Five checks. Each runs in 30 seconds. The first four don't require any signup or account.
SPF is a TXT record at the apex of your domain (e.g. example.com). It lists which IP addresses and servers are allowed to send email as that domain. If you're using Google Workspace, your SPF record looks like v=spf1 include:_spf.google.com ~all.
Check it:
dig TXT example.comOr just paste your domain into our email API and look at the SPF section.
What's a good result: exactly one v=spf1 record, ending in -all (strict), with fewer than 10 DNS lookups. (More than 10 is an RFC violation — some receivers will reject.)
DKIM adds a cryptographic signature to every outgoing email. Receiving servers verify the signature against a public key stored in DNS. If the signature doesn't match, the email is suspect.
The public key is at selector._domainkey.example.com, where selector is something your ESP chose (often default, google, k1, etc.).
Check it:
dig TXT default._domainkey.example.comYou're looking for a record that starts with v=DKIM1.
What's a good result: a valid v=DKIM1 record on at least one selector. If you use a custom selector that we don't probe, we won't find it — check with your ESP for the exact selector.
DMARC ties SPF and DKIM together. It's a TXT record at _dmarc.example.com that says: "if an email claims to be from me but fails SPF or DKIM, please reject it".
Check it:
dig TXT _dmarc.example.comYou're looking for v=DMARC1 and a p= (policy) tag. The policy is one of:
p=none — "monitor only, do nothing". Useless for protection. Required as a starting point, but not where you want to stay.p=quarantine — "send failures to spam". A real step up.p=reject — "reject failures outright". The strictest. What you want once you're confident nothing legitimate will fail.MX records tell other servers where to deliver email addressed to your domain. If you don't have any, you can't receive mail. (You can still send through a third-party ESP.)
dig MX example.comWhat's a good result: one or more MX records pointing to a working mail server. If you use Google Workspace, you should see aspmx.l.google.com.
If your IP is on Spamhaus, Barracuda, or any of the other public blocklists, your email will be rejected or sent to spam by every server that checks those lists. You can check at /ip by passing your sending server's IP.
What's a good result: "low" risk, 0 of 7 DNSBLs listing the IP.
What to do if you're listed: Most blocklists have a "delist" form. The trick is figuring out why you were listed — usually a misconfigured server, a compromised account, or a customer who marked your email as spam.
If you don't want to remember which DNS server to query, our email API does all five checks in one call and returns a 0-100 score:
curl "https://api.sitetrace.it.com/api/email?domain=example.com" | jq .scoreScore ≥80, low risk: you're fine. Score 50-80, medium: there are gaps. Score <50, high: something is broken.