MX lookup and email DNS checker
Look up a domain’s public MX, SPF, DMARC, MTA-STS, TLS reporting and DNSSEC records, plus its addresses, aliases (CNAME), nameservers and CAA policy. Add up to three DKIM selectors, a custom TXT name or an SRV pair for targeted lookups.
SRV lookup optional · enter both labels, e.g. _ldap and _tcp
When you click a lookup button, Cloudflare’s resolver receives your IP address and the domain, record names, SRV labels or IP address you query. DNS records are public; Cloudek does not receive the lookup.
Optional reverse DNS (PTR) lookup
Check the public PTR record for an IP address. This sends the IP address’s reverse name to Cloudflare only when you click the button.
Informational lookup only. Optional CAA parent lookup checks up to 8 ancestor names, stopping at the first returned CAA RRset; aliases, DNS delegation and longer name trees can make the result incomplete, so it does not determine effective CA behavior. The issuewild tag has a separate wildcard-name scope, while issuemail concerns email-protection certificates. See RFC 8659 and RFC 9495. MTA-STS policy files are not fetched. DNSSEC records and the resolver signal are informational, not a full chain validation. A Null MX record signals that a domain does not accept email; mixed Null MX answers are flagged against RFC 7505. If no MX is returned, SMTP may fall back to the domain’s A/AAAA records (RFC 5321); the checker cannot verify mail acceptance. The checker does not send test email, validate SPF’s full include chain, inspect a live certificate, or verify a DKIM signature. SRV query owner names follow RFC 2782. MTA-STS specification (RFC 8461); TLS reporting specification (RFC 8460).
Want every check in one go? Try the Email Health Check for MX, SPF, DMARC, DKIM, MTA-STS and DMARC report upload.