No account required
Free tools that show the evidence, not a mystery score.
Diagnose public email-authentication records and inspect original message headers. Every result states what was observed and what it cannot prove.
Available MailDNS tools
Authentication policy
Start with the whole domain, then trace the policies that authorize and govern senders.
- Domain authentication scanCheck SPF, DMARC, MX, MTA-STS, TLS reporting, DNSSEC, and DANE with direct evidence.Live public DNS
- SPF lookup analyzerTrace includes and redirects, expose cycles, and inspect the ten-term and two-void-lookup limits.Recursive DNS graph
- SPF policy generatorImport an existing record without dropping terms, edit it safely, inspect its static lookup budget, and export an exact TXT value.Local round-trip editor
- DMARC rollout plannerGenerate current RFC 9989 records, flag risky policy choices, and prepare RFC 9990 external reporting authorization.RFC 9989 rollout
- BIMI evidence validatorTrace organizational records, evaluate DMARC readiness, and inspect logo plus leaf-certificate validity without claiming VMC trust.DNS, HTTPS, and SVG
Infrastructure and transport
Inspect the keys, receiving hosts, certificates, and registration signals behind delivery.
- DKIM selector checkerDecode RSA or Ed25519 keys, compare resolvers, inspect TTL and DNSSEC, and detect revocation.Multi-resolver DNS
- SMTP STARTTLS checkerInspect real MX endpoints, TLS negotiation, cipher, certificate trust, hostname coverage, and expiry.Active port-25 probe
- Certificate and domain lifecycleTrace CA authorization, registrar status, registration dates, and expiration warnings with resolver evidence.CAA and authoritative RDAP
Private message evidence
Analyze a message locally when public DNS alone cannot explain what a receiver evaluated.
- Private DMARC report analyzerOpen XML, GZIP, or ZIP reports locally, reconcile every message total, inspect source outcomes, and export formula-safe CSV.Runs entirely in your browser
- Private EML inspectorRead Authentication-Results, DKIM, SPF, ARC, and attachments without uploading the message.Runs entirely in your browser
- Private bounce analyzerParse delivery-status fields per recipient, separate SMTP evidence from unscoped text, and explain enhanced status families without uploading the message.Runs entirely in your browser