Why test a real mail instead of DNS records only?
The DNS tools show whether SPF, DKIM and DMARC are published correctly. Whether a particular mail actually passes them is decided when it is sent: which server delivers it, with which return path, does it sign with the right key, does a gateway modify the message after signing? That is exactly what the mail test shows, because it analyses the message that actually arrived.
Typical cases: the newsletter tool sends with its own return path, the shop’s contact form goes out via the web host without an SPF entry, the CRM signs with its own domain instead of yours. None of this shows in the DNS records, all of it shows in the mail test.
What the mail test checks
DomainWarn evaluates every check itself instead of just copying what the receiving server noted.
- SPF: may the sending IP send for the domain of the return path? With the mechanism that matched and the limit of ten DNS lookups.
- DKIM: every signature is verified cryptographically (RSA and Ed25519), with key length and whether the signing domain matches the sender.
- DMARC: policy of the sender domain and whether SPF or DKIM align with the visible sender.
- Reverse DNS and HELO: does the sending IP have a PTR record pointing back to it, and does the server introduce itself with a matching name?
- TLS: was the mail delivered encrypted, with which version?
- Blacklists: is the sending IP on Spamhaus, SpamCop, Barracuda or PSBL?
- Message: Message-ID, Date, a text part next to HTML and, for newsletters, one-click unsubscribe per RFC 8058.
How to read the score
Every mail starts at 100 points. Real problems cost points: a missing or invalid DKIM signature the most, then missing or failing SPF and DMARC, blacklists and missing reverse DNS. Minor issues such as a 1024-bit key or a DMARC policy of p=none cost a few points. From 90 points the mail is set up very well; below 50 many receivers put it in spam or reject it.
Gmail, Yahoo and Microsoft: what large mailbox providers require
Since 2024 Gmail and Yahoo require SPF or DKIM, valid reverse DNS and TLS from all senders; anyone sending more than 5,000 mails a day to them also needs DMARC, alignment and, for newsletters, one-click unsubscribe. Microsoft followed for Outlook.com in 2025. The mail test checks exactly these points and tells you which one is missing.
What happens to your mail
The test address is valid for one hour and accepts exactly one mail. After the analysis the mail is deleted; only the headers and the result are kept, never text or attachments, and they are deleted after 24 hours as well. So it is best to send a test message without confidential content.
Frequently asked questions
- How fast is the result?
- Usually within seconds: the page checks every five seconds, and the mail is analysed as soon as it arrives. If the sending server holds the mail back (greylisting, queue), it takes correspondingly longer. The address is valid for one hour.
- Can I test a newsletter service or a contact form?
- Yes, that is exactly what the test is for. Enter the test address as a recipient, for example in a test group of the newsletter service or in the contact form, and send a real message. You will see whether the service signs with your domain and is in your SPF.
- Why does SPF pass but DMARC fail?
- SPF checks the return path, DMARC the visible sender address. If a service sends with its own return path, SPF passes for its domain but does not match yours. The fix is DKIM with your domain or your own return path at the service.
- Is the mail test free?
- Yes, without signing up. As with the other tools, the limit is 20 requests per hour. In the DomainWarn dashboard the mail test is also available per domain, with 30 days of history.