Usage

Type an IP address, a subnet, a domain or an email address and press Check. Results appear as each check finishes.

What you can check

• An IP address (IPv4 or IPv6): 45 blocklists and good-sender lists, 16 threat feeds (botnet command servers, hacked and attacking machines, malware and phishing), Cisco Talos's reputation, whether it is a Tor exit, reverse DNS (also traced from the root servers, so a recent change shows), the network it belongs to and its approximate location. For IPv6 only the lists that cover IPv6 are asked.
• A subnet such as 203.0.113.0/24: every address on its own, up to 254 addresses, against the main blocklists, with its reverse DNS. Select an address for its full check.
• A domain or an email address: everything a receiving mail service looks at, and the other reasons a domain gets blocked. Reachability traced from the root servers; every name server asked directly (lame delegation, serials, open resolvers, spread); WHOIS; mail servers (MX) and their addresses; SPF, with your own mail server tested against it; DKIM; DMARC; MTA-STS, TLS-RPT, DANE; BIMI; DNSSEC; CAA; domain blocklists; and the threat feeds for malware, phishing, ransomware and hacked websites, plus whether it is a throwaway email service. Enter a mail server's own name (like mail.example.com) and the domain it serves is checked.

DKIM keys live under a name the sender chooses (the selector), which DNS cannot list. About 60 common names are tried. To check yours, open Options and enter the s= value from the DKIM-Signature header of an email you sent.

Email analyzer

The email analyzer reads a whole message: drop or open its .eml file, or paste its source. It shows every server it passed through (when, how long it waited, whether that step was encrypted, each server's name tag and reputation), what the receiving server's SPF, DKIM and DMARC checks said and what they say today, and it verifies each DKIM signature itself: the body hash and the signature, with the key the sender publishes, so a message changed after it was signed shows. It lists the message's parts, every attachment with its SHA-256 (dangerous types, double extensions like invoice.pdf.exe, types that do not match their name), every link and where it really goes (Safe Links and URL Defense unwrapped, link text that names a different site, links to listed or malicious domains), forms, scripts, hidden text, tracking pixels, pressure wording and missing one-click unsubscribe. Everything is read in your browser; only addresses, server names and domains are looked up by our server. For an exact DKIM check use the file: pasting can change spaces and line ends.

Deliverability test

The deliverability test judges a real message the way a receiving mail server does. Get a one-time address and send it a normal email from the account or service you want to test (write it as you usually would, with a real subject and text). You see the sending server's address, reverse DNS, HELO name, encryption and reputation; SPF, DKIM (verified) and DMARC with alignment; the content (parts, unsubscribe, links and their reputation, attachments); and the mail software the message names, checked against the OSV vulnerability database. It is all scored out of 10, with each deduction explained. The first delivery may be greylisted: your mail server then retries by itself, usually within a few minutes. The spam filter's own score is not included.

Reading the results

• Every explanation shows the plain words and, beside them, the technical detail it is based on: the exact record, the question asked and the raw answer.
• The box at the top says, in plain words, what needs fixing. Must fix means mail is likely refused or forged. Should fix means mail works but is trusted less or could break. Clears by itself is a fact that goes away on its own, like a brand-new domain getting older.
• The table lists every check, problems first. Each problem is explained in its row: what is wrong, why it matters and how to fix it.
• Below the table each check shows every detail: the exact DNS question asked, the raw answer and how long it took.
• PASS: fine. WARNING: works, but worth improving. FAIL: broken or listed. INFO: a fact, not a judgement. ERROR: a source did not answer, so that line says nothing either way.
• A policy listing describes the kind of address or network (a home internet range, a whole provider, a brand-new domain). It is not an accusation of spam and is never counted as a blocklist hit.

Why the answers can be trusted

• Every list is tested against its own test points every six hours. A list that stopped working, refuses us, or answers "listed" for everything is shown as not used instead of being believed. Dead lists that list the whole internet are the most common false alarm on other checkers.
• When a list does not answer, it is asked again, then each of its own name servers is asked directly over UDP and TCP. Cloudflare's and Google's public resolvers are asked for its test address too (only the test address, never anything you look up). That shows whether the list is down for everyone or only refusing us, and the Sources page shows the evidence. A list that is down is tried again every 15 minutes and used again as soon as it answers.
• A list's answer code is given a meaning only where the list documents it. Otherwise the result is "listed", with the list's own reason.
• Every listing links to the list's own lookup and removal page.
• DNS questions go to our own recursive resolver, as the lists require, never through a public resolver. Blocklists give wrong answers to public resolvers.

Limits

mailcheck is free, so it is shared fairly.

• Normal use is never slowed. In any ten minutes you can run about 24 IP checks, 8 domain checks, or one full /24 subnet sweep plus a few more checks. A subnet counts one for every 16 addresses.
• Past that, each check waits before it starts: 2 seconds at first, then 4, 8 and 16, up to 30 seconds. The page counts the wait down.
• Keep going while slowed down for ten minutes and lookups are blocked for 24 hours. The ten minutes start with the first slowed check and keep running while checks keep coming. Two minutes without a check resets them.
• One check at a time per visitor.
• Subnets can be up to a /24 (256 addresses). For IPv6, enter one address or a /64. Every IPv6 address in the same /64 counts as one visitor.
• Each list has a daily allowance, so our questions never exceed what its free use allows. Once a list's allowance is used up, it shows as skipped until the next UTC day.
• Answers are kept for a few minutes, so checking the same thing again shows the same result. Wait about five minutes after a fix before checking again.
• The live port-25 (SMTP and TLS) test is switched off on this server.

mailcheck is built for people. Automated bulk lookups are not allowed; see the Terms.