A single check runs the full email authentication and DNS review that determines whether a domain can send trustworthy mail and receive it reliably. Every result links to the RFC it is based on, so a fix is always traceable to a standard.

MX records: which servers accept mail, whether they resolve, and whether a null-MX is set correctly.
SPF: the sending policy, its syntax, the all-qualifier, and the 10-lookup limit.
DKIM: signing keys at common and custom selectors.
DMARC: the alignment policy and whether it is set to none, quarantine, or reject.
DNS health, DNSSEC, and provider: delegation, signing, and the detected mail provider.
Blacklists: Spamhaus and SpamCop listing status for the domain and its mail server IPs.
Live SMTP: a real connection to the mail servers to confirm they answer and support STARTTLS.

For bulk senders

Sending newsletters, transactional mail, or campaigns at volume? Mailbox providers weigh authentication and reputation heavily. scan.mx gives a fast pre-send check: confirm SPF, DKIM, and DMARC align, that the sending domain is not blacklisted, and that a DMARC policy is enforced before a large send. Run it in a pipeline through the JSON API or an AI agent over MCP.

Sponsor

Land in the inbox, not the spam folder

Search Brothers helps brands fix deliverability at the root: authentication, domain reputation, and technical SEO.

Talk to Search Brothers

Frequently asked questions

Is scan.mx free?

Yes. Every check, the API, and the MCP server are free with no account, signup, or API key. Usage is rate-limited for abuse prevention.

What is a good email deliverability setup?

At minimum: valid MX records, an SPF record ending in -all or ~all, DKIM signing on outbound mail, and a DMARC policy of quarantine or reject with alignment. scan.mx checks each of these and explains what is missing.

Does scan.mx send email or store my data?

No email is sent on your behalf. Reports (the DNS results and grade) are cached for one hour as public permalinks. Request metadata is logged for abuse prevention. Domain owners can opt a domain out of scanning and indexing.

How is the grade calculated?

Each section is scored by the severity of its failing checks, then combined into a 0 to 100 score and an A to F grade. Critical gaps cap the grade: no MX caps at F, a soft SPF all-qualifier caps at D, and no DMARC caps at C.