Email Authentication & Deliverability Tools
Check and fix the DNS records that decide whether your mail is trusted: SPF, DKIM and DMARC for authentication, BIMI for brand logos, and MTA-STS and TLS-RPT for encrypted delivery.
When the records look right but mail still lands in spam, send a real message to the deliverability test, test your SMTP server directly, or paste a received message's headers into the header analyzer.
12 free email tools
- SPF CheckerValidate SPF syntax and the 10-lookup limit
- DKIM CheckerLook up and validate a DKIM key by selector
- DMARC CheckerCheck DMARC policy, alignment and reporting
- BIMI CheckerBrand indicators for email
- MTA-STS CheckerEnforced TLS mail delivery
- TLS-RPT CheckerSMTP TLS reporting
- Deliverability TestSend a test email, get a 0-10 score
- SMTP TestConnect, STARTTLS, log in and send through an SMTP server
- Header AnalyzerParse a received email's headers, auth results, and hop delays
- SPF Record GeneratorBuild an SPF record with a 10-lookup check
- DMARC Record GeneratorBuild a DMARC policy record from your settings
- DKIM Key GeneratorGenerate an RSA key pair and DKIM DNS record
Guides: Web & Mail Servers
- Postfix as a Relay, with MiltersConfiguring Postfix to relay for internal networks or through a smarthost with SASL auth, restriction stages (client/helo/sender/recipient/data), and wiring OpenDKIM/OpenDMARC/SpamAssassin as milters.
- Postfix postscreen and Pre-Queue Spam DefenseHow postscreen filters connections before smtpd, the deny/pass list, DNSBL weighting, deep protocol tests (pipelining, non-SMTP, bare newline), greylisting effect, and tuning to avoid false positives.
- Dovecot IMAP BasicsDovecot's role in a mail stack, Maildir vs mdbox, authentication and userdb/passdb, the LMTP hand-off from Postfix, SSL, and debugging login and delivery with doveadm.
- unbound as a Recursive ResolverRunning unbound for a LAN or a single host: DNSSEC validation, caching, access control, forwarding vs full recursion, local zones and overrides, DoT upstream, and prefetching.
- OCSP Stapling and Modern TLS ConfigA current TLS server config for Nginx and Apache: protocols and ciphers, OCSP stapling, session resumption, HSTS, OCSP must-staple, and testing with testssl.sh and the checker.
- HAProxy BasicsThe frontend/backend model, L4 vs L7 mode, balance algorithms, health checks, sticky sessions, ACL-based routing, TLS termination, and reading the stats page and logs.
Checking a whole domain? The Super Scanner runs every DNS, email, website and security check at once and gives one score.