MXToolbox: Email and DNS Diagnostics

Every email your server sends faces a trial: Is this really who they claim to be? Can I trust them? MXToolbox shows you exactly how you're being judged.

At mxtoolbox.com, you can run the same checks that receiving mail servers perform—MX record validation, authentication verification, blacklist queries, and SMTP diagnostics. The free tier handles most troubleshooting. You enter a domain or IP, select your tests, and see what the Internet sees.

MX Records: Who Receives Your Mail

MX (Mail Exchanger) records tell senders which servers accept email for your domain. The lookup shows:

• Server hostnames and their IP addresses
• Priority values (lower = preferred)
• Response times and reachability
• Configuration warnings

Multiple MX records provide redundancy. If priority 10 fails, senders try priority 20. Common problems: MX records pointing to CNAMEs (not allowed), pointing to non-existent hosts, or reverse DNS mismatches.

SMTP Diagnostics: Can Anyone Reach You?

The SMTP test connects to your mail server like a sender would:

• TCP connection to port 25
• SMTP banner exchange
• TLS/SSL support verification
• Reverse DNS validation
• Open relay testing

Reverse DNS matters more than people realize. Many mail servers reject messages from IPs without proper PTR records. Your IP should resolve to a hostname that resolves back to the same IP—forward-confirmed reverse DNS.

Open relay testing ensures your server won't forward mail for strangers. An open relay is an abuse magnet and gets blacklisted fast.

Blacklists: Your Server's Reputation

MXToolbox queries 100+ blacklists simultaneously. Being listed means many mail servers will reject your messages without even looking at the content.

Your IP can land on blacklists for:

• Hitting spam traps
• Sending too much mail too fast
• Showing signs of compromise
• User complaints
• Policy violations (residential IPs, dynamic addresses)

Some lists devastate deliverability. Others affect few recipients. The tool shows impact levels and provides delisting links. The strange reality: you can end up on lists you've never heard of, affecting delivery to recipients you've never contacted.

SPF: Who's Allowed to Send As You?

Sender Policy Framework records declare which servers can send email for your domain. MXToolbox validates:

• Syntax correctness
• Lookup count (must stay under 10 DNS lookups—exceeding this invalidates the entire record)
• Include mechanisms
• IP coverage

You can test whether specific IPs are authorized by your SPF record. This catches the common mistake of adding a new mail server but forgetting to update SPF.

DKIM: Proving the Message Is Untampered

DomainKeys Identified Mail cryptographically signs outgoing email. The signature proves the message hasn't been modified in transit.

MXToolbox checks DKIM records at selector._domainkey.yourdomain.com. You need to know your selector (strings like "google", "default", "k1"). The tool validates record presence, syntax, and public key format.

For debugging, paste email headers into the analyzer. It shows whether DKIM signatures validated from the recipient's perspective.

DMARC: The Policy Layer

Domain-based Message Authentication, Reporting, and Conformance ties SPF and DKIM together with a policy. Your DMARC record at _dmarc.yourdomain.com specifies:

• What happens when authentication fails (none, quarantine, reject)
• What percentage of messages the policy applies to
• Where to send authentication reports

A "reject" policy with 100% coverage means failed authentication = deleted email. Powerful protection, but configure carefully or you'll block your own legitimate mail.

Email Header Analysis

Paste complete headers to trace an email's journey:

• The route through each mail server
• SPF, DKIM, and DMARC results at each hop
• Delivery times between servers
• Spam score indicators

This reveals where delays happen and why spam filters triggered. Authentication results show exactly what failed and where.

Deliverability Testing

Send a test message to MXToolbox's address. They check:

• Authentication results (SPF, DKIM, DMARC)
• Spam scores from multiple filters
• Content analysis for spam triggers
• HTML rendering

This shows how your email appears to recipients before real messages go out.

DNS Lookups

Beyond email records, MXToolbox handles all standard DNS queries: A, AAAA, CNAME, TXT, NS, SOA. Useful for verifying propagation and debugging resolution issues.

Troubleshooting Workflows

Email not delivered:

1. MX records exist and point to reachable servers?
2. SMTP connectivity works?
3. IP blacklisted?
4. SPF, DKIM, DMARC passing?
5. What do test message headers show?

Marked as spam:

1. SPF passing?
2. DKIM signature validating?
3. DMARC aligned?
4. Any blacklist appearances?
5. What's the deliverability test spam score?

Reading the Results

Green checkmarks pass. Yellow warnings deserve investigation but aren't critical (like missing IPv6 records for mail servers—doesn't affect IPv4 delivery). Red errors need fixing.

Prioritize by impact:

1. Blacklist listings (immediate delivery failure)
2. SPF/DKIM/DMARC failures (major deliverability problems)
3. Reverse DNS issues (moderate impact)
4. Configuration warnings (potential future problems)

What MXToolbox Can't See

The tool shows external perspective—how the Internet views your configuration. It can't check internal mail routing, firewall rules, content filtering policies, mailbox quotas, or application-level problems. Combine it with your mail server logs for the complete picture.