Inspect every MX record like a forensic lab.
mxinspect.org decodes your entire email delivery chain in 8 seconds: MX priority, SPF flattening, DKIM rotation, DMARC alignment, blacklist exposure and SMTP handshake — with a 0-100 deliverability score you can actually fix.
Drop a domain. Get the truth.
Instant MX + SPF + DKIM + DMARC + blacklist verdict. Free, no account.
Trusted for pre-migration audits, cold-email warmup and post-breach forensics.
Everything that decides inbox vs spam
One scan replaces 7 separate tools. We follow the exact path Gmail, Outlook and Yahoo take to judge you.
MX Priority & Failover Map
Visualizes all MX hosts, priorities, latency per PoP, dead secondaries and single-point-of-failure risks. Detects lame delegations and dangling CNAMEs.
SPF Flattener & Lookup Counter
Parses nested includes, counts 10-DNS-lookup limit, warns on permerror, suggests flattened record that keeps marketing tools working.
DKIM Selector Discovery
Brute-forces common selectors, validates key length, rotation age and weak 512/1024-bit keys. Confirms alignment for strict mode.
DMARC & Aggregate Analyzer
Reads p, rua, ruf, adkim, aspf. Simulates enforcement impact and turns raw XML reports into human actions: who sends as you.
127 Blacklists + Spamhaus Radar
Checks Spamhaus, Barracuda, Sorbs, UCEPROTECT, SpamCop and 122 more. Shows listing history, delist links and neighbourhood spam score.
SMTP TLS & Banner Audit
Opens real SMTP handshake: STARTTLS, cert expiry, MTA-STS, TLS-RPT, open-relay test and banner leakage that invites attackers.
Built by postmasters, for everyone who sends email.
MXInspect.org started in 2019 as a weekend script to debug why invoices landed in spam. Today it processes 180k inspections a day for SaaS founders, agencies, IT admins and security teams. We are obsessed with one thing: making opaque DNS records readable in plain English.
Unlike generic DNS tools, we specialize only in mail flow. No bloated dashboards. No jargon dumps. Every warning ships with exact TXT to paste, priority order, and risk if ignored. From startup to enterprise migration — we show misconfigured secondaries, shadow IT senders, expired DKIM, and DMARC set to p=none for years.
domains inspected
global test PoPs
blacklists tracked
scanner uptime
How the inspection works
Same logic as a receiving MTA, but explained like a friend.
Authoritative MX fetch
We ignore cached Google DNS and ask your authoritative nameservers directly from 3 continents to catch geo-split and propagation drift.
SPF / DKIM / DMARC chain
We simulate alignment for every sender: newsletter tool, CRM, transactional API. One misaligned source = fix snippet generated.
Live SMTP dialogue
Real EHLO, STARTTLS, cert chain and response codes. We catch greylisting traps, 550 bounces and servers that accept then silently drop.
Inbox score + playbook
Weighted 0-100 score with prioritized tasks: critical, warning, polish. Export PDF for clients or push to API for monitoring.
Latest lab reports
Blacklist waves, Gmail bulk rules, DNS post-mortems. Click any card to open full analysis.
No reports yet
Our lab is warming up scanners. Check back soon for fresh intel.
Questions postmasters ask
What exactly does MXInspect check?
MX hosts and priorities, A/AAAA glue, reverse PTR, SPF syntax and lookup count, DKIM selectors and key strength, DMARC policy and rua reporting, BIMI, MTA-STS, TLS-RPT, SMTP banner, open relay, plus 127 DNS blacklists. You get one score and one fix-list.
Why do my emails go to spam even with correct MX?
90% of the time it's authentication, not MX: SPF exceeds 10 lookups, DKIM selector rotated by your provider but DNS still old, or DMARC at p=none letting spoofers burn your reputation. Our chain view pinpoints which sender breaks alignment.
How do I fix “too many SPF lookups”?
Flatten includes: replace nested include:_spf.google.com include:mailgun.org include:sendgrid.net… with verified IPs and a dedicated subdomain for marketing. We auto-generate a flattened record under the limit.
Is the free scan really free?
Yes. Single-domain instant scan needs no account and never expires. Monitoring, history, Slack alerts and API need a plan because we poll your DNS every 5 minutes from 42 nodes.
Do you store my DNS data?
Public DNS is public by design — we cache results for 1 hour for speed. We never sell scan history and we don't require email to run a check.
Need bulk audits or API?
Agencies audit 500 domains before migration. SaaS verify customer DNS before onboarding. We help with both — response within 24h.
- ● Monitoring: 5-min checks + Slack / webhook alerts
- ● API: JSON for MX/SPF/DKIM/DMARC/blacklists
- ● White-label PDF: your logo, your domain