Email deliverability,
diagnosed properly.
SPF, DKIM, DMARC, MX, 15 blacklists, BIMI, MTA-STS, TLS-RPT, DNSSEC and DANE — all analyzed in parallel with an overall grade and the exact DNS records to fix the issues.
How we compare
Everything that matters for modern email authentication — in one place, at one price.
| Feature | CheckFast | MXToolbox | SSL Labs | Dmarcian |
|---|---|---|---|---|
| SPF record validation | ||||
| SPF void lookup detection | ||||
| DKIM selector enumeration (30+ selectors) | 3-5 selectors | 10 selectors | ||
| DKIM key revocation detection | ||||
| DMARC policy + alignment analysis | ||||
| MX records + reverse DNS (PTR) | MX only | |||
| Blacklist check (15 DNSBLs) | ||||
| BIMI + VMC validation | basic | |||
| MTA-STS DNS + policy file | DNS only | |||
| TLS-RPT | ||||
| DNSSEC validation | ||||
| DANE/TLSA | ||||
| Email provider auto-detection | ||||
| Shareable permanent reports | paid | paid | ||
| Free public API | paid | paid | ||
| Monitoring & alerts | $9/mo | $99/mo | $19/mo |
Every check explained
No shallow "does it exist" checks — we validate, count, and explain every record.
SPF deep-dive
Validates record syntax, counts DNS lookups against the 10-lookup limit, flags void includes, detects deprecated ptr mechanism, and explains your 'all' qualifier.
DKIM across 30+ providers
Probes selectors for Google, Microsoft 365, SendGrid, Mailgun, SES, Zoho, Postmark, Mailchimp, Fastmail, and more — including revocation detection.
DMARC policy analyzer
Shows policy, subdomain policy, percentage, adkim/aspf alignment, and reporting URIs. Flags weak p=none setups.
MX + PTR reverse DNS
Resolves every MX host to IPs, checks reverse DNS matches, and warns on single-MX failover gaps.
15 DNSBLs in parallel
Queries Spamhaus, Barracuda, SpamCop, SORBS, UCEPROTECT, Mailspike and others — with the delisting reason when available.
BIMI + VMC
Checks for your Brand Indicator record, SVG logo URL, and the Verified Mark Certificate Gmail now requires.
MTA-STS enforcement
Validates the DNS record, fetches the policy file over HTTPS, checks mode (enforce/testing/none) and max_age.
TLS-RPT reporting
Confirms you're receiving daily SMTP TLS failure reports — essential when MTA-STS is active.
DNSSEC via DoH
Queries DS records through Cloudflare DoH to confirm your zone is signed and using modern algorithms.
DANE / TLSA
Looks for TLSA records on every MX host — the strongest TLS authentication available for SMTP.
Provider auto-detection
Identifies Google Workspace, Microsoft 365, Zoho, Yandex, ProtonMail, SES, Mailgun, and others — giving provider-specific fix guidance.
Shareable reports
Every result gets a permanent URL like /email-checker/report/example.com with dynamic Open Graph image.
Plug the check into your CI.
Fail your deploy pipeline if DMARC policy gets weakened, your SPF crosses 10 lookups, or you show up on a blacklist. Ready for CI at $29/mo.
$ curl -sS -X POST https://checkfast.io/api/v1/email-checker/check \
-H "Content-Type: application/json" \
-d '{"domain":"example.com"}' | jq .score
87
$ curl -sS -X POST https://checkfast.io/api/v1/email-checker/check \
-H "Content-Type: application/json" \
-d '{"domain":"example.com"}' | jq .summary.topFixes[0]
{
"severity": "warning",
"message": "DMARC policy is \"none\" — monitoring only.",
"fix": "Upgrade to p=quarantine, then p=reject after reviewing reports"
}Frequently asked questions
SPF record (validity DNS lookup limit void lookups 'all' qualifier deprecated ptr) DKIM across 30+ common selectors including Google Microsoft 365 SendGrid Mailgun SES Zoho Postmark and more DMARC with policy/pct/alignment MX records with reverse DNS (PTR) checks 15+ DNSBLs including Spamhaus Barracuda SpamCop BIMI (logo + VMC) MTA-STS DNS + policy file validation TLS-RPT DNSSEC via DoH and DANE/TLSA on every MX host.
MXToolbox runs checks individually and charges for the useful features. CheckFast runs all 10 checks in parallel gives you an overall grade (A+ to F) with explainable per-category scores shows the exact DNS record you need to copy-paste and publishes a shareable permanent report at a clean URL. Modern checks (BIMI MTA-STS TLS-RPT DNSSEC DANE) are included — MXToolbox often omits them.
A or A+ (90+) means SPF DKIM DMARC are all correctly configured you have MTA-STS enforced DNSSEC signed and aren't on any blacklists. B (80-89) is a solid baseline but you're likely missing BIMI or MTA-STS. C or below means immediate action needed — the top fixes in the report tell you exactly what to change.
SPF DKIM DMARC and MX are non-negotiable baseline checks — without them your mail won't be delivered reliably. BIMI MTA-STS TLS-RPT DNSSEC and DANE are 2024-era best practices. Blacklist listing is a response not a configuration — if you're listed fix the cause first (compromised server spam).
Yes. Starter ($9/mo) includes scheduled monitoring with Telegram email and in-app alerts. Slack and webhooks require Pro or Agency. Alert timing depends on monitor cadence thresholds scheduler processing and the external provider.
Yes. CheckFast auto-detects your provider from your MX and SPF records and adjusts the DKIM selector probing accordingly. Google Workspace Microsoft 365 Zoho Yandex ProtonMail Fastmail SendGrid Mailgun Amazon SES Mailchimp and Postmark are all recognized with specific guidance.
Yes. POST Endpoint with domain: example.com returns the full JSON report. The route applies the current hourly and daily request budgets for anonymous free and paid callers; no monthly or priority-processing contract is offered.
Spamhaus Zen Barracuda SpamCop SORBS (main + spam + dul) CBL abuseat UCEPROTECT L1+L2 PSBL Mailspike Manitu SpamCannibal SURBL and Spamhaus DBL — 15 lists total.
Recommended reading
DMARC From Zero to Reject: A Step-by-Step Rollout
How to roll DMARC out without breaking legitimate mail flow. SPF and DKIM prereqs, p=none through quarantine to reject, and how to read aggregate reports.
Read articleDNS Deep Dive: How SPF, DMARC, MX, and DNSSEC Fit Together
An end-to-end view of mail-flow DNS — how MX, SPF, DKIM, DMARC, and DNSSEC interact, common misconfigs, and the dig commands to verify every layer.
Read articleMore in Domain Health
Foundational integrity of your domain — TLS, DNS, ownership, and email authentication.