maail
Free mail diagnostics

Read the whole DMARC picture.

Find the policy behind a domain, translate every tag and inspect reporting destinations. Clear evidence and repair guidance, without a misleading “fully protected” badge.

Public DNS, live answersNo account neededNo email sent
Email toolboxDMARC inspectorSwitch tool
Required only for DKIM.

Use a domain, not an email address or URL. For PTR, enter a public IP.

Query names are sent to Google Public DNS. Please use public, non-sensitive domains. Privacy details

Mail authentication, explained
From record to next step

Evidence, not guesswork.

It follows the RFC 9989 DNS tree walk, capped at eight policy queries, with psd boundaries and an explicit trace. Older RFC 7489 receivers can use different PSL-based inheritance. External-report checks show exact DNS authorization evidence; organizational-domain equivalence for report destinations and override URIs are not fully evaluated.

01

Choose the exact domain

For MX and SPF, use the domain you want to inspect. DMARC checks _dmarc at that exact domain; inherited organizational policies are not inferred.

02

Read the finding, not just the badge

“Inspected” means evidence was parsed, not that delivery is guaranteed. “Needs review” explains a policy trade-off; “Issue found” identifies a configuration problem. Resolver errors stay distinct.

03

Verify in your mail workflow

Confirm findings with your receiving provider and real message headers. After DNS changes, allow caches to expire. Review legitimate senders before enforcing stricter policies.

A closer look

The right tool for each record.

Email health check

One place for your mail infrastructure. Inspect public DNS, trace sender policies, understand message headers and draft your DMARC setup. No signup. No email sent.

Open tool

MX lookup

See mail servers ordered by preference and resolve their IPv4 and IPv6 addresses. Distinguish a working DNS route, broken destinations and a domain that intentionally refuses email.

Open tool

SPF checker

Inspect your published sender policy. Find duplicate records, overly permissive endings and common syntax mistakes before they affect authentication.

Open tool

DMARC checker

Inspect the policy at the exact _dmarc name and decode its tags. For inherited policy discovery and external-report authorization evidence, use the full DMARC inspector.

Open tool

DKIM checker

Enter your domain and signing selector to inspect the published DKIM key. See common format issues, key strength and revoked or testing-mode selectors.

Open tool

DNS lookup

Inspect address records, aliases, nameservers and mail-security discovery records. For reverse DNS, choose PTR and enter a public IP address.

Open tool

SPF dependency lookup

Go beyond a single TXT record. Explore nested sender policies, see the referenced domains and understand where lookup-limit risks come from.

Open tool

Email header analyzer

Paste original headers to inspect reported authentication, DKIM signing identities and the claimed transit path. The parser does not send your headers to a DNS resolver or any third party.

Open tool

DMARC draft generator

Build a copy-ready DMARC draft, understand every setting and start with monitoring. Nothing is published automatically; you remain in control of your DNS.

Open tool

DMARC report analyzer

Open an uncompressed aggregate XML report to understand receiver observations. See which sources need investigation and how aligned SPF and DKIM contributed to the result.

Open tool

MTA-STS — DNS discovery

Inspect the public DNS signal for MTA-STS, a transport-security policy for mail delivery. This check does not fetch the HTTPS policy, test its certificates or verify MX enforcement.

Open tool

TLS-RPT — DNS discovery

Discover the DNS record that requests mail-transport failure reports. TLS-RPT complements MTA-STS, while DMARC aggregate reports describe a different layer: sender authentication.

Open tool

BIMI — DNS discovery

Inspect the default BIMI DNS selector for your domain. Logo display also depends on receiver support, authentication, eligible assets and any required certificate; a TXT record is not a display guarantee.

Open tool
Good questions

Before you change DNS.

Need address-level intelligence?
How does this inspector discover inherited policies?

It follows the RFC 9989 DNS tree walk, capped at eight policy queries, with psd boundaries and an explicit trace. Older RFC 7489 receivers can use different PSL-based inheritance. External-report checks show exact DNS authorization evidence; organizational-domain equivalence for report destinations and override URIs are not fully evaluated.

Is this free, and will you send email?

The public tools are free and do not require an account. No email is sent, no SMTP session is opened and no recipient mailbox is probed. DNS tools query public records; header analysis and policy generation make no external requests. Up to 12 checks per minute are allowed per network address.

What happens to the domain I enter?

Maail does not save submitted domains or DNS results in an application history. Query names, including referenced SPF domains, are sent to Google Public DNS over HTTPS and are subject to Google’s resolver privacy policy. Request history stays in this page’s memory and disappears on reload. Rate protection stores a hash of your network address with short-lived counters; infrastructure logs may also contain request metadata. Do not enter private or sensitive hostnames.

Does a good DNS result guarantee delivery?

No. DNS is one part of mail delivery. Server availability, sender reputation, authentication of actual messages, spam filtering and recipient policies also matter. Findings describe the inspected records, not a delivery guarantee.

Build it into your workflow

Go beyond a manual lookup.

Explore Maail’s email intelligence API for address-level signals, or use these free tools whenever you need to inspect public DNS.

Explore email intelligenceRead the API guide