Free preflight tool
Check an email domain before it breaks.
Scan the public DNS records that decide whether custom-domain email routes cleanly and whether receiving mail servers can trust what you send.
Folio's free domain health check reads the public DNS records that decide custom-domain email deliverability: MX, SPF, DKIM signals, DMARC, and DMARC enforcement. It scores the domain out of 100, explains which records are missing or weak, and gives the next DNS action to fix before mail starts bouncing, spoofing, or landing in spam.
Updated 23 June 2026 (2026-06-23)
Reads public DNS only — no login required. Nothing is stored.
Common questions
Free DMARC & SPF checker — FAQ
- Is this a free DMARC and SPF checker?
- Yes. Enter any domain and the tool reads its public DNS — MX, SPF, DKIM presence, DMARC, and whether DMARC is actually enforced (p=quarantine or p=reject) — and scores it out of 100. No login, no payment, and nothing is stored.
- Why is my email going to spam?
- The most common causes are visible in DNS: no SPF record (or one that doesn't list your real sender), a missing or broken DKIM signature, and a DMARC policy left at p=none so receivers don't trust alignment. This check flags each of those and tells you the specific record to fix, in priority order.
- What's a good domain health score?
- Healthy is 85–100: MX present, SPF valid, DKIM signing, and DMARC enforced. 60–84 is 'watch' — mail flows but something (usually DMARC still at p=none) leaves you spoofable. Below 60 means at least one record that decides deliverability is missing or wrong.
- Does a passing score mean my domain can't be spoofed?
- It means you've published the records that let receiving servers reject forgeries — which is most of the battle. Spoofing only stops when DMARC is at p=reject and your real senders are aligned. The tool calls out when you're publishing records but not yet enforcing them.
- Do I need to change anything to run the check?
- No. It only reads public DNS, the same records any receiving mail server can already see. You don't add a TXT record, install anything, or grant access. Fixes are yours to apply at your DNS host afterward.