How it works

How Message Check works

You get a unique address.When you open the page, a random UUID is generated and combined with our testing subdomain (e.g. [email protected]).
You send an email to it.Use any email client or mail server you want to test: Outlook, Gmail, your own server, and more.
Cloudflare receives it.Our MX records point to Cloudflare's email infrastructure, which stamps the message withAuthentication-Results headers containing SPF, DKIM, and DMARC verdicts.
Our worker processes it.A Cloudflare Worker parses the headers, looks up DNS records, performs a reverse DNS (PTR) lookup on the sender's IP, fetches GeoIP data, detects security gateways, parses the ARC chain, and looks up WHOIS/RDAP registration data for the sender's domain.
Results appear on screen.The worker stores results in Cloudflare KV (deleted after 24 hours). Your browser polls for the result every 3 seconds and displays it automatically.

What each check means

SPF (Sender Policy Framework): Checks whether the IP address that sent the email is listed as an authorized sender for the envelope-from domain. A domain publishes a DNS TXT record listing its permitted sending IPs. If the sending IP isn't in that list, SPF fails. When a security gateway relays the email, the ARC chain is shown inside the SPF card to give full context.
DKIM (DomainKeys Identified Mail): Verifies a cryptographic signature added to the email by the sending server. The public key is published in DNS at selector._domainkey.domain. If the signature doesn't match, the message may have been altered in transit or the key has changed.
DMARC (Domain-based Message Authentication Reporting and Conformance): Combines SPF and DKIM results and checks that at least one of them alignswith the visible From address. The domain owner publishes a policy (p=none,p=quarantine, or p=reject) that tells receivers how to handle failures.
ARC (Authenticated Received Chain): A chain of cryptographic stamps added by each mail server that forwards or relays the message. When a security gateway rewrites the envelope (breaking SPF), ARC lets the final receiver verify the authentication state before the relay. Each hop's stamp is shown with its chain validation status (cv=none, cv=pass, or cv=fail).
PTR: Pointer record (reverse DNS): A PTR record maps an IP address back to a hostname. Legitimate mail servers almost always have a PTR record that matches their forward hostname. Missing or mismatched PTR records increase the likelihood of messages being flagged as spam.
Security gateway detection: Identifies known email security gateways (Proofpoint, Mimecast, Barracuda, Cisco IronPort,Microsoft Defender for Office 365, Trend Micro, Forcepoint, and others) from message headers and PTR records. When a gateway is detected, authentication results are explained in that context so SPF failures caused by relay rewriting are not misread as misconfiguration.
MTA-STS (Mail Transfer Agent Strict Transport Security): A policy published in DNS and at a well-known HTTPS URL that instructs sending mail servers to always use TLS when delivering to your domain, and to reject connections if a valid certificate cannot be obtained. Prevents downgrade attacks on SMTP transport.
DANE (DNS-based Authentication of Named Entities): Uses TLSA records published in DNSSEC-signed zones to pin the TLS certificate that your MX hosts present. Sending servers that support DANE will refuse delivery if the certificate doesn't match the pinned value, providing stronger transport security than MTA-STS alone.
DNSSEC (DNS Security Extensions): Cryptographically signs DNS records so that resolvers can verify they haven't been tampered with in transit. Checks for the presence of DNSKEY and DS records and whether the chain of trust is validated by Cloudflare's resolver.
BIMI (Brand Indicators for Message Identification): A standard that lets domain owners publish a verified logo in DNS. Supporting mail clients (Gmail, Apple Mail, Yahoo) display the logo next to authenticated emails. Requires DMARC p=quarantine or p=reject, a valid SVG logo, and optionally a Verified Mark Certificate.
WHOIS / RDAP: Registration data for the sender's domain fetched via RDAP (the modern, structured replacement for WHOIS). Shows registrar, registration date, expiration date, and domain status codes. Expiry warnings are highlighted when a domain is within 90 days of renewal.
Routing hops: The path the email took from sender to inbox, reconstructed from Receivedheaders. Each hop shows the sending and receiving server names, IP addresses, protocol, TLS usage, and timestamp. Useful for diagnosing delays or unexpected relays.
Header analysis: Every header in the received email is shown with a plain-English explanation, including vendor-specific headers from Microsoft 365, Exchange, Google Workspace, Barracuda, IronPort,Proofpoint, and others. Headers are grouped by category and sorted by relevance.

Domain Check

Enter any domain to look up its email DNS configuration without sending an email. The Domain Check queries MX, SPF, DKIM (common selectors), DMARC, MTA-STS, DANE, DNSSEC, BIMI, and WHOIS in parallel and presents each record with validation, plain-English breakdown, and policy analysis. It also detects your DNS provider and links directly to their management dashboard.

Privacy

Email contents are never stored. Only authentication headers and metadata are kept.
Results are stored in Cloudflare KV with a 24-hour TTL and then permanently deleted.
No account is required and no personal information is collected.
Each test address is single-use and randomly generated.