Email Health Check: the question this tool answers
Email Health Check answers one focused troubleshooting question: email health check. The live result is designed to tell you whether MX is usable, whether mail provider agrees with it, and whether SPF exposes a second path that can explain the symptom. A healthy result here is not an all-purpose website score; it only describes the business-email DNS and mail authentication evidence this tool owns.
- MX
- mail provider
- SPF
- DMARC
- DKIM when selector is known
- BIMI
- MTA-STS
- TLS-RPT
- mail host resolution
How to read the MX, mail provider and SPF evidence
Start with the value that directly controls the failing service, then use the other signals to confirm or challenge that interpretation. A single record or response can look correct while another hostname, IP family, redirect or mail-authentication path still fails. The tool therefore keeps the raw observed value visible and explains how the signals relate.
- MX — Read the public MX priorities and targets, then verify that each target itself resolves. A visible MX record is not enough if its mail hostname is broken.
- Mail provider — Verify mail provider from the public Internet and compare it with the value the responsible provider says should be live.
- SPF — Inspect the single public v=spf1 policy, validate its terms and count DNS-query-causing mechanisms; duplicate policies or excessive lookups can invalidate SPF.
- DMARC — Query _dmarc, validate the policy tags and distinguish publication from message-level alignment; a published record does not by itself prove every message passes DMARC.
- DKIM when selector is known — Use the selector configured by the sender or found in a DKIM-Signature header. Selector guessing is only a convenience and an empty guessed result is not proof that DKIM is absent.
- BIMI — Verify BIMI from the public Internet and compare it with the value the responsible provider says should be live.
- MTA-STS — Verify MTA-STS from the public Internet and compare it with the value the responsible provider says should be live.
- TLS-RPT — Test the hostname actually requested, its certificate dates and SAN coverage, and the TLS handshake. Root and www can serve different certificates.
- Mail host resolution — Verify mail host resolution from the public Internet and compare it with the value the responsible provider says should be live.
Common email health check failure patterns
The most useful warnings are mismatches rather than isolated missing fields. MX can be absent or stale; mail provider can point somewhere different from the expected provider; and SPF can reveal a second path that behaves differently. If public sources disagree, first decide whether the difference comes from authoritative data, caching, a separate hostname, IPv6, or another protocol layer before editing configuration.
What to change — and what not to change
Change the smallest setting that the evidence proves is wrong. Compare the observed MX with the current value supplied by the responsible provider, save the existing value, make one correction, and retest. Do not replace nameservers, delete unrelated MX/TXT records, disable TLS controls or remove IPv6 simply because Email Health Check shows a warning in another layer. Broad changes can turn one isolated problem into several independent outages.
How HostWithShery runs Email Health Check
The submitted public input is normalized and validated before any server-side request is made. HostWithShery then obtains MX and mail provider using the appropriate public DNS, HTTP, TLS or mail protocol and adds SPF plus DMARC where it materially changes the interpretation. URL-based checks are restricted to public destinations, and redirect targets are revalidated instead of being trusted automatically.
Example email health check interpretation
Example only: suppose MX returns an expected value, but mail provider points to an older destination while SPF shows a different result for another hostname or network path. The correct conclusion is not “everything is broken.” It is that one public path still disagrees with the intended business-email DNS and mail authentication configuration. The live result uses the domain you enter; this example is never presented as evidence about your site.
When a email health check result is inconclusive
This is a public-configuration diagnostic. Network filtering, private control-panel settings, split-horizon DNS, provider-internal state and transient routing conditions can limit what can be confirmed from outside the account. Public diagnostics cannot see private control-panel state, unpublished origin addresses, provider account status or split-horizon/internal DNS. If the remote service times out, blocks automated requests or hides a signal, the result stays inconclusive instead of inventing a provider or configuration. That distinction matters when the next step is a potentially disruptive DNS, SSL or mail change.
How to verify the repair
The public MX/authentication records should match the intended mail provider, required hostnames should resolve, and the relevant SPF/DKIM/DMARC check should no longer show the original failure. Repeat Email Health Check after the change and compare the same MX, mail provider and SPF evidence that exposed the problem. A provider dashboard saying “saved” is not enough when the public Internet still returns the old value.
What to check next if Email Health Check is healthy
If MX, mail provider and SPF now agree but the user-facing problem remains, move to the adjacent layer instead of editing the same setting repeatedly. Use the related diagnostics on this page to test the next plausible cause, and keep the previous result as evidence when escalating to a hosting, DNS or email provider.
Technical references
These primary standards and provider documents are used to verify the behavior described on this page. Provider dashboards can change, so use the current official value for tenant-specific DNS records rather than copying an example from another account.