maail
Free mail diagnostics

Inspect your signing key.

Enter your domain and signing selector to inspect the published DKIM key. See common format issues, key strength and revoked or testing-mode selectors.

Public DNS, live answersNo account neededNo email sent
Required only for DKIM.

Use a domain, not an email address or URL. For PTR, enter a public IP.

Query names are sent to Google Public DNS. Please use public, non-sensitive domains. Privacy details

From record to next step

Evidence, not guesswork.

Open the headers of a message sent by your domain and find the DKIM-Signature header. Its s= value is the selector and d= is the signing domain. Your email provider may also show the selector in its DNS setup instructions. A domain alone is not enough to reliably discover all selectors.

01

Choose the exact domain

For MX and SPF, use the domain you want to inspect. DMARC checks _dmarc at that exact domain; inherited organizational policies are not inferred.

02

Read the finding, not just the badge

“DNS inspected” means evidence was retrieved, not that delivery is guaranteed. “Needs review” explains a policy trade-off; “Issue found” identifies a configuration problem. Resolver errors stay distinct.

03

Change, wait, check again

Update records with your DNS provider and allow caches to expire. Confirm the result with real message headers and your mail provider before enforcing stricter policies.

A closer look

The right tool for each record.

Email health check

One place for your mail infrastructure. Look up public DNS records, spot configuration risks and get clear next steps. No signup. No email sent.

Open tool

MX lookup

See mail servers ordered by preference and resolve their IPv4 and IPv6 addresses. Distinguish a working DNS route, broken destinations and a domain that intentionally refuses email.

Open tool

SPF checker

Inspect your published sender policy. Find duplicate records, overly permissive endings and common syntax mistakes before they affect authentication.

Open tool

DMARC checker

Inspect the policy at _dmarc, understand monitoring versus enforcement and check whether aggregate reporting is configured.

Open tool

DNS lookup

Inspect address records, aliases, nameservers and mail-security discovery records. For reverse DNS, choose PTR and enter a public IP address.

Open tool
Good questions

Before you change DNS.

Need address-level intelligence?
Where do I find my DKIM selector?

Open the headers of a message sent by your domain and find the DKIM-Signature header. Its s= value is the selector and d= is the signing domain. Your email provider may also show the selector in its DNS setup instructions. A domain alone is not enough to reliably discover all selectors.

Is this free, and will you send email?

The public tools are free and do not require an account. They query DNS only: no email is sent, no SMTP session is opened and no recipient mailbox is probed. Up to 12 checks per minute are allowed per network address.

What happens to the domain I enter?

Maail does not save submitted domains or DNS results in an application history. Query names are sent to Google Public DNS over HTTPS and are subject to Google’s resolver privacy policy. Request history stays in this page’s memory and disappears on reload. Rate protection stores a hash of your network address with short-lived counters; infrastructure logs may also contain request metadata. Do not enter private or sensitive hostnames.

Does a good DNS result guarantee delivery?

No. DNS is one part of mail delivery. Server availability, sender reputation, authentication of actual messages, spam filtering and recipient policies also matter. Findings describe the inspected records, not a delivery guarantee.

Build it into your workflow

Go beyond a manual lookup.

Explore Maail’s email intelligence API for address-level signals, or use these free tools whenever you need to inspect public DNS.

Explore email intelligenceRead the API guide