maail
Free mail diagnostics

Draft a policy with a plan.

Build a copy-ready DMARC draft, understand every setting and start with monitoring. Nothing is published automatically; you remain in control of your DNS.

No external requestsNo account neededNo email sent
Email toolboxDMARC draft generatorSwitch tool
Use a mailbox or reporting service you control.
pct was removed by RFC 9989. Current receivers ignore it. Leave 100 to omit this legacy tag; use p=none for monitoring.

Processed by Maail without external requests or application-history storage. Clipboard and downloaded reports may contain submitted data. Privacy details

Mail authentication, explained
From record to next step

Evidence, not guesswork.

Start with p=none and an aggregate-report mailbox you control. Review reports, inventory legitimate senders and verify SPF or DKIM alignment. Only then consider quarantine or reject. An enforcing policy can affect legitimate messages; percentage settings are not a guaranteed safety gate.

01

Choose the exact domain

For MX and SPF, use the domain you want to inspect. DMARC checks _dmarc at that exact domain; inherited organizational policies are not inferred.

02

Read the finding, not just the badge

“Inspected” means evidence was parsed, not that delivery is guaranteed. “Needs review” explains a policy trade-off; “Issue found” identifies a configuration problem. Resolver errors stay distinct.

03

Verify in your mail workflow

Confirm findings with your receiving provider and real message headers. After DNS changes, allow caches to expire. Review legitimate senders before enforcing stricter policies.

A closer look

The right tool for each record.

Email health check

One place for your mail infrastructure. Inspect public DNS, trace sender policies, understand message headers and draft your DMARC setup. No signup. No email sent.

Open tool

MX lookup

See mail servers ordered by preference and resolve their IPv4 and IPv6 addresses. Distinguish a working DNS route, broken destinations and a domain that intentionally refuses email.

Open tool

SPF checker

Inspect your published sender policy. Find duplicate records, overly permissive endings and common syntax mistakes before they affect authentication.

Open tool

DMARC checker

Inspect the policy at the exact _dmarc name and decode its tags. For inherited policy discovery and external-report authorization evidence, use the full DMARC inspector.

Open tool

DKIM checker

Enter your domain and signing selector to inspect the published DKIM key. See common format issues, key strength and revoked or testing-mode selectors.

Open tool

DNS lookup

Inspect address records, aliases, nameservers and mail-security discovery records. For reverse DNS, choose PTR and enter a public IP address.

Open tool

SPF dependency lookup

Go beyond a single TXT record. Explore nested sender policies, see the referenced domains and understand where lookup-limit risks come from.

Open tool

Email header analyzer

Paste original headers to inspect reported authentication, DKIM signing identities and the claimed transit path. The parser does not send your headers to a DNS resolver or any third party.

Open tool

DMARC inspector

Find the policy behind a domain, translate every tag and inspect reporting destinations. Clear evidence and repair guidance, without a misleading “fully protected” badge.

Open tool

DMARC report analyzer

Open an uncompressed aggregate XML report to understand receiver observations. See which sources need investigation and how aligned SPF and DKIM contributed to the result.

Open tool

MTA-STS — DNS discovery

Inspect the public DNS signal for MTA-STS, a transport-security policy for mail delivery. This check does not fetch the HTTPS policy, test its certificates or verify MX enforcement.

Open tool

TLS-RPT — DNS discovery

Discover the DNS record that requests mail-transport failure reports. TLS-RPT complements MTA-STS, while DMARC aggregate reports describe a different layer: sender authentication.

Open tool

BIMI — DNS discovery

Inspect the default BIMI DNS selector for your domain. Logo display also depends on receiver support, authentication, eligible assets and any required certificate; a TXT record is not a display guarantee.

Open tool
Good questions

Before you change DNS.

Need address-level intelligence?
How should I roll out DMARC?

Start with p=none and an aggregate-report mailbox you control. Review reports, inventory legitimate senders and verify SPF or DKIM alignment. Only then consider quarantine or reject. An enforcing policy can affect legitimate messages; percentage settings are not a guaranteed safety gate.

Is this free, and will you send email?

The public tools are free and do not require an account. No email is sent, no SMTP session is opened and no recipient mailbox is probed. DNS tools query public records; header analysis and policy generation make no external requests. Up to 12 checks per minute are allowed per network address.

What happens to the data I submit?

Submitted headers, XML reports and draft settings are processed by Maail to render this report, not stored as application history and not sent to external resolvers. Reports and headers may contain personal data: remove sensitive content first. In-page history and lookup sharing are disabled for these tools. Rate protection stores short-lived hashed network counters; infrastructure logs may contain request metadata. Clipboard and downloaded reports can contain the information you submitted.

Does a good DNS result guarantee delivery?

No. DNS is one part of mail delivery. Server availability, sender reputation, authentication of actual messages, spam filtering and recipient policies also matter. Findings describe the inspected records, not a delivery guarantee.

Build it into your workflow

Go beyond a manual lookup.

Explore Maail’s email intelligence API for address-level signals, or use these free tools whenever you need to inspect public DNS.

Explore email intelligenceRead the API guide