Email diagnostics

Why is your business email not sending or landing in spam?

Test your SMTP connection step by step, send a real test email, audit your domain's SPF/DKIM/DMARC setup, and check whether your server IP is blacklisted. No signup, completely free.

  • Free, no sign-up
  • Credentials are never stored
  • Results in seconds

SMTP Connection Test

Enter your mail relay, sending server or your own SMTP credentials. Connection and authentication are tested step by step.

Encryption

Your credentials are used only for this test request and are not stored.

See exactly where your connection breaks

We talk to your server the way a mail client does and report every step: what the server answered, how long it took, which TLS version and certificate it presented, and what to fix.

ConnectionTCP connection and the server greeting.
EHLOThe capabilities the server advertises.
TLSProtocol, cipher and certificate health.
AUTHWhether your username and password are accepted.

Send a Real Test Email

A real test email is sent through the SMTP server you provide.

Encryption

Left empty, the username is used as the sender address.

Your credentials are used only for this test request and are not stored.

Prove that your mail really arrives

We hand a real message to your SMTP server and tell you what it answered. Then we show you how to read the headers of the received message to confirm SPF, DKIM and DMARC.

Mail Security Analysis

Type your domain; we inspect your MX, SPF, DKIM and DMARC records and score how well you are protected against spoofed email.

DKIM selectors cannot be discovered through DNS. We try the common ones for you; if you know your own selector, enter it here for a definitive result.

Is your domain protected against spoofing?

The analysis takes a few seconds. For every record we show its status, the danger it creates when missing, and the most secure configuration as copy-ready DNS records.

MXVerifies which servers receive your email.
SPFChecks who is allowed to send email on behalf of your domain.
DKIMChecks the digital signature of your messages and the key strength.
DMARCReviews the policy that decides what happens to spoofed email.

DMARC Policies: none, quarantine and reject

When someone sends a fake email impersonating your domain, what happens under each policy?

Your domain is here right now
p=none Dangerous

p=none (monitor only)

Spoofed email: Lands in the inbox
What does the receiving server do?

The receiving server takes no action against mail that fails the checks; it delivers the message as usual and only sends you a report.

Remaining risk

Zero protection. A forged invoice that appears to come from "accounting@yourdomain.com" lands in your customer's inbox like any genuine message.

When to use it?

Only at the start, for 2-4 weeks: to collect reports, identify every genuine source that sends mail for your domain, and fix what is missing.

Your domain is here right now
p=quarantine Weak

p=quarantine (send to spam)

Spoofed email: Goes to the spam folder
What does the receiving server do?

Mail that fails the checks is accepted but placed in the spam (junk) folder instead of the inbox.

Remaining risk

The same forged invoice no longer shows in the inbox, but it is still in the mailbox: a user who looks in the spam folder can open it, or even mark it as "not spam".

When to use it?

As the intermediate stage, after you have fixed your genuine sources. If you overlooked a source, its mail is not lost; it can be recovered from the spam folder.

Your domain is here right now
p=reject Secure

p=reject (refuse)

Spoofed email: Rejected, never reaches the recipient
What does the receiving server do?

The receiving server turns away mail that fails the checks during the SMTP connection itself; the message reaches no folder at all.

Remaining risk

The forged invoice never reaches the recipient. The remaining risk is on your side: if one of your sending sources (CRM, newsletter service, website form) is not yet covered by SPF or DKIM, its genuine mail is rejected too.

When to use it?

This is the target end state. Move to it once the reports show all of your genuine sources passing the checks; on domains that send no e-mail at all, apply it immediately.

SPF “all” Qualifiers

The all term at the end of your SPF record tells receivers what to do with email from a server that is not on your list.

Qualifier
Meaning
Risk
-all Secure Your domain is here right now
MeaningMail from servers that are not on the list fails the SPF check outright (fail); the receiving server may reject it.
RiskThe most secure setting. Its one condition is that every genuine sending source is in the record; mail from a source you forgot fails as well.
~all Weak Your domain is here right now
MeaningServers that are not on the list are marked "suspicious" (softfail); the message is usually still accepted, at most with a higher spam score.
RiskMost forged mail is delivered. Reasonable during a rollout, weak as a permanent setting. With DMARC p=reject in force, the difference shrinks.
?all Dangerous Your domain is here right now
MeaningThe domain states no opinion about servers that are not on the list; the receiving server behaves as if there were no SPF.
RiskProvides no protection; it only makes sense for short-term testing.
+all Dangerous Your domain is here right now
MeaningEvery server on the internet counts as authorised to send e-mail for your domain.
RiskMakes SPF completely ineffective and is an open invitation to spoofers. It should never be used.

Blacklist (DNSBL) Check

Enter your mail server IP (or domain); it is queried against known blacklists including Spamhaus.

Is your mail server on a blacklist?

One listing on a major blacklist is enough for Gmail, Outlook and corporate filters to reject your email. We query the lists that matter and tell you what each result means.

DNSBLThe leading DNS blacklists, grouped by how much they affect delivery.
PTRReverse DNS and forward confirmation of your IP address.
RemovalA step-by-step delisting guide with links to the removal pages.
In short

This page has four tools built to find the root cause of business email deliverability problems: SMTP Test verifies the server connection and TLS/AUTH steps, Send Test Email performs a real end-to-end delivery, Mail Security scores your domain's SPF/DKIM/DMARC/MX records, and Blacklist Check looks up your server IP across 9 DNSBLs. Built for sysadmins, developers, and any business whose email keeps landing in spam.

What do these tools actually do?

IzMail Mail Server Tools is a free technical toolkit for diagnosing business email delivery problems. Most "my email isn't sending" or "my customer's email keeps going to spam" complaints trace back to a handful of server-side causes: a wrong port/encryption combination, a broken SPF/DKIM/DMARC record, or a sending IP that ended up on a blacklist. This page gives you four independent tools to rule each cause out one at a time.

The tools work at the real protocol level. SMTP Test opens a TCP connection to your server, reads the banner, lists the EHLO capabilities, performs STARTTLS or a direct SSL/TLS handshake, and checks whether the certificate matches the hostname. Mail Security parses SPF's 10-DNS-lookup limit, discovers your DKIM keys, and evaluates your DMARC policy (p=none/quarantine/reject) with concrete, copy-ready recommendations.

For security, connections are only allowed to standard mail ports (25, 465, 587, 2525) and to public IP addresses — internal/private servers are blocked. Any SMTP credentials you enter are used only for that single test request and are never stored. You can test your own server, a client's server you manage as an agency, or the relay your application sends through.

Four tools, four layers of the problem

SMTP Test

Connects to your server on port 25, 465, 587, or 2525 and reports every step from connection to authentication separately.

Use it when your SMTP server refuses the connection, STARTTLS fails, or you need to see exactly where the AUTH step breaks down.
  • TCP connection and server banner
  • Server capabilities announced via EHLO
  • STARTTLS or direct SSL/TLS handshake
  • TLS version, cipher suite, and certificate-hostname match
  • AUTH mechanisms offered and an optional login test
  • Server software guess based on the banner

Send Test Email

Sends a real email to a recipient you choose using the SMTP server and credentials you provide, then reports success or a classified failure.

Use it when the SMTP connection looks fine but you are not sure mail is actually being delivered — for a true end-to-end check.
  • Authentication success or failure
  • Connection refused or timed out
  • TLS/certificate-related send errors
  • Whether the server accepted the message for delivery
  • Error message classified by SMTP reply code

Mail Security

Analyzes your domain's SPF, DKIM, DMARC, and MX records and returns a security score out of 100 with recommended DNS records.

Use it when your emails land in spam on Gmail or Outlook, or when you're worried your domain could be spoofed.
  • SPF syntax, the 10-DNS-lookup limit, void lookup count, and the nested include tree
  • SPF qualifier (-all / ~all / ?all / +all) and duplicate-record detection
  • DKIM: automatic scan of common selectors or key validity for a selector you specify
  • DMARC presence, policy (p=none/quarantine/reject), and reporting addresses
  • MX record correctness and priority
  • Visual chain analysis of the SPF include tree

Blacklist Check

Looks up the IPv4 address you provide (or the IPv4 a domain resolves to) across 9 DNSBLs and separates major from minor lists.

Use it first whenever your emails simply never arrive or keep getting rejected — checking whether your sending IP is blacklisted.
  • Spamhaus ZEN, SpamCop, Barracuda, Mailspike
  • UCEPROTECT-1, DroneBL, s5h, 0spam, GBUdb Truncate
  • Major vs. minor list distinction
  • Delisting link for each listed blacklist
  • PTR (reverse DNS) record presence and correctness

What you need to know about email deliverability

What is an SPF record and how do you check it?

SPF (Sender Policy Framework) is a DNS TXT record that lists which servers are allowed to send mail on behalf of your domain.

A missing or misconfigured SPF record makes receiving servers treat your mail as possibly spoofed, which can send it straight to spam or get it rejected outright.

v=spf1 include:_spf.example.com include:_spf.izmail.com.tr -all
  • Make sure your domain has exactly one SPF TXT record (more than one invalidates SPF)
  • Keep the total include chain under the 10-DNS-lookup limit
  • Set the trailing qualifier to -all (fail); ~all (softfail) is only for a transition period
  • Remove old sending services you no longer use from the include list
  • Run the SPF chain analysis in Mail Security to catch void-lookup warnings

What is a DKIM signature and how is it verified?

DKIM (DomainKeys Identified Mail) attaches a cryptographic signature to outgoing mail using a private key; the recipient verifies it against the public key published in DNS.

Without a valid DKIM signature you cannot prove to the receiving server that your message wasn't altered in transit, which breaks DMARC alignment and lowers your deliverability.

selector1._domainkey.example.com TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSq..."
  • Find out which selector name your mail server or sending service uses
  • Add the corresponding DKIM public key TXT record to your DNS
  • Use Mail Security to scan common selectors (google, selector1, default, mail, k1...) or your own
  • Use a key length of at least 1024 bits, preferably 2048 bits
  • Rotate the key on a regular schedule

How do you create a DMARC record?

DMARC is a DNS TXT record that tells receiving servers what to do when SPF and DKIM fail (ignore, quarantine, or reject) and lets you receive reports about the results.

Without a DMARC record, you have no policy stopping spoofed mail sent as your domain, and major providers increasingly trust domains without one less.

_dmarc.example.com TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com; pct=100"
  • Start in monitoring mode with p=none and collect rua reports first
  • Confirm from the reports that your legitimate senders pass DMARC alignment
  • Move to p=quarantine once clean, then to p=reject
  • Point rua (and ruf, if used) at an inbox you actually check
  • Roll out gradually with the pct parameter (e.g. pct=50) if you want a staged rollout

How do you look up an MX record?

An MX (Mail Exchanger) record specifies which server(s) incoming mail for a domain should be routed to, and in what priority order.

Missing, incorrect, or misordered MX records mean incoming mail never arrives, or arrives at the wrong server entirely.

example.com MX 0 mx1.izmail.com.tr. / example.com MX 10 mx2.izmail.com.tr.
  • Verify every MX record points to a hostname with a valid A/AAAA record
  • Use different priority values for your primary and backup mail servers
  • Never point an MX record directly at an IP address
  • Keep DNS TTL reasonable after making changes

Why does the PTR (reverse DNS) record matter?

A PTR record maps an IP address back to a hostname, and for a mail server IP it is normally set by your hosting or server provider.

Most major mail providers reject or spam-flag mail coming from an IP with no PTR record, or one that doesn't match the sending hostname.

203.0.113.10 → mail.example.com (PTR), and mail.example.com → 203.0.113.10 (A) should match
  • Ask your server provider to set a PTR record for your IP
  • Make sure the hostname the PTR points to has a valid A record
  • Keep the PTR hostname consistent with the hostname announced in the SMTP banner
  • Verify the PTR record with the Blacklist Check tool

What's the difference between STARTTLS and SSL/TLS?

STARTTLS upgrades a plaintext connection to an encrypted one mid-session (typically port 587/25); implicit SSL/TLS encrypts the connection from the very first byte (typically port 465).

Picking the wrong encryption/port combination means the connection fails outright or gets dropped by the server; outdated or weak TLS versions can also be rejected by some recipients.

Port 587: EHLO → 250-STARTTLS → STARTTLS command → TLS handshake → AUTH
  • Choose STARTTLS if you are using port 587
  • Choose direct SSL/TLS (implicit) if you are using port 465
  • Use SMTP Test to check which TLS version the server offers and whether the certificate matches the hostname
  • Renew any expired certificate or one that doesn't match the hostname

How do you check and clear a DNSBL blacklist listing?

A DNSBL (DNS Blackhole List) is a database of IP addresses known to have been abused, which mail servers query to decide whether to reject a message.

If your server IP is listed on a DNSBL, providers that use that list can silently reject your mail or send it straight to spam — even a single listing can seriously hurt deliverability.

203.0.113.10 → a query against zen.spamhaus.org looks up an A record at 10.113.0.203.zen.spamhaus.org
  • First find out why the IP was listed (spam campaign, open relay, compromised device)
  • Fix the root cause (rotate passwords, close the open relay, clean the infected machine)
  • Use the delisting form on the specific DNSBL's own website
  • After delisting, re-run Blacklist Check to confirm you're clean everywhere
  • Tighten sending volume and authentication (SPF/DKIM/DMARC) to avoid getting relisted

Check your business email deliverability in 5 steps

  1. Test the SMTP connection

    Enter your server, port, and encryption details and run SMTP Test to see exactly where things break: connection, STARTTLS, or AUTH.

  2. Send a real test email

    If the connection succeeds, use Send Test Email to deliver a real message to yourself or a test inbox and confirm end-to-end delivery.

  3. Score your domain's SPF/DKIM/DMARC

    Scan your domain with Mail Security to see your SPF lookup count, discovered DKIM keys, and DMARC policy, along with a score and recommendations.

  4. Check your sending IP against blacklists

    Use Blacklist Check to look up your server IP across 9 DNSBLs, and follow the delisting steps if it's listed anywhere.

  5. Combine the findings and prioritize

    Weigh the four results together: fix connection/authentication issues first, then DNS records, and finally reputation (blacklist) problems.

Common SMTP error codes

CodeMeaningFix
535 5.7.8Authentication failed; the server rejected the username or password you provided.Double-check the username/password, use an app password if one is required, and confirm you selected the AUTH mechanism the server expects.
550 5.7.1Relaying to the recipient was denied, or server policy blocked the message.Make sure the server actually authorizes you to relay (authentication, allowed IP) and that you're using the correct relay server.
550 5.1.1The recipient mailbox was not found on the server (user unknown).Check the recipient address for typos and confirm the recipient domain's MX record points to the correct server.
554 5.7.1The message or sending server was rejected outright, usually for policy or reputation reasons.Check whether the sending IP is blacklisted, verify your SPF/DKIM/DMARC records, and review the message content.
421 4.7.0Temporary error; the server cannot accept the connection right now, usually due to rate limiting.Slow down your sending rate and retry after a short wait — the server usually accepts again shortly after.
450 4.7.1Temporary rejection, most commonly greylisting — the server temporarily rejects an unfamiliar sender on the first attempt.An automatic retry within a few minutes usually succeeds; if it keeps happening, check your sending IP's reputation.
550 5.7.26The sender could not be authenticated; the recipient expected SPF/DKIM/DMARC alignment and didn't find it.Add SPF and DKIM records for your domain and confirm DMARC alignment passes using Mail Security.
553 5.7.1The From address was rejected by the server as invalid or unauthorized.Confirm the From address is a defined, authorized sender on the server and that the domain format is valid.
550 5.7.23SPF validation failed; the sending IP is not listed as authorized in the domain's SPF record.Add the sending server or service as an include in your SPF record and verify it with the SPF chain analysis.
451 4.7.0A temporary server error, usually caused by a DNS resolution issue or a transient server-side failure.Check that your DNS records (MX, SPF, PTR) resolve correctly; if the issue is temporary, retry shortly after.

Glossary

SMTP
Simple Mail Transfer Protocol, the standard protocol used to send email between servers. Sending typically happens on port 25, 465, or 587.
STARTTLS
A command that upgrades an SMTP connection that started as plaintext into an encrypted one once server and client agree. Commonly used on port 587 and 25.
SPF
Sender Policy Framework, a DNS TXT record listing which servers may send mail on behalf of a domain. The total DNS lookup count is capped at 10.
DKIM
DomainKeys Identified Mail, a mechanism that signs outgoing email and lets the recipient verify that signature against the public key published in DNS.
DMARC
A policy record that tells receiving servers what to do based on SPF and DKIM results (none/quarantine/reject) and provides reporting back to the sender.
MX record
A DNS record that specifies which server incoming mail for a domain should be routed to, and with what priority.
PTR / rDNS
A reverse DNS record mapping an IP address to a hostname; an important factor in sender reputation for mail servers.
DNSBL
DNS Blackhole List, a database of IP addresses known to have been abused, which mail servers query to decide whether to reject a message.
MTA-STS (recommendation)
A policy standard that forces SMTP traffic between mail servers to use TLS. Not checked by the tools on this page; it requires a separate DNS/HTTPS configuration.
BIMI (recommendation)
A standard that lets domains enforcing DMARC display a brand logo alongside their email. Not checked by the tools on this page; it requires DMARC at p=quarantine/reject.

Frequently asked questions

Why does my email keep going to spam?
The most common causes are a missing or broken SPF/DKIM record, no DMARC record at all, a sending IP listed on a blacklist, or a missing/incorrect PTR record. Run Mail Security and Blacklist Check in sequence and you can usually pinpoint the layer that's failing within a few minutes.
My email just isn't sending and I'm not getting an error — what now?
First use SMTP Test to connect to your server and confirm the AUTH step is actually succeeding; then try Send Test Email for a real end-to-end delivery attempt. Messages that vanish silently have usually either landed in the recipient's spam folder or been silently discarded on the receiving end.
What does a "535 authentication failed" error mean?
It means the SMTP server rejected the username/password combination or the AUTH method you used. Double-check your password, use an app password if your provider requires one, and compare the AUTH mechanism list from SMTP Test against what the server expects.
How do I fix a 550 5.7.1 error?
550 5.7.1 usually means a relay denial or a policy block: the server is refusing a message from an unauthenticated or unauthorized source. Make sure authentication is enabled and that your sending IP or account is actually authorized to relay through that server.
How do I get around the 10-DNS-lookup limit in my SPF record?
You don't get around it — exceeding it makes SPF invalid (permerror) and authentication fails. The fix is to simplify the include chain: drop unused services, flatten nested includes, and use SPF flattening if needed. The SPF chain analysis in Mail Security shows exactly how many lookups you're using.
How do I find my DKIM selector?
The selector is usually listed in your sending service or mail server's admin panel or setup documentation (e.g. google, selector1, mail, default). If you're not sure, Mail Security automatically scans common selectors for you; if it can't find one, ask your server administrator or check your sending service's documentation.
Can I set my DMARC policy straight to reject?
It's not recommended. Start with p=none to monitor reports and confirm your legitimate sending sources pass SPF/DKIM alignment, then move to p=quarantine, and only then to p=reject. Jumping straight to reject can cause legitimate but unaligned mail to be rejected too.
How do I get delisted from a blacklist?
First fix the underlying cause (spam source, open relay, compromised device), then submit the delisting form on that specific blacklist's own website. Most lists, including Spamhaus, process delisting automatically or within a few hours; our Blacklist Check tool links directly to each list's delisting page.
Can I send mail without a PTR record?
Technically yes, but most major providers (Gmail, Outlook, Yahoo) reject or spam-flag mail from IPs with no PTR record. You'll need to request the PTR record from whoever hosts your mail server.
Should I use STARTTLS or SSL/TLS?
Use STARTTLS on port 587, or direct SSL/TLS (implicit) on port 465. Both encrypt the traffic; the difference is whether the connection starts encrypted (465) or gets upgraded to encryption mid-session (587). If you're unsure, SMTP Test will try both and show you the result.
I sent a test email but it never arrived — why?
The tool may have delivered it successfully to your server, but the message could have landed in the recipient's spam folder or been silently discarded on their end. Check the recipient's spam folder first, then use Mail Security and Blacklist Check to verify your SPF/DKIM/DMARC and IP reputation.
Can I use these tools to test a server that isn't mine?
Yes — you can test a client's server you manage as an agency or consultant, or the relay your own application sends through. The only requirement is that it has a public IP and listens on one of the standard mail ports; connections to private/internal servers are blocked.

Found the problem — want a permanent fix?

With IzMail Kurumsal E-posta, Mail Relay, and Spam Gateway, your SPF/DKIM/DMARC configuration, PTR record, and IP reputation are managed for you, so you get reliable delivery without wrestling with SMTP settings yourself.

Business Email Mail Relay Spam Gateway