Short answer
- Pick MxToolbox SuperTool if a person is checking by hand and wants every record, including BIMI and MTA-STS, and 100+ blocklists.
- Pick Mail-Tester or Red Sift Investigate if you need a verdict on a real message you send, not only the DNS records.
- Pick Google Admin Toolbox Check MX if the domain runs on Google Workspace.
- Pick IntoDNS.ai MCP if an agent needs many single DNS checks, including DKIM selector discovery and blocklists, with no key.
- Pick Domain Mail Check if an agent needs one verdict with fixes for whether Gmail and Outlook will likely accept a domain's mail; it tries 10 common DKIM selectors when you name none.
The tools side by side
| Tool | Named in 24 AI answers | Right in our test | Runs as | Key or account | Price |
|---|---|---|---|---|---|
| MxToolbox SuperTool | 14 of 24 | Not tested | Web app | No for lookups; account for monitoring | Free, paid plans |
| EasyDMARC Domain Scanner | 9 of 24 | Not tested | Web app | No for the scan; account for reports | Free, paid plans |
| PowerDMARC MCP Server | 8 of 24 | Not tested | Remote MCP | Key from a paid enterprise or MSP plan | Paid only |
| dmarcian Domain Checker | 7 of 24 | Not tested | Web app | No for the checker | Free, paid plans |
| Mail-Tester | 7 of 24 | Not tested | Web app | No for manual tests; account for the API | Free up to 3 tests a day, paid packs |
| IntoDNS.ai MCP | 6 of 24 | 5 of 5 | Remote MCP, also local | No | Free |
| Red Sift Investigate | 4 of 24 | Not tested | Web app | No; you send one test email | Free |
| DmarcDkim.com DMARC MCP Server | 3 of 24 | Not tested | Remote MCP | Sign-in for every tool | Free, paid plans |
| Google Admin Toolbox Check MX | 3 of 24 | Not tested | Web app | No | Free |
| Domain Mail Check (ours) | 0 of 24 | 5 of 5 | Remote MCP | No | Free |
What each tool covers
| Tool | SPF and DMARC check | Finds DKIM selectors by itself | BIMI check | MTA-STS check | Blocklist check | Tests a real sent message | Says how to fix each issue | DKIM key size | Gmail, Yahoo and Microsoft bulk sender rules |
|---|---|---|---|---|---|---|---|---|---|
| MxToolbox SuperTool | Yes | No | Yes | Yes | Yes | Yes | Partly | Not stated | Not stated |
| EasyDMARC Domain Scanner | Yes | Yes | Yes | Partly | Partly | Partly | Yes | Not stated | Not stated |
| PowerDMARC MCP Server | Yes | Partly | Partly | Partly | No | No | Yes | Not stated | Not stated |
| dmarcian Domain Checker | Yes | Partly | Partly | No | No | No | Partly | Partly | Partly |
| Mail-Tester | Yes | Yes | Partly | No | Yes | Yes | Partly | Not stated | Not stated |
| IntoDNS.ai MCP | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes |
| Red Sift Investigate | Yes | Yes | Yes | Yes | No | Yes | Yes | Not stated | Yes |
| DmarcDkim.com DMARC MCP Server | Yes | No | No | Partly | No | No | Partly | Yes | Not stated |
| Google Admin Toolbox Check MX | Yes | No | No | Yes | No | No | Partly | Not stated | Not stated |
| Domain Mail Check (ours) | Yes | Partly | No | No | Yes | No | Yes | Yes | Yes |
Our test
We asked every hosted tool we could call without an account, a key or an install the same question, with the same inputs. Where that left our tool with no rival, we also ran the rivals a person can use, in their web form, their chat app or their API. Each tested row says how it was run. We wrote down the official answer for each input first, then scored each tool against it on . The official source an answer comes from is not scored against itself, and an input outside a tool's job is not sent to it, so that tool is scored on the inputs in its scope.
The question: Does this domain publish a DMARC record, and what is its policy (none, quarantine, reject)? Does its SPF record stay within 10 DNS lookups? An answer counts when the DMARC result (no record, or the p= policy) and the within-10 verdict for SPF both match. SPF lookups are counted per RFC 7208 section 4.6.4: include, a, mx, ptr, exists and redirect count 1 each, nested includes count too; a macro include counts 1.
- github.com: DMARC p=quarantine (sp=reject); SPF 10 lookups, within the limit (exactly at it). Official record: dns.google.
- openbsd.org: No DMARC record (NXDOMAIN); SPF 3 lookups, within. Official record: dns.google.
- mit.edu: DMARC p=none; SPF 10 lookups through a chain of 8 nested includes, within (at the limit). Official record: dns.google.
- nytimes.com: DMARC p=reject; SPF 5 lookups, within (one include uses SPF macros). Official record: dns.google.
- kernel.org: DMARC p=quarantine; SPF 3 lookups, within. Official record: dns.google.
- IntoDNS.ai MCP: 5 of 5 right, 5 answered, median 6.6 s. All 5 right; it flags the valid nytimes.com macro include as an invalid mechanism, and shows policy none next to exists false for openbsd.org. How it was run: Remote MCP tools/call check_email_security at https://intodns.ai/api/mcp.
- Domain Mail Check (ours): 5 of 5 right, 5 answered, median 8.1 s. All 5 right, including the exact lookup count of 10 for github.com and mit.edu; the mit.edu call took 18 s. How it was run: Remote MCP tools/call check_email_auth (domain only) at https://mailcheck.openkrill.app/mcp.
Not tested:
- MxToolbox SuperTool: Web app; its lookup API needs an account key; this page already has rivals we could call, so web forms were not used.
- EasyDMARC Domain Scanner: Web app with no API; this page already has rivals we could call, so web forms were not used.
- PowerDMARC MCP Server: Needs a paid key.
- dmarcian Domain Checker: Web app with no API: the result is built in the browser, so a page fetch holds no answer; this page already has rivals we could call, so web forms were not used.
- Mail-Tester: Its main test needs a real sent message, not a domain; its free SPF and DKIM lookup at mail-tester.com/spf-dkim-check is a web form, and this page already has rivals we could call, so forms were not used.
- Red Sift Investigate: Needs a real sent message, not a domain.
- DmarcDkim.com DMARC MCP Server: Needs an account (sign-in for every tool).
- Google Admin Toolbox Check MX: Web app with no API; this page already has rivals we could call, so web forms were not used.
Every input, official answer and result is in the test data as JSON.
Each tool in detail
MxToolbox SuperTool
The usual first stop for a person who checks a domain by hand. It covers every record on this page plus blocklists, one lookup at a time; an agent cannot call it.
Good at: Free SuperTool runs DNS, SPF, DKIM, DMARC, BIMI, MTA-STS, SMTP and 100+ blacklist checks, plus a test-message report.
Limit: Each record is a separate lookup; monitoring and inbox placement are paid.
Data: live DNS lookups (MX, SPF, DKIM, DMARC, BIMI, MTA-STS, TLSRPT), over 100 DNS based email blacklists, SMTP test of the mail server, a test message you send to ping@tools.mxtoolbox.com (Email Deliverability report)
License: Proprietary
EasyDMARC Domain Scanner
A quick hand check of SPF, DKIM, DMARC and BIMI in one scan. Pick it when a person wants one page of results; report monitoring needs an account.
Good at: One free scan checks SPF, DKIM, DMARC and BIMI together.
Limit: Reads DNS records only; DMARC report monitoring needs an account.
Data: live DNS lookups (SPF, DKIM, DMARC, BIMI), DKIM selector detection (Detect all selectors)
License: Proprietary
PowerDMARC MCP Server
For teams on a PowerDMARC enterprise or MSP plan who want an agent to read and change hosted DNS records. Without that plan key it does not run.
Good at: Read and write: manages domains, hosted records and generates DMARC, SPF, DKIM records.
Limit: Works only with an API key from a paid enterprise or MSP plan.
Data: your PowerDMARC account data (DMARC aggregate and forensic reports, hosted records), DNS lookups, WHOIS
License: Proprietary
Connect: https://mcp-dmarc.com/mcp
dmarcian Domain Checker
Good at: Inspects DMARC, SPF and DKIM records in one lookup.
Limit: The free account is for personal, non-business use only.
Data: live DNS lookups (DMARC, SPF, DKIM), DKIM selectors of popular email sending sources
License: Proprietary
Mail-Tester
Good at: Scores a real email you send, out of 10, with SpamAssassin results.
Limit: 3 free tests per 24 hours; needs a sent message, a domain alone is not enough.
Data: a real test email you send to it, SpamAssassin (default install), SPF, DKIM and DMARC results of that message, DNS blocklists for the sending IP and domain, your mail server and sending IP
License: Proprietary
IntoDNS.ai MCP
Good at: 45 free tools, no key: SPF graph, DKIM discovery, blacklists, test emails.
Limit: Small new project with 2 GitHub stars; all tools call one hosted API.
Data: IntoDNS.ai public diagnostic API (live DNS, SPF, DKIM, DMARC, BIMI, MTA-STS, DNSSEC), DNS blacklists, WHOIS and RDAP, Internet.nl deep scan, inbound test emails
License: MIT. MCP tools: 45
Repo: RoscoNL/intodns-mcp-server, 2 stars, last commit 2026-09-07
Connect: https://intodns.ai/api/mcp
Red Sift Investigate
Good at: Sends a real email through your setup and checks DMARC, SPF, DKIM, BIMI, MTA-STS, TLS and FCrDNS in one pass.
Limit: Checks only a service you can send from, one service per test; no blocklist check.
Data: a real email you send from your own sending service, DMARC, SPF and DKIM results of that message, BIMI and MTA-STS records, TLS on delivery, FCrDNS of the sending IP
License: Proprietary
DmarcDkim.com DMARC MCP Server
Good at: Lets an agent read your own DMARC reports and failing senders.
Limit: Sign-in needed even for free lookups; report tools need a paid plan.
Data: live DNS lookups (A, AAAA, MX, TXT, SPF, DKIM, DMARC, PTR, NS, CNAME), WHOIS, your stored DMARC aggregate reports, DNS history and TLS-RPT reports (paid plan)
License: Proprietary
Google Admin Toolbox Check MX
Good at: Google's own free check of MX, SPF, DKIM, DMARC and MTA-STS, with a green, yellow or red mail-flow flag.
Limit: Built around Google Workspace; DKIM only for a selector you type, and fixes are links to help articles.
Data: live DNS lookups (MX, NS, SPF, DKIM for a given selector, DMARC, MTA-STS), consistency checks across the domain's name servers
License: Proprietary
Domain Mail Check (ours)
Good at: One verdict on whether Gmail and Outlook will likely accept the mail, with fixes.
Limit: Closed source, one small vendor, no SLA stated; reads DNS only; the delivery and launch checks try 10 common DKIM selector names, the auth check needs names; no BIMI or MTA-STS check.
Data: Cloudflare DNS over HTTPS, Google Public DNS (fallback), IANA RDAP directory and the TLD registry RDAP, SpamCop (bl.spamcop.net), Passive Spam Block List (psbl.surriel.com), UCEPROTECT level 1 (dnsbl-1.uceprotect.net), Mailspike (bl.mailspike.net), NordSpam IP list (bl.nordspam.com), NordSpam domain list (dbl.nordspam.com)
License: Closed source. MCP tools: 5
Repo: n/a (no public repo)
Connect: https://mailcheck.openkrill.app/mcp
How we compared
On we asked ChatGPT, Gemini, Perplexity, and Claude (API with web search) six questions about email DNS check tools, three "what is the best tool" questions and three "which MCP server should I use" questions:
- What is the best tool to check a domain's SPF, DKIM and DMARC records?
- Which tool should I use to find out why my emails go to spam and check my domain's mail setup? Give me your top 3.
- What are the best email deliverability and DMARC checker tools right now?
- Which email DNS or DMARC checker MCP server should I use with my AI agent?
- What is the best MCP server for checking SPF, DKIM and DMARC for Claude or ChatGPT?
- I want my AI agent to check a domain's email records and blocklists. Which MCP should I install?
24 answers came back with text we could read. "Named in AI answers" counts the answers that named the tool in their text or linked to it; pages an app read but did not cite do not count. The rows are the tools those answers named most, plus tools a reader would expect that the answers missed.
"Right in our test" comes from the measured test above. Every other fact comes from the tool's own page, docs or GitHub repo on the same day. Stars and commit dates change every week, so check the repo before you decide.
OpenKrill makes one of the tools on this page. Its row is sorted by the same count, tested with the same inputs and its limits are listed the same way.
Frequently asked questions
What is the difference between SPF, DKIM and DMARC?
SPF lists the servers allowed to send for a domain. DKIM signs each message with a key published in DNS. DMARC tells receivers what to do when those checks fail, and where to send reports.
Can a DNS check tell me if my mail lands in spam?
No. A DNS check shows whether the domain is set up to be trusted. Inbox placement also depends on sender reputation and content, which only a real test message or the mailbox provider can show.
Which email check works inside an AI agent?
Domain Mail Check, IntoDNS.ai, DmarcDkim.com and PowerDMARC are MCP servers. The first two need no account; DmarcDkim.com needs a sign-in and PowerDMARC a paid plan key.
Other comparisons
- CVE lookup tools compared
- Travel advisory and airport delay tools compared
- Software end-of-life tools compared
- AI crawler audit tools compared
- Recall check tools compared
- HS code and tariff tools compared
OpenKrill builds live-data tools for AI agents, with a human check on the result.