Domain health check

SPF, DKIM, DMARC, MX and eight more checks on one domain, graded A to F with the exact records to paste. Free, no signup, and nothing is sent from your domain.

Reads public records only. Nothing is sent from your domain.Try

Ken runs this check on every inbox it sends from.

Add your domains and Ken watches DNS, blacklists and bounce rates for you, and pauses an inbox before it does damage.

Start free - 1,000 credits, no card

What the domain health check covers

Enter a domain and the check reads its public DNS records, then grades the result from A to F. It covers the records that decide whether mail from the domain is trusted: MX and the mail provider behind it, SPF, DKIM, DMARC, BIMI, MTA-STS, TLS-RPT and reverse DNS on the mail servers.

It also checks two things a generic DNS checker skips. The first is whether the domain hosts your website and team mail, because cold email should run on a separate sending domain. The second is whether the setup meets the sender requirements Gmail and Yahoo started enforcing in February 2024.

Nothing is sent from your domain. The check only reads public records, so it works on any domain, including a client's or a prospect's.

How to read the grade

The grade is a 0 to 100 score turned into a letter. SPF, DKIM and DMARC carry most of the weight. Transport and reporting checks such as MTA-STS and TLS-RPT carry less. BIMI is reported but doesn't move the grade, since it only displays a logo and needs an enforced DMARC policy first. Blacklists count too: the domain and its mail server IPs are looked up on public blocklists, and a listing on a major list fails that row.

Each row is a pass, a warning or a fail. Read the fails first. A fail on SPF, DKIM or DMARC means some receivers will reject or junk your mail today. A warning means the record works but is fragile, like an SPF record at 9 of 10 lookups or a DMARC policy that never moved past p=none.

The grade uses public signals only. Gmail and Outlook keep their own reputation for every domain and IP, built from how recipients react to your mail, and no outside tool can see it. A domain can score an A here and still land in spam if people report its mail.

How to fix what it finds

Every failing row comes with the record to publish. Add it at your DNS host as a TXT, CNAME or MX record at the host name shown, wait for the old TTL to run out, and run the check again. Work in this order:

MX and SPF first. Without a working MX, replies have nowhere to land, and without SPF many receivers treat the mail as unauthenticated.
Turn on DKIM signing in your mail provider and publish the key it gives you. Use a 2048-bit key.
Publish DMARC at p=none with a rua address, read the reports for two weeks, then move to quarantine and reject.
MTA-STS, TLS-RPT and BIMI last. They protect incoming mail or display a logo. They don't decide where your cold email lands.

Each record has its own checker in this suite with more detail and a generator.

Why it matters for cold email

Since February 2024 Gmail has required every sender to authenticate with SPF or DKIM. Anyone sending around 5,000 or more messages a day to personal Gmail accounts also needs SPF, DKIM and a DMARC record, with the From domain aligned to SPF or DKIM. Yahoo set matching rules, and Microsoft added similar rules for senders of 5,000 or more messages a day to Outlook.com, Hotmail and Live addresses in May 2025.

Cold email gets less benefit of the doubt than other mail. Recipients didn't ask for it, so filters have little engagement history to go on and lean harder on authentication and domain reputation. A sending domain that fails these checks starts every campaign behind.

The primary-domain check matters for the same reason. If the domain behind your website and team mail picks up a bad reputation from outbound, invoices and password resets go to spam with it.

Questions

What is a good domain health score for cold email?

An A, or a high B with no fails on SPF, DKIM or DMARC. Warnings on MTA-STS or TLS-RPT are fine for a sending domain. Below that, fix the fails before you send. A bad first week on a new domain is hard to undo.

Why do my emails go to spam if my domain passes every check?

DNS proves you are who you say you are. It doesn't show whether recipients want your mail. Placement also depends on spam complaints, bounces, volume per inbox, domain age and content. Send a real message to an inbox you control and read its Authentication-Results header, and keep your spam rate in Google Postmaster Tools under 0.1%.

How long do DNS changes take to show up?

As long as the TTL on the old record, often an hour and sometimes a day, because resolvers keep the old answer until it expires. A brand-new record usually appears within minutes, unless a resolver cached a 'does not exist' answer. That lasts as long as the negative TTL set in the zone's SOA record.

Can I check a domain I don't own?

Yes. Every check reads public records, so a client's, a prospect's or a competitor's domain works the same way as yours. Agencies can run it before onboarding a client to see what needs fixing first.

Should I send cold email from my main domain?

No. Cold email draws more spam reports than mail people asked for. If the main domain's reputation drops, your team's everyday mail, invoices and password resets land in spam too. Register a few close variants of your brand for outbound, redirect their websites to your main site, and send from those.