Email DNS Record Inspector
Deeply inspect MX, SPF, DMARC, and DKIM public DNS records for protocol syntax, PermError risks, and RFC conformance.
Queries are strictly bounded to public DNS MX and TXT records using Cloudflare Public DoH (1.1.1.1). No SMTP connections, inbox handshakes, or private resolvers are ever queried.
Query target: google.com
Required to inspect <selector>._domainkey
Technical Boundaries & Query Scope
- Domain MX Records: Direct queries for MX resource records to identify authoritative mail exchangers.
- Domain SPF Records: Direct queries for TXT resource records on the domain to detect and parse v=spf1 declarations.
- Domain DMARC Records: Direct queries for TXT resource records on _dmarc.<domain> to parse v=DMARC1 policy tags.
- DKIM Selector Records: Targeted queries for TXT resource records on <selector>._domainkey.<domain> when an explicit selector is specified.
- Fixed Resolver: All requests route strictly through Cloudflare 1.1.1.1 Public DNS-over-HTTPS. No arbitrary endpoints, private network resolvers, or SMTP handshakes are contacted.
Email DNS Record Inspector & Protocol Guide
Deeply inspect MX, SPF, DMARC, and DKIM public DNS records for protocol syntax, PermError risks, and RFC conformance.
Overview
The Email DNS Record Inspector examines public DNS records critical for email authentication and delivery. It evaluates Mail Exchangers (MX) for priority and RFC 7505 Null MX advertisements, validates SPF (RFC 7208) syntax and flags PermErrors from multiple records or exceeding the 10-lookup cap, inspects DMARC (RFC 7489) policies and reporting tags, and validates DKIM (RFC 6376) selectors for key strength and revocation.
How to Inspect Email DNS Records
Input your root domain or subdomain (e.g. google.com or mail.example.org). Bare hostnames and URLs are automatically normalized to ASCII Punycode.
If you want to inspect a DomainKeys Identified Mail signature key, provide your provider selector (e.g. "google", "default", "selector1", or "k1").
Review the consolidated health overview, individual protocol cards, PermError warnings, and RFC citations. Copy or download the full audit report as Markdown.
google.com (Selector: google)
MX: 5 authoritative servers (aspmx.l.google.com) SPF: v=spf1 include:_spf.google.com ~all (1/10 DNS lookups) DMARC: v=DMARC1; p=reject; rua=mailto:[email protected] DKIM: 2048-bit RSA active public key at google._domainkey.google.com
All records conform to standard email authentication RFCs. SPF remains well below the 10-lookup threshold, DMARC enforces a strict p=reject policy, and DKIM utilizes a 2048-bit RSA public key.
- RFC 7208: Strict single SPF record check (multiple records immediately produce PermErrors) and 10 DNS lookup limit tracking.
- RFC 7489: Evaluates mandatory DMARC tags, policy values (p=none, quarantine, reject), and reporting URIs.
- RFC 6376 §3.6.1: Identifies revoked DKIM keys (empty p= tag) and flags legacy sub-2048-bit keys.
- RFC 7505: Recognizes Null MX records (priority 0, target ".") designating domains that reject incoming email.
- Cloudflare Public DoH: All queries route strictly through Cloudflare 1.1.1.1 DNS-over-HTTPS with zero private resolver access.
- Zero SMTP Connections: No mailboxes, mail servers, or recipient addresses are connected to or pinged.
- Inspection Disclaimer: DNS inspection verifies syntax and published policies only; it does not guarantee actual inbox placement or spam filtering outcomes.