Public DNS, clear limits
What does your domain
ask mail receivers to check?
Review MX, SPF and DMARC records. Supply a known DKIM selector if you want its published key record checked.
Free check. No card, mailbox connection or private message upload. DNS checks are bounded to 20 seconds and cached briefly.
Scoped assistance
Want help reviewing the setup?
Tell us which domain and sending services you use. We review legitimate senders and confirm the proposed scope and quote before any changes.
No price or delivery commitment is made here. A request does not authorize DNS changes or take payment.
Assisted work involving accounts, DNS changes, private headers or network audits requires verified ownership or explicit owner authorization and an agreed scope. A help request does not authorize that work.
What this can tell you
Published records, record syntax, bounded SPF references and the requested DMARC policy under RFC 9989. A monitoring policy is not proof that reports are being received. Older receivers can interpret DMARC differently; legacy pct does not prove current enforcement.
What remains unknown
Actual-message alignment, sender authentication, DKIM signing and key strength, receiver enforcement, account compromise and overall security. We do not connect to customer hosts or mail servers, send email, upload private headers, request OAuth access, enumerate selectors or change records. No security score or guarantee is produced.
PrivacyQueries go to Cloudflare's public DNS resolver, which receives the queried names. Published records can be reviewed without asserting ownership; this gives no permission for other work. Records and results are cached in memory for at most five minutes. A help request uses StoreRx's existing private intake and stores the domain, name, email and note you choose to provide. Do not include passwords, private message headers or access tokens. Private-header review and network audits are outside this public check.