Try:
Check a domain's mail servers (MX), reverse DNS, SPF, DMARC and DKIM — the DNS-level configuration behind reliable email delivery.
This is a DNS-level mail-configuration check — no port 25 required.
Type a domain like example.com, or paste a full email address and the tool strips it down to the domain. Optionally add a DKIM selector to check a signing key too — or click the github.com + DKIM example to fill one in.
A single check fans out over encrypted DNS-over-HTTPS to your MX mail servers, their IP addresses and reverse DNS, plus SPF, DMARC and optional DKIM records. Because Cloudflare and most networks block outbound port 25, this reads configuration instead of opening a live socket.
A summary row shows whether MX, SPF, DMARC, reverse DNS (and DKIM) are present, with the raw records grouped below. Want the full DNS picture? Run a DNS lookup. Want to reach a mail server on a specific port? Try the Ping tool.
Which port to use when you configure an SMTP client or server.
| Port | Encryption | Used for |
|---|---|---|
| 25 | Optional (STARTTLS) | Server-to-server relay (MTA → MTA). Usually blocked for outbound client sending to curb spam. |
| 587 | STARTTLS | Modern message submission from authenticated clients. The recommended port for sending mail from an app. |
| 465 | Implicit TLS (SMTPS) | Submission with TLS from the first byte. A widely supported alternative to 587. |
| 2525 | STARTTLS | Unofficial fallback submission port some providers offer when 587 is blocked. |
What a mail server is telling you during an SMTP conversation.
| Code | Meaning |
|---|---|
| 220 | Service ready — the server greeted you and is ready to accept commands. |
| 250 | Requested action completed — e.g. the recipient was accepted. |
| 354 | Start mail input — send the message body, end with a single dot on its own line. |
| 421 | Service not available — the connection is being closed (often rate-limiting). |
| 450 / 451 | Temporary failure — try again later (greylisting or a transient error). |
| 550 | Mailbox unavailable — recipient rejected (no such user, or blocked). |
| 554 | Transaction failed — often a policy or reputation rejection. |
When you need an actual handshake, test from a machine that allows outbound SMTP.
Plain connection to the submission port and an EHLO greeting (shows supported extensions such as STARTTLS and AUTH):
# connect and greet (port 587 submission)
telnet mail.example.com 587
EHLO test.example.com
Encrypted handshake with STARTTLS on 587, or implicit TLS on 465, using OpenSSL:
# STARTTLS on 587 openssl s_client -starttls smtp -connect mail.example.com:587 -crlf # implicit TLS on 465 openssl s_client -connect mail.example.com:465 -crlf
A 220 greeting means the server is reachable and ready; the EHLO response lists the extensions it supports. Find the correct mail.example.com hostname by running the SMTP test above — it is the MX record for the domain.
telnet or openssl commands shown in the walkthrough above.v=spf1, a DMARC policy at _dmarc, and reverse DNS (PTR) that resolves for each mail-server IP. If SPF or DMARC is missing, receiving servers have less ability to verify your mail and it is more likely to be marked as spam or rejected. Missing reverse DNS on a sending server is a common reason legitimate mail is bounced. This tool flags each of these so you can see at a glance what is present and what is not.selector._domainkey.example.com, and the selector is chosen by whoever signs your mail (for example google, s1, k1, or dkim). Enter that selector in the optional DKIM selector field and the tool looks up the corresponding TXT record at selector._domainkey.yourdomain.com and shows the public key; the github.com + DKIM example fills in a working selector for you. If you do not know the selector, check a recent email's headers for the DKIM-Signature line — the s= value is the selector.