Email DNS Mini-Check
A free client-side sanity check for MX, SPF, DMARC, DNSSEC/DS, optional DKIM selectors, and optional sending-IP reverse PTR. No login. No DNS dashboard access. No mailbox access. It queries public DNS from your browser and gives you a plain-English first read.
Privacy note: this page does not send your domain to Tuck Sentinel. The DNS lookups go directly from your browser to Cloudflare's public DNS-over-HTTPS resolver when you click the button.
Summary
When this is worth paying for
If password resets, receipts, support replies, or founder emails are landing in spam, the mini-check is only the first pass. A real review maps your senders, checks SPF/DKIM/DMARC alignment, explains provider-specific weirdness, and gives you a fix order.
Advisory only. Not a deliverability guarantee, reputation repair service, spam setup, phishing help, legal opinion, or compliance certification.
What the checks mean
- MX tells the internet which mail servers receive mail for your domain.
- SPF says which services may send mail for your domain. More than one SPF record is a problem, and SPF has a 10 DNS-lookup limit.
- DMARC tells receivers what to do when SPF/DKIM alignment fails.
p=noneis monitoring;quarantineandrejectare stricter.aspfandadkimcontrol alignment strictness. - DKIM proves a sending service signed the message. You need the selector from your mail provider or message headers to check it.
- DNSSEC/DS checks whether the domain has a DS record at the parent zone. Missing DS is common; a broken/mismatched DS is the real outage risk.
- Reverse PTR checks whether a sending IP resolves back to a hostname. This only matters when you send mail directly from that IP.