SieveGuard
Free tool · No signup · DNS-only

Free domain health check

Composite SPF / DKIM / DMARC / MX check with a single 0-100 score.

A composite SPF / DKIM / DMARC / MX check rolled into a single 0-100 score. The same engine that powers the in-app Domain Health add-on, exposed here without an account — one lookup, the full picture.

How the 0–100 score is built

SPF, DKIM, DMARC and MX are each checked and weighted into one composite, so a domain missing DKIM entirely cannot score as well as one where only the DMARC policy is weak.

It is a DNS posture check, not a delivery test. A perfect score confirms your records are right; it says nothing about your sending reputation, which is the other half of whether mail arrives.

Background reading

  • How SPF, DKIM and DMARC work together— The three records in one picture — what each proves, which one receivers actually enforce, and what Gmail and Yahoo now require.
  • What is sender reputation?— Domain reputation and IP reputation are different scores with different owners — and on a shared IP only one of them is yours to fix.
  • What is email warmup, and does it work?— Realistic ramp schedules, plus an honest account of the cases where warmup does nothing at all and something else is wrong.
  • What is a good email bounce rate?— The thresholds providers actually act on, why hard and soft are different problems, and where the 2% rule of thumb comes from.
  • Disposable email addresses— Why domain blocklists decay within weeks of publication, and the structural signals that keep working after the list goes stale.
  • What is multi-accounting?— Gmail dot-folding and plus-addressing worked through — including the canonicalisation we run on every address in production.
  • Role-based email addresses— Why shared mailboxes drive complaints, and the cases where blocking them at signup costs more revenue than it protects.
  • VoIP vs mobile numbers— What line-type lookup can and cannot tell you, and why treating VoIP as fraud blocks a lot of legitimate customers.

FAQ

How is the 0-100 score calculated?+

It's a weighted roll-up of the four checks — SPF, DKIM, DMARC, and MX. Present, valid, and appropriately strict records earn full marks; missing or weak ones (a DMARC policy stuck at none, a soft-fail SPF, no DKIM key) cost points. It's the same scoring the in-app Domain Health add-on uses.

What counts as a good score?+

Roughly: 85+ is a strong, enforced posture; 65-84 is functional but has room to tighten (often DMARC not yet at reject); 40-64 means a pillar is missing or weak; below 40 means authentication is largely absent and your mail is at real risk of spam or rejection.

Why include MX records in an authentication check?+

MX records prove your domain can actually receive mail, which matters for two-way deliverability, bounce handling, and DMARC reporting. A domain with great SPF/DKIM/DMARC but no MX is configured to send but can't receive — usually a sign the setup is incomplete.

Which check should I fix first?+

Follow the breakdown. If SPF or DKIM is missing, fix authentication first — DMARC can't enforce without at least one of them aligning. If both pass but DMARC is at none, your next move is to ramp DMARC toward enforcement.

Is this the same as a real inbox placement test?+

No. This checks your DNS authentication posture, which is the foundation of deliverability. Whether a specific message lands in the inbox also depends on content and reputation — for that, use the email spam checker, or run a real seed-list placement test inside SieveGuard.

How often should I run it?+

At domain setup, as pre-send QA before important campaigns, and on a recurring schedule for monitoring. DNS drifts; a clean score today doesn't guarantee a clean score after the next stack change.

Want this score on every domain you ingest?

SieveGuard's Domain Health add-on runs this exact composite check on every email address you screen, surfaces the score as a per-record badge, and alerts you the moment a record changes. Free during your trial.

Other free tools

SPF checker →

Pull and parse your domain's SPF record and policy.

DKIM checker →

Probe the common DKIM selectors and confirm signing is live.

DMARC checker →

Read your DMARC policy + pct% and flag weak posture.