example.com.au.._domainkey, such as s1.Enter a domain, or paste an email address, to check its mail setup.
Email setup for
🔒 Your browser asks a public DNS service directly — lookups never pass through our servers.
Using an AI agent or a script? Call this tool as an API
AI agents and scripts can call this tool directly, to check their work or look something up, and get JSON back with the same answer this page gives. No key needed.
GET https://digitalgreenhouse.com.au/api/tools/mx-email-check?domain=digitalgreenhouse.com.au&selector=selector1domain— string, required. Domain name. A URL or email address also works. Also accepted asd.selector— string, optional. Optional DKIM selector to check as well as the common ones (the s= value in a DKIM-Signature header). Also accepted ass.
The API answers from our server, and our code doesn’t store what you send. Fair-use limits apply. API guide · all endpoints (JSON) · OpenAPI
The four records behind business email
Email works on trust that DNS records set up. Two questions matter: can mail reach you, and can a receiving server tell real mail from your domain apart from a forgery? Four records answer them:
- MX — the mail servers that receive email for the domain. No MX, no inbound email.
- SPF — a TXT record starting
v=spf1that lists the servers allowed to send email as the domain. A domain should have exactly one. - DKIM — a public key published under a selector name (such as
selector1._domainkey). Your mail service signs each message, and receivers check the signature against this key. - DMARC — a TXT record at
_dmarcthat tells receivers what to do when a message fails SPF and DKIM: let it through (none), send it to spam (quarantine) or refuse it (reject). It also says where to send reports.
SPF and DKIM on their own don’t stop someone forging your name in the “From” line that people actually see. DMARC is what ties them to that address, which is why a missing or monitoring-only DMARC policy is the most common reason a domain can still be spoofed. The Australian Signals Directorate’s guidance, How to combat fake emails, recommends all three, moving DMARC to quarantine and then reject once your legitimate email is passing.
It says no DKIM was found, but I’m sure we have it. Why?
s= part of the DKIM-Signature header of an email the domain has sent.What is the SPF 10-lookup limit?
include, a, mx, ptr, exists and redirect, including those inside the records you include. Go over and SPF fails outright for every message, which is easy to do once you add a few mailing and helpdesk services. We follow the includes and count them for you.Which DMARC policy should I use?
p=none and a rua address so you receive reports and can see every service sending as you. Once those all pass, move to p=quarantine, then p=reject. Staying on p=none for good means forged email is still delivered.My domain doesn’t use email. Does any of this matter?
v=spf1 -all (no server may send) and a DMARC record of v=DMARC1; p=reject. A “null MX” record (MX 0 .) also tells senders not to try delivering to it.