Email Tools Guide: MX, SPF, DKIM, DMARC, MTA-STS & More

Email problems rarely announce their cause. A bounce says "message rejected", a customer says "your invoice landed in spam", a report shows DMARC failures from an IP you do not recognize. Behind those symptoms sit a handful of DNS records, a few mail servers and some public blocklists, and checking them one at a time by hand with dig and openssl s_client takes time.

The NetTools.tech email tools cover that chain: where mail for a domain goes, whether the receiving servers answer and offer TLS, whether outgoing mail is authenticated with SPF, DKIM and DMARC, whether sending IPs are listed on blocklists, and whether transport-security policies are published correctly. Generators help you build the records, and batch tools help when many domains or resolvers are involved. You can browse every tool on the tools page.

What these tools cover

The email category groups four kinds of tools:

Diagnostics: MX Lookup for mail routing, SMTP Test for the mail server conversation and STARTTLS, Email Health Check for a combined report, and the Email Header Analyzer for tracing one real message.
Authentication and reputation: SPF Lookup, DKIM Lookup and DMARC Lookup to read and validate the published records; SPF Record Generator, DMARC Record Generator and DKIM Record Generator to build them; MultiRBL Check and Email Blacklist Check for DNS blocklists.
Transport and compliance: MTA-STS Lookup and TLS Reporting (TLS-RPT) for enforced TLS on inbound mail, Email DNS Propagation to watch email record changes spread across resolvers, and the Email Provider Compliance Check for the DNS-visible parts of the Gmail and Yahoo bulk-sender requirements.
Utilities: Bulk DNS / Email Lookup for one record type across up to 25 domains.

What they deliberately do not do: send email, test mailbox logins, guess reputation scores, or claim inbox placement. Results are based on real DNS answers, real SMTP replies and real blocklist responses; anything that cannot be measured is reported as not checked.

Why they matter

Mail delivery depends on many independent parts working together. A typo in an SPF include, a DKIM key that was rotated on the server but not in DNS, a DMARC policy enforced too early, a missing PTR record or a backup MX not covered by the MTA-STS policy can each cause rejections or spam-folder placement, often only at some receivers. Large mailbox providers also publish explicit requirements for bulk senders, so authentication has moved from best practice to a condition for delivery.

These tools let you check each part directly, with the evidence behind every finding, so you can fix the actual cause instead of guessing. Because they run from outside your network, they show what other mail servers on the internet see.

The tools at a glance

Tool	What it does	Best for	Guide
MX Lookup	Find the mail servers that receive email for a domain.	List a domain’s MX records in priority order, resolve each mail server to its IP addresses and check reverse DNS.	Guide
MultiRBL Check	Check an IP or mail server against multiple DNS blocklists at once.	Check an IP address or mail server hostname against multiple DNS-based blacklists to identify potential email-delivery problems.	Guide
SMTP Test	Test a mail server’s SMTP banner, EHLO and STARTTLS.	Connect to a public mail server, read its SMTP banner and EHLO capabilities and check STARTTLS — without sending any email.	Guide
Email Health Check	One report covering MX, SPF, DKIM, DMARC, MTA-STS, TLS-RPT and SMTP.	Run the core email checks for a domain in one go — MX, SPF, DMARC, DKIM (with your selector), MTA-STS, TLS-RPT and SMTP/STARTTLS — with plain-language findings.	Guide
Email Header Analyzer	Trace a message’s route and authentication from its headers.	Paste raw email headers to see the delivery route, delays between hops and SPF, DKIM and DMARC results — analyzed locally in your browser.	Guide
SPF Lookup	Check and validate a domain’s SPF record.	Fetch a domain’s SPF record, expand its includes and check syntax, the 10-lookup limit and the final “all” policy.	Guide
DKIM Lookup	Fetch and check a DKIM public key by selector.	Look up the DKIM public key published at selector._domainkey.domain and check its format, key type and length.	Guide
DMARC Lookup	Check a domain’s DMARC policy and reporting setup.	Read the DMARC record at _dmarc.domain and explain its policy, alignment modes, percentage and report destinations.	Guide
SPF Record Generator	Build a valid SPF record with built-in checks.	Build an SPF record from your mail providers and IP ranges, with validation for syntax, the 10-lookup limit and record length.	Guide
DMARC Record Generator	Create a DMARC record with guided, validated options.	Build a DMARC record step by step — policy, reporting addresses and alignment — with validation and guidance for a safe rollout.	Guide
DKIM Record Generator	Generate a DKIM key pair and the DNS record to publish.	Generate a DKIM RSA key pair in your browser and get the DNS TXT record, host name, private key and public key ready to copy.	Guide
Email Blacklist Check	Check whether an IP or domain is listed on DNS blocklists.	Check a mail server IP or domain against well-known DNS-based blocklists (DNSBLs) and see the listing reason where provided.	Guide
MTA-STS Lookup	Check a domain’s MTA-STS record and policy file.	Verify a domain’s MTA-STS setup: the _mta-sts TXT record and the HTTPS policy file, including mode, MX patterns and max age.	Guide
TLS Reporting (TLS-RPT)	Check where a domain receives SMTP TLS failure reports.	Look up a domain’s TLS-RPT record at _smtp._tls and validate its reporting addresses.	Guide
Email DNS Propagation	See whether email DNS changes are visible on public resolvers.	Compare MX, SPF, DMARC, MTA-STS and TLS-RPT answers from eight public resolvers to see if your email DNS changes have propagated.	Guide
Email Provider Compliance Check	Check sender requirements of major mailbox providers.	Check your sending domain against the DNS-verifiable bulk-sender requirements of major mailbox providers (Gmail, Yahoo): SPF, DKIM, DMARC, reverse DNS of MX hosts and TLS.	Guide
Bulk DNS / Email Lookup	Look up one DNS record type for many domains at once.	Look up MX, TXT (SPF), A or another record type for up to 25 domains in one batch and copy the results.	Guide

Which tool should I use?

Problem	Tool	Guide
Mail to a domain bounces or never arrives	MX Lookup, then SMTP Test	MX Lookup guide, SMTP Test guide
You want one overview of a domain's email setup	Email Health Check	Email Health Check guide
One specific message was delayed, spoofed or failed authentication	Email Header Analyzer	Email Header Analyzer guide
SPF fails or "too many DNS lookups"	SPF Lookup	SPF Lookup guide
You need a new or cleaned-up SPF record	SPF Record Generator	SPF Record Generator guide
DKIM fails or you do not know if a key is published	DKIM Lookup	DKIM Lookup guide
Your mail server needs a DKIM key pair	DKIM Record Generator	DKIM Record Generator guide
DMARC reports do not arrive or the policy seems ignored	DMARC Lookup	DMARC Lookup guide
You want to publish or tighten a DMARC policy	DMARC Record Generator	DMARC Record Generator guide
A quick answer: is this IP or domain blocklisted?	Email Blacklist Check	Email Blacklist Check guide
You need per-list return codes and diagnostics	MultiRBL Check	MultiRBL guide
You are deploying or debugging MTA-STS	MTA-STS Lookup	MTA-STS Lookup guide
TLS failure reports never arrive	TLS Reporting (TLS-RPT)	TLS-RPT guide
A DNS change for MX, SPF or DMARC is not visible everywhere yet	Email DNS Propagation	Email DNS Propagation guide
You send newsletters and must meet Gmail and Yahoo bulk-sender rules	Email Provider Compliance Check	Compliance Check guide
You need MX or TXT records for many domains	Bulk DNS / Email Lookup	Bulk DNS Lookup guide

Typical workflows

1. Setting up email authentication for a domain

Inventory every service that sends mail as the domain, then build the record with the SPF Record Generator.
Create a DKIM key with your provider, or with the DKIM Record Generator when you must supply your own, and publish the TXT record.
Publish a monitoring policy with the DMARC Record Generator (p=none plus a report address).
Watch the new records appear with Email DNS Propagation, then validate them with SPF Lookup, DKIM Lookup and DMARC Lookup.
Send a test message to a mailbox you control and confirm spf=pass, dkim=pass and dmarc=pass in the Email Header Analyzer. Move DMARC to quarantine and reject once the reports are clean.

2. "Our mail goes to spam" or "our mail is rejected"

Run the Email Health Check on the sending domain for an overview.
Analyze the headers of an affected message with the Email Header Analyzer to see which check failed and which server sent it.
Check the sending IP with the Email Blacklist Check, and with MultiRBL Check for per-list details and removal links.
For newsletters, run the Email Provider Compliance Check with your DKIM selector to see which bulk-sender requirements are covered.

3. Enforcing TLS for inbound mail

Confirm all MX hosts with MX Lookup and test STARTTLS and certificates on each with the SMTP Test.
Publish a TLS-RPT record and verify it with TLS Reporting (TLS-RPT).
Publish an MTA-STS policy in testing mode and check it with MTA-STS Lookup.
After clean reports, switch to mode: enforce, change the id and run the MTA-STS Lookup again.

4. Mail provider migration across several domains

Lower the MX and SPF TTLs well in advance; record the current state with Bulk DNS / Email Lookup (MX, then TXT).
Change the records, then follow them per domain with Email DNS Propagation.
Re-run the bulk lookup to confirm every domain points to the new provider, and update the MTA-STS policy if MX hosts changed.

Tool guides in this category:

Neighbouring categories:

DNS & domain tools – DNS lookups, propagation, reverse DNS, WHOIS and SSL certificates.
Security testing tools – website security assessment and password tools.
Network diagnostics – ping, traceroute, MTR and port checks when a mail server is unreachable.

Frequently asked questions

Which email tool should I run first?

For a domain-level problem, start with the Email Health Check, which runs the MX, SPF, DMARC, MTA-STS, TLS-RPT and SMTP checks (and DKIM with a selector) in one report. For a problem with one specific message, start with the Email Header Analyzer and the message's full headers.

Do any of the email tools send email?

No. The SMTP Test and the checks that use it stop after the banner, EHLO and STARTTLS and disconnect with QUIT, so no sender, recipient or message is ever transmitted. All other email tools only query DNS, fetch a public MTA-STS policy or run in your browser.

Do I need to enter my email password anywhere?

No. None of the NetTools.tech email tools test authentication or ask for mailbox credentials, and you should never enter a mail password into any online testing tool.

Which email tools run entirely in my browser?

The Email Header Analyzer and the SPF, DMARC and DKIM record generators. The DKIM generator creates its key pair locally with the Web Crypto API, so the private key never leaves your browser.

What is the difference between SPF, DKIM and DMARC?

SPF lists the servers allowed to send for a domain, DKIM signs messages so receivers can verify them with a key in DNS, and DMARC tells receivers what to do when neither passes for a domain aligned with the visible From: address. Each has a lookup tool and a generator on NetTools.tech.

Can these tools tell me why my mail goes to spam?

They can show the technical causes they can measure: missing or broken authentication, blocklist listings, missing reverse DNS or TLS problems. Content, engagement and the reputation data that mailbox providers keep internally are not visible to any outside tool.

Where do the DNS-based email checks run from?

From the NetTools.tech server, which queries public resolvers such as Cloudflare 1.1.1.1 and Google 8.8.8.8, never internal DNS. Internal names like .local or .internal are rejected, and requests are rate limited per client.