First CH Apps / Email DNS Checker
Enter a domain name and our server looks up MX, SPF, DKIM and DMARC to judge whether mail sent from this domain is set up to arrive. We follow every include: in the SPF record to count the DNS lookups it costs and check them against the limit of ten.
Investigating “our mail does not arrive” or “it lands in spam” starts with these four records. The verdict follows Google's sender guidelines, in force since February 2024.
SPF is evaluated by following every include:, and the whole evaluation may spend at most ten DNS lookups (RFC 7208). Cross that and the result is a permerror — the record stops working entirely. The dangerous part is that nothing announces it. You add a marketing platform, a helpdesk and a contact form, and one day some recipients start filing your mail as spam. The count on this page is measured by expanding the nested includes for real.
A DKIM public key lives at selector._domainkey.example.com. The selector is chosen by whoever sends the mail, so a domain name alone leaves you guessing. We try the common ones, but “not found” does not mean “no DKIM”. For a definitive answer, copy the selector from your Google Workspace, Microsoft 365 or ESP console.
DMARC tells receivers what to do with mail that fails SPF and DKIM. Jumping straight to p=reject also stops legitimate senders you had forgotten about — the invoicing system, the booking system. The standard path is p=none plus rua= for a few weeks, identify every sender, then move to quarantine and reject. Google's requirement is satisfied by p=none.
DMARC passes when SPF or DKIM passes *and* the domain that authenticated matches the From: domain. With an ESP it is common for SPF to pass on the provider's domain while From: uses yours — that mismatch is an alignment failure. Follow your provider's instructions for signing DKIM with your own domain and setting a custom Return-Path.
Sent: only the domain name you type and the DKIM selector, if you give one. Our server (Cloudflare Workers) queries Cloudflare's public DNS over HTTPS (cloudflare-dns.com) for MX, TXT (SPF), _dmarc and the DKIM selectors. Including the include: expansion, one check is capped at 40 queries.
Stored: nothing. Neither the domain nor the result is written to any database (no KV, no D1); everything leaves memory when the request ends. Access logs are only Cloudflare's standard ones.
Returned: the record values DNS gave us and our assessment of them. No message content, recipients or sending logs are involved — this app neither sends nor receives mail.
Note: only public DNS records can be looked up. localhost, internal domains (.internal, .local) and IP addresses are rejected.
POST /email-dns/api/check with JSON ({"domain": "example.com", "selector": "google"}) or a form body and you get the same result as JSON (no auth, nothing stored).