---
title: "Email deliverability checker"
description: "Check any domain’s SPF, DKIM, DMARC, BIMI and MX records against live DNS. See the records as published, what each one actually says, and what is missing."
url: "https://nextmail.sh/tools/deliverability"
---

Tools

# Is your domain set up to be trusted?

SPF, DKIM, DMARC, BIMI and MX, read from live DNS. You get the records as published and what each one actually says, not a score and a sales call.

## What each record does

- **MX**
  Where mail addressed to the domain is delivered. Without it nothing arrives at all, whatever else is configured.
- **SPF**
  A published list of the servers allowed to send as the domain. Its hidden failure is the ten-lookup limit: go past it and SPF stops working entirely, while the record still looks correct.
- **DKIM**
  A signature on each outgoing message, checked against a public key in DNS. It survives forwarding, which is the one thing SPF cannot do.
- **DMARC**
  The instruction that ties the other two together: what a receiver should do when a message fails. Without it, a receiver that catches a forgery has nothing from you telling it to act, and usually delivers it.
- **BIMI**
  Your logo beside your mail in supporting clients. It is a reward for having DMARC enforced, not a substitute for it, and most receivers want a Verified Mark Certificate too.

Nothing is stored. Each check is a set of public DNS queries made when you press the button, and the answers are the same ones any receiving mail server would get.

## Questions this raises

[How Nextmail checks senders](https://nextmail.sh/features.md#safety)[DMARC on your own domains](https://nextmail.sh/features.md#dmarc)[All tools](https://nextmail.sh/tools.md)