Domain health check

Runs MX, SPF, DMARC, DKIM selector discovery, MTA-STS with TLS-RPT, DNSSEC, reverse DNS of the mail servers, BIMI and CAA in parallel and returns one section per check. A section that fails is marked and the status becomes unknown. There is no score.

Updated 2026-10-25

What this tool checks

An email security check that stops at SPF and DMARC misses half of what decides whether a domain can be trusted. The domain health check runs nine checks on one domain at the same time and puts the results in one report:

MX lookup: where the domain receives mail, null MX and hosts that do not resolve.
SPF check: the SPF record, its include tree and the limit of ten DNS lookups.
DMARC check: the policy, alignment and reporting addresses.
DKIM selector finder: keys under 27 common selectors, checked like single DKIM records.
MTA-STS and TLS-RPT check: the policy that makes senders use TLS, and the TLS failure reports.
DNSSEC check: whether the domain is signed and validates.
Reverse DNS check: PTR records for the mail server addresses and whether they resolve back.
BIMI record check: the brand logo record and whether DMARC is strict enough for it.
CAA record check: which certificate authorities may issue certificates.

Every section behaves exactly like the tool it links to, so a finding in the report means the same as on the single check.

How to read the result

The report has one section per check and one list of findings with codes, severities and evidence. The overall status is the most serious severity among the findings: ok when nothing was found, then info, warning and error. There is no score and no ranking. Some findings are plain information, such as a domain without BIMI or without DNSSEC; whether that matters depends on the domain.

When one section cannot be completed, for example because a DNS resolver times out, the report keeps the sections that finished, adds the technical finding for the one that failed and sets the overall status to unknown. Only when every section fails is no report produced.

When to use it

Before you move a domain to a new mail or DNS provider, to record how things looked.
After a change, to see that nothing else broke.
When mail from a domain lands in spam and you do not know where to start.

For a narrower question, the single tools are faster to read. The mail configuration check is the shorter report for MX, SPF, DMARC and known DKIM selectors.

Limitations

The check reads public DNS and fetches the MTA-STS policy file. It does not connect to mail servers on port 25 and does not send mail.
DKIM is searched with a fixed list of selectors. Not finding one is a hint, not proof that DKIM is missing; see the DKIM guide.
DNSSEC status comes from the validating public resolvers, not from local validation.
BIMI logos and certificates are not downloaded.

Use it from code

API reference for Domain health check

curl -i "https://api.probekit.dev/v1/domain/health?domain=example.com"

A request without payment is answered with 402 Payment Required and the exact price. See the API reference.

Limits

Input	Domain
Deadline	15 seconds
Freshness	Up to 5 minutes, never longer than the record TTL
Price	$0.08 per check

Findings this tool can report

BIMI (6)

Warning BIMI_DMARC_NOT_ENFORCED DMARC is not enforced strongly enough for BIMI.
Warning BIMI_INSECURE_URL A BIMI URL does not use HTTPS.
Error BIMI_INVALID_RECORD The BIMI record is not valid.
Warning BIMI_LOGO_NOT_SVG The BIMI logo URL does not point to an SVG file.
Info BIMI_NOT_FOUND The domain publishes no BIMI record.
Info BIMI_NO_VMC The BIMI record has no mark certificate (a= tag).

CAA (5)

Warning CAA_INVALID_IODEF The CAA iodef target is not a mailto: or https: address.
Warning CAA_INVALID_VALUE A CAA record value cannot be parsed.
Info CAA_NOT_FOUND The domain has no CAA records.
Info CAA_NO_ISSUANCE CAA forbids certificate issuance for the domain.
Error CAA_UNKNOWN_CRITICAL_TAG A CAA record marks an unknown tag as critical.

Check (1)

Warning CHECK_QUERY_BUDGET_EXCEEDED The check stopped after reaching its DNS query limit.

DKIM (7)

Error DKIM_INVALID_KEY The DKIM public key is not valid base64.
Warning DKIM_KEY_REVOKED The DKIM key for this selector is revoked (empty p tag).
Error DKIM_MULTIPLE_RECORDS More than one DKIM record was found for the selector.
Info DKIM_NO_COMMON_SELECTORS No DKIM key was found under the common selectors that were tried.
Error DKIM_SYNTAX_ERROR The DKIM record contains a tag that cannot be parsed or has an invalid value.
Info DKIM_TESTING_MODE The DKIM record is in testing mode (t=y).
Warning DKIM_WEAK_KEY The RSA key is shorter than 1024 bits.

DMARC (10)

Info DMARC_INHERITED The DMARC policy comes from the organisational domain.
Error DMARC_INVALID_POLICY The DMARC record has a missing or invalid p tag.
Error DMARC_MULTIPLE_RECORDS More than one DMARC record was found.
Warning DMARC_NOT_FOUND No DMARC record was found for the domain or its organisational domain.
Info DMARC_NO_RUA The DMARC record has no aggregate report address (rua).
Info DMARC_PARTIAL_PCT The DMARC policy applies to only part of the failing mail (pct below 100).
Info DMARC_POLICY_NONE The DMARC policy is p=none (monitoring only).
Error DMARC_SYNTAX_ERROR The DMARC record contains a tag that cannot be parsed or has an invalid value.
Info DMARC_UNKNOWN_TAG The DMARC record contains tags that are not defined.
Info DMARC_UNSUPPORTED_REPORT_URI A DMARC report address uses a scheme other than mailto.

DNS (3)

Error DNS_DOMAIN_NOT_FOUND The DNS resolver reported that the domain does not exist.
Warning DNS_RESOLVER_FAILURE The DNS resolver returned a server failure.
Warning DNS_RESOLVER_TIMEOUT The DNS resolver did not answer in time.

DNSSEC (6)

Error DNSSEC_BOGUS DNSSEC validation fails for the domain.
Warning DNSSEC_DEPRECATED_ALGORITHM The zone uses a DNSSEC algorithm that should no longer be used.
Error DNSSEC_DS_WITHOUT_DNSKEY A DS record has no DNSKEY with the same algorithm.
Warning DNSSEC_INDETERMINATE The DNSSEC status of the domain could not be determined.
Info DNSSEC_NOT_SIGNED The domain is not signed with DNSSEC.
Warning DNSSEC_SHA1_DIGEST A DS record uses a SHA-1 digest.

MTA-STS (10)

Error MTASTS_INVALID_POLICY The MTA-STS policy file is not valid.
Error MTASTS_INVALID_RECORD The MTA-STS record has invalid syntax.
Warning MTASTS_LOW_MAX_AGE The MTA-STS policy has a max_age below one day.
Info MTASTS_MODE_NONE The MTA-STS policy is in mode none.
Warning MTASTS_MODE_TESTING The MTA-STS policy is in testing mode.
Error MTASTS_MULTIPLE_RECORDS More than one MTA-STS record is published.
Error MTASTS_MX_NOT_COVERED An MX host is not covered by the enforced MTA-STS policy.
Warning MTASTS_MX_NOT_COVERED_TESTING An MX host is not covered by the MTA-STS policy in testing mode.
Info MTASTS_NOT_FOUND The domain publishes no MTA-STS record.
Error MTASTS_POLICY_UNAVAILABLE The MTA-STS policy file could not be fetched.

MX (5)

Warning MX_NOT_FOUND The domain has no MX records.
Info MX_NULL The domain publishes a null MX and does not accept mail.
Error MX_NULL_WITH_OTHERS A null MX is published together with other MX records.
Error MX_TARGET_IS_IP An MX record points to an IP address instead of a host name.
Error MX_TARGET_UNRESOLVABLE An MX host has no A or AAAA records.

Reverse DNS (4)

Warning PTR_MISSING A mail server address has no PTR record.
Info PTR_MULTIPLE_RECORDS A mail server address has more than one PTR record.
Warning PTR_NOT_FORWARD_CONFIRMED The PTR name of a mail server address does not point back to it.
Info PTR_NO_MAIL_HOSTS The domain has no MX hosts whose reverse DNS could be checked.

SPF (13)

Error SPF_INCLUDE_LOOP The SPF chain returns to a domain it already evaluated.
Error SPF_INCLUDE_NOT_FOUND An included or redirected domain has no SPF record.
Info SPF_MACRO_NOT_EVALUATED An SPF record contains macros that were not evaluated.
Error SPF_MULTIPLE_RECORDS More than one SPF record was found for a name in the SPF chain.
Warning SPF_NEUTRAL_ALL The SPF policy ends with ?all.
Warning SPF_NOT_FOUND No SPF record was found for the domain.
Warning SPF_NO_ALL The SPF record has no all mechanism and no redirect.
Error SPF_PASS_ALL The SPF policy ends with +all.
Warning SPF_PTR_MECHANISM An SPF record uses the ptr mechanism.
Info SPF_SOFTFAIL_ALL The SPF policy ends with softfail (~all).
Error SPF_SYNTAX_ERROR An SPF record contains a term that cannot be parsed.
Error SPF_TOO_MANY_LOOKUPS The SPF record needs more than 10 DNS lookups.
Error SPF_TOO_MANY_VOID_LOOKUPS More than two SPF lookups returned no data.

TLS-RPT (2)

Warning TLSRPT_INVALID The TLS-RPT record is not valid.
Info TLSRPT_NOT_FOUND The domain publishes no TLS-RPT record.

Frequently asked questions

What does the domain health check cover?

Nine checks run together on the domain: MX, SPF, DMARC, DKIM selector discovery, MTA-STS with TLS-RPT, DNSSEC, reverse DNS for the mail servers, BIMI and CAA. Each has its own section in the report, and each also exists as a separate tool.

Why is there no score?

A single number hides what matters. A domain without BIMI and a domain whose DNSSEC is broken would lose points for very different reasons. The report gives every finding with its code and severity, and the overall status is the most serious severity found. You decide what matters for your domain.

Why is the status unknown?

If one of the sections could not be completed, for example because a resolver timed out, that section is marked with the technical finding and the overall status becomes unknown. The other sections are still shown. Running the check again usually completes it.

How is this different from the mail check?

The mail configuration check covers MX, SPF, DMARC and DKIM for selectors you supply. The domain health check adds MTA-STS, TLS-RPT, DNSSEC, reverse DNS, BIMI and CAA, and searches for common DKIM selectors itself.