Mail Health Check

Checks whether your domain's emails are delivered, whether they can be spoofed and whether transport is encrypted — 15 checks in three groups.

DNS configuration

Check	What is checked
MX	Are there MX records? Multiple entries with priorities provide failover.
SPF	Is there a v=spf1 record, and how strict is it? -all (hardfail) is ok, ~all/?all only warn, +all is dangerous and thus fail.
DKIM	Vernax looks for DKIM records under 13 common selectors (default, google, selector1/2, k1, …). Custom selectors outside this list may not be found.
DMARC	Policy level and reporting: p=reject with rua= is ok; quarantine/none trigger warn. p=reject without rua= also warns — without a reporting address you run blind and don't see what gets rejected.
MTA-STS	DNS record and policy file at https://mta-sts.<domain>/.well-known/mta-sts.txt; mode enforce recommended.
TLS-RPT	Is there _smtp._tls.<domain> with v=TLSRPTv1; rua=? Reports when sending servers can't establish a secure connection to your MX — the counterpart to MTA-STS/DANE. A record without rua= is ineffective (warn), none at all is info.
BIMI	Optional logo record (info only, barely counts toward the score).
PTR	Do the MX IPs have reverse DNS entries? Missing PTR leads to rejection at some recipients.
DNSSEC	DNSKEY and DS records present? Only both together form a complete chain of trust.

Transport encryption

Vernax connects live to your primary MX server on port 25:

Check	What is checked
STARTTLS	Does the server offer encryption? Without STARTTLS mail travels in plaintext (fail).
TLS version	TLS 1.2/1.3 ok, TLS 1.0/1.1 warn, SSLv3 fail.
Certificate	Validity and expiry: < 30 days warn, < 14 days or expired fail.
DANE/TLSA	Not only checks whether TLSA records exist for the MX hosts, but validates the live-served certificate against the DNS entry (all selector/matching-type combinations). If the hash no longer matches — typically after a certificate rotation without a TLSA update — that's fail: DANE-validating mail servers then stop delivering. No TLSA record is info (DANE is optional). The details show DNS digest and computed certificate hash for comparison.

When port 25 is unreachable

Some networks block outbound connections on port 25. If Vernax can't reach your MX, these three checks are marked "info" and do not downgrade your domain.

Reputation

Check	What is checked
DNSBL	Are your MX servers' IPs on blacklists? Spamhaus ZEN, Barracuda, SpamCop and SORBS are checked.
DBL	Is the domain itself on the Spamhaus Domain Block List?

Tip: enter an email address

Instead of the domain you can also enter an email address (user@example.com) — the domain part is checked.