DNS Toolbox & Record Inspector
Web & network Network on demand
Email Authentication & Domain Health Checker
Manual-first with explicit DoHAudit SPF, DKIM, DMARC, BIMI and transport policies with optional DNS lookup.
Manual records
Health score
85/100Errors
0Warnings
2SPF DNS terms
5/10DMARC policy
quarantineReport messages
128Prioritized authentication findings
Evidence is grouped by protocol and never presented as an inbox-placement guarantee.
InformationIncluded SPF record was not loaded
mail.example.orgWarningObserved DKIM public-key material is short
mail2026._domainkey.example.com · 73WarningDMARC applies to only part of traffic
_dmarc.example.com · 50Cloudflare DNS query plan
Only clicking Query DNS sends these domain names and the TXT record type to cloudflare-dns.com. No email, XML report or account credential is sent.
SPF
example.comDKIM
mail2026._domainkey.example.comDMARC
_dmarc.example.comBIMI
default._bimi.example.comMTA-STS
_mta-sts.example.comTLS-RPT
_smtp._tls.example.comHealth report
Authentication is not deliverability
Reputation, message content, list quality, PTR, TLS, unsubscribe behavior and receiver-specific filtering still affect delivery.
How to use it
- 01
Enter a domain or records
Paste records privately, or explicitly query the displayed DNS names through Cloudflare DoH.
- 02
Review authentication
Inspect SPF lookup budget, DKIM key evidence, DMARC alignment and mail transport policy.
- 03
Summarize and improve
Parse DMARC XML, draft reviewed DNS records and export a transparent health report.
Frequently asked questions
What leaves the browser?
Only an explicit DNS lookup sends the displayed domain and selector names to Cloudflare DNS. Manual records and DMARC XML stay local.
Does a high score guarantee inbox delivery?
No. Authentication configuration is one factor; reputation, content, list quality and receiver policy are outside this tool.
Does the tool cryptographically verify DKIM messages?
No. It reviews the published selector record and observable key material, not an email signature.
Can generated records be published directly?
They are drafts. Confirm every legitimate sender, mailbox and rollout policy with the responsible DNS and mail teams.
Related tools
Keep working with other focused browser utilities.