Skip to content
healthcheck.email Sign in

What healthcheck.email checks

healthcheck.email reads the public records that decide whether your email arrives and whether someone could fake it. We never sign in to your accounts, and we never send mail as you. Everything we check is public: anyone on the internet can see the same records.

The three questions

Every report answers three questions in plain words:

  • Does your email work? Whether mail sent to and from your domain gets through: your MX records, your SPF record, and the DKIM keys your services sign with.
  • Can someone pretend to be you? Whether your DMARC policy tells receivers to refuse fakes, and whether every service that can send as you is one you use.
  • Could you lose your domain or your email? Your registration and when it expires, your nameservers, DNSSEC, and whether mail to you can be read in transit.

What we look at

  • Your domain's DNS records: MX, SPF, DKIM, DMARC, MTA-STS, TLS-RPT and BIMI.
  • Common subdomains that services send from, plus any you name.
  • Your registration, from the public registration database.
  • The senders your records allow, matched against a catalog of known services.
  • Whether your own sending servers or your domain are on a public blocklist, and whether those servers have reverse DNS that points back.
  • Your own mail servers, when you run them: we connect on port 25, read the banner, ask for STARTTLS, and check the certificate's name, expiry and issuer. We never send a message. Servers run by your email provider, like Google or Microsoft, are theirs to manage, so we leave them alone. Before testing yours, we connect to a server that always answers; if that fails, the mail port is blocked from where the check runs, and we say we couldn't test rather than blame your server. A server that asks us to try again later is counted as untested, not down.
  • The email addresses your own website shows, on its home, contact and about pages and in its security.txt. We read only those pages, and we honour robots.txt. Each address becomes a question on the Mail flows tab: what sends from it, and do we check that?

What we don't see

We can't see your mailboxes, your sending volume, or how recipients treat your mail. So a clean report means your setup is right. It doesn't promise every message lands in the inbox; Why mail lands in spam covers the rest.

In healthcheck.email

Add a domain from the Domains page. The first check runs within a minute, and the report opens on the domain's Overview tab.