Enter your domain. In a couple of seconds you get an honest report on the records that decide whether your email is trusted: SPF and whether it actually enforces anything, DKIM, DMARC and whether its policy blocks anyone, your mail routing, and the hardening records most domains never publish.
No signup, no email required. This reads public DNS records only — nothing is sent to your domain and no mail is generated.
These records decide whether your mail is allowed to arrive. They say nothing about whether it lands in the inbox or the promotions tab — that comes down to sending reputation, list hygiene and what you actually send, none of which is visible in DNS.
SPF and whether there is exactly one of it, what its final mechanism actually enforces, and whether it stays under the ten-lookup limit. Plus DKIM and DMARC. Two SPF records is not a minor untidiness: it breaks SPF completely.
Whether DMARC is set to reject, quarantine or the very common p=none — which monitors and blocks nothing. Plus reporting, rollout percentage, subdomain policy and alignment mode.
MX records, whether there is a fallback host, and which provider you are on. A domain deliberately configured to send no mail at all is recognised as correct, not failed.
MTA-STS, TLS reporting and BIMI. These stop an attacker downgrading mail to an unencrypted connection, and tell you when encrypted delivery is failing.
Two things this deliberately does not do. It cannot list your DKIM selectors, because DNS offers no way to enumerate them — it probes the common ones and, if it finds nothing, says it could not confirm rather than claiming DKIM is missing. And it runs no blocklist checks at all, because a check that gets rate-limited by the blocklist would produce an unreliable answer, and an unreliable “you are blacklisted” is worse than no answer.