the setup that works Teams that send outbound at any scale usually separate their cold email from their main domain. A typical setup looks like this: - **Secondary sending domains** that closely match your brand, for example `getyourcompany.com` or `yourcompanyhq.com`, each redirecting its website to your main site. - **Two or three mailboxes per domain**, each sending a modest daily volume rather than one inbox sending hundreds. - **SPF, DKIM and DMARC on every sending domain**, checked with this tool before warm-up starts. - **Warm-up before volume**: two to four weeks of gradually increasing sends on new inboxes. The [Warm-up Planner](https://prosyo.com/tools/email-warmup-planner/) builds a day-by-day schedule. - **Ongoing monitoring**: rerun the health check monthly and after adding any new tool that sends email. Use the [Volume and Inbox Calculator](https://prosyo.com/tools/cold-email-volume-calculator/) to work out how many domains and inboxes your meeting goal actually needs. ## What a health check cannot tell you DNS records are the foundation, not the whole building. A perfect score means receivers can authenticate your mail; it does not guarantee the inbox. Placement also depends on your sending reputation (complaints, bounces, how recipients engage), your list quality and your copy. Keep bounce rates low by checking lists with the [Email Verifier](https://prosyo.com/tools/email-verifier/), keep copy plain and specific with the [Cold Email Grader](https://prosyo.com/tools/cold-email-grader/), and send to people for whom your message is genuinely relevant. ## Example records for the most common email providers If the checker tells you a record is missing, these are the usual values. Always confirm the exact records in your provider’s admin console, because some accounts use regional servers or custom selectors. ### Google Workspace | Record | Host | Value | | --- | --- | --- | | MX | @ | `1 smtp.google.com` (newer accounts) or the five `aspmx.l.google.com` records (older accounts) | | SPF (TXT) | @ | `v=spf1 include:_spf.google.com ~all` | | DKIM (TXT) | google._domainkey | The `v=DKIM1; k=rsa; p=…` key generated in the Admin console (choose 2048 bits) | | DMARC (TXT) | _dmarc | `v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com` | ### Microsoft 365 | Record | Host | Value | | --- | --- | --- | | MX | @ | `0 yourdomain-com.mail.protection.outlook.com` | | SPF (TXT) | @ | `v=spf1 include:spf.protection.outlook.com -all` | | DKIM (CNAME) | selector1._domainkey and selector2._domainkey | The two CNAME targets shown in the Defender portal | | DMARC (TXT) | _dmarc | `v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com` | ### Adding a sending tool on top Most outreach, CRM and newsletter tools send through their own servers. Each one needs to be added to SPF with its own `include:` (never a second SPF record) and usually publishes its own DKIM selector, often as a CNAME. Tools that send through your own Google or Microsoft mailbox, connected over OAuth or SMTP, use your provider’s SPF and DKIM and need no extra records. That is one reason sending from real mailboxes tends to authenticate cleanly. ## A pre-send checklist for every new sending domain 1. The domain is at least a few days old and its website redirects to your main site or has a real page, so it does not look abandoned. 2. MX records point to your mailbox provider and you can receive a test email. 3. Exactly one SPF record, under 10 lookups, ending in `~all` or `-all`. 4. DKIM is switched on in your provider and the key is found by the checker. 5. DMARC is published with at least `p=none` and a reporting address you actually read. 6. The domain and its mail server IPs are not on any blocklist this tool can check. 7. Each mailbox has a real name, a profile photo and a short signature with your company and website. 8. Warm-up has run for at least two weeks before the first cold campaign. 9. Your first list has been cleaned: invalid, disposable and role-based addresses removed. 10. Your first email has been through a copy check: one link at most, no spam-trigger phrasing, a clear and easy question. Run this health check as step one and again after step ten. If the score holds above 90, you have removed the technical reasons for poor placement and can focus on targeting and message quality. ## How often should you check your domain? Run a full check before any new campaign, after connecting any new tool that sends email for your domain, after changing DNS hosts or registrars, and whenever reply rates drop sharply without an obvious reason. For teams sending every day, a monthly check is a sensible habit, because records are changed more often than people expect: a colleague adds a marketing tool, an agency edits SPF, or a domain renewal resets DNS at a new host. ## Glossary - **Inbox placement**: whether a message lands in the inbox, a tab, spam, or is rejected. - **Sender reputation**: how mailbox providers rate your domain and IPs, based mainly on how recipients react to your mail. - **Authentication**: SPF, DKIM and DMARC together; proof that mail claiming to be from you really is. - **Alignment**: the authenticated domain matching the domain in the visible From address. - **Blocklist (DNSBL)**: a public list of IPs or domains linked to spam, queried by receivers over DNS. - **Secondary sending domain**: a separate domain used for outreach so the main domain’s reputation stays protected. - **Warm-up**: gradually increasing the daily volume of a new mailbox so providers learn to trust it. ## How Prosyo helps Prosyo runs LinkedIn and email outreach from your own accounts, inside safe daily limits, and stops every sequence the moment someone replies. Healthy domains plus sensible volume plus relevant messages is the whole game, and Prosyo is built to keep all three in place while it finds the right buyers and writes to them. [Start a 7-day free trial](https://prosyo.com/pricing/), no card required. ## Related free tools These tools are often used together with the Domain Health Checker. All of them are free, and the checkers and calculators run instantly in your browser. - [SPF Checker](https://prosyo.com/tools/spf-checker/): Validate your SPF record, count its DNS lookups against the limit of 10 and see every include it depends on. - [DKIM Checker](https://prosyo.com/tools/dkim-checker/): Find your DKIM keys by selector or scan 40+ common selectors, with key length and revocation checks. - [DMARC Checker](https://prosyo.com/tools/dmarc-checker/): Read your DMARC policy in plain English, get a grade from A to F and a safe path to full enforcement. - [Blacklist Checker](https://prosyo.com/tools/blacklist-checker/): Check a domain and its mail servers against widely used DNS blocklists, with removal steps. - [Warm-up Planner](https://prosyo.com/tools/email-warmup-planner/): Get a day-by-day warm-up and ramp schedule for a new inbox or domain. ## Frequently asked questions ### How do I check if my domain is healthy for sending email? Enter your domain in the checker above. It reads your MX, SPF, DKIM, DMARC, BIMI and MTA-STS records and checks common blocklists, then scores the domain out of 100 with a fix for every failed item. ### What is a good email domain health score? 90 or above means the core authentication is in place and the domain is not on the blocklists we could check. Between 75 and 89 the domain works but has improvements to make. Below 75, fix the failed items before sending cold email. ### Do I need SPF, DKIM and DMARC for cold email? Yes. Gmail, Yahoo and Microsoft expect all three from anyone sending at volume, and missing records are one of the most common reasons cold email goes to spam even when the copy is good. ### Why does the checker say DKIM was not found when I set it up? Your provider probably uses a selector outside the common list. Find the s= value in the DKIM-Signature header of an email you sent and enter it in the DKIM Checker. ### How long do DNS changes take to show up? Usually minutes, sometimes a few hours, depending on your DNS host and the record’s TTL. Run the check again after you save changes. ### Is this domain health checker free? Yes, with no sign-up. The checks run in your browser using public DNS-over-HTTPS resolvers, so nothing you enter is stored on our servers. ### Why are some blocklists shown as not checkable? Spamhaus and URIBL refuse lookups from public DNS resolvers. A browser tool has to use those resolvers, so we show those lists as not checkable rather than claiming you are clean. ## Ready to Accelerate Your Growth? Launch smarter campaigns, convert more leads, and scale your business with ease — all in one place. [Get Started Now](https://prosyo.com/es/) [Book a Demo](https://prosyo.com/es/pricing/)