What this checks
- MX: which servers receive mail for the domain, their IP addresses and reverse DNS.
- SPF: the TXT record listing which servers may send as your domain. Every include is followed to count DNS lookups: more than 10 and SPF fails everywhere, a common problem once you add a newsletter tool, a helpdesk and a CRM.
- DKIM: the public key receivers use to check your signatures. Keys live under a selector only your provider knows; without one, the 30 selectors common providers use are tried.
- DMARC: what receivers should do with mail that fails SPF and DKIM, and where to send reports. Gmail and Yahoo require it from bulk senders.
- Mail server test: connects to your primary mail server on port 25, checks it greets properly, offers STARTTLS, and that its certificate is valid for its name. The conversation ends with QUIT before any message is sent.
- MTA-STS, TLS-RPT and BIMI: optional records for enforced encryption, TLS failure reports and brand logos.
Finding your DKIM selector
Open an email you sent in Gmail, choose Show original, and find the DKIM-Signature header. The value after s= is the selector and the value after d= is the domain it is published under. Google Workspace uses google, Microsoft 365 selector1 and selector2, and many services use s1 and s2 or a name of their own.
Sending mail from a VPS
If your Laravel or WordPress site sends mail straight from its server, the server's IP needs reverse DNS that matches its host name (set it at your hosting provider), the IP must be in your SPF record, and it must not be on a blacklist. Many providers block outgoing port 25 on new accounts; a transactional mail service (Postmark, Amazon SES, Mailgun and others) avoids all three problems.
Privacy
The domain is looked up through the DNS resolvers on Cloudhim’s server. Nothing is stored. Results are kept for two minutes, so run the check again after that to see a change.