Gugu
Domain Test
EN
← All tools

Check it

Domain Test

Get a single overview of the most important email settings.

Start here when you are not sure which email setting needs attention.

Generated with gugu.tr. Results reflect the state at the time of the test.

About the domain scan

This scan checks your domain's email security in one go: SPF, DMARC, MX, BIMI, MTA-STS and TLS-RPT.

Under each check you see what is missing and how to fix it. The score at the top summarizes your overall status.

How do I read the result?

  1. Start with the red and yellow checks; they can send your emails to spam.
  2. Open the related tool (SPF, DMARC, etc.) for detailed findings and fixes.
  3. After changing DNS, wait a little for propagation and run the scan again.

Frequently asked questions

Which domain should I scan?

The domain you send email from, for example example.com. Subdomains work too.

Are MTA-STS and TLS-RPT required?

No, but they make sure incoming mail is delivered encrypted; they are advanced protection.

If my score is low, will my emails fail?

Not necessarily, but they are more likely to land in spam. Fix SPF and DMARC gaps first.

What is SPF and how do I add it?

SPF is a DNS record that lists which servers may send email for your domain. The receiving server compares the sending IP address with this list; if the record is missing or wrong, your emails may land in spam.

How to add it

  1. List every service that sends email for you (your own server, Google Workspace, newsletter and sales tools).
  2. Add a single SPF TXT record to your domain and combine the include values each service gives you in it.
  3. End the record with ~all; once you are sure, you can switch to -all. Stay within the 10 DNS lookup limit.

Example record

TXT · example.com

v=spf1 include:_spf.google.com ip4:203.0.113.10 ~all

Do not add a second SPF record for the same domain. Replace example.com with your domain and the include values with your own services.

What is DMARC and how do I add it?

DMARC tells receivers what to do with email that fails SPF and DKIM, and sends you reports. Gmail and Yahoo expect a DMARC record from bulk senders.

How to add it

  1. First make sure SPF and DKIM work.
  2. Add a TXT record to the _dmarc subdomain; start with p=none and watch the reports sent to the rua address.
  3. If you see no problems, move to p=quarantine, then p=reject.

Example record

TXT · _dmarc.example.com

v=DMARC1; p=none; rua=mailto:[email protected]

Replace example.com with your domain and use an address you actually read for rua.

What is MX and how do I add it?

MX records decide which servers receive email for your domain. Without MX, no email can reach your domain.

How to add it

  1. Get the server names from your email provider (for example aspmx.l.google.com for Google Workspace).
  2. Add one MX record per server; a lower priority number means preferred.
  3. An MX target must point to an A record, not a CNAME.

Example record

MX · example.com

10 mail.example.com
20 mail2.example.com

The server with the lower priority is tried first. Replace example.com with your domain.

What is BIMI and how do I add it?

BIMI shows your brand logo next to your emails in mail apps that support it. It only works if DMARC on your domain is in quarantine or reject mode.

How to add it

  1. Set DMARC to p=quarantine or p=reject.
  2. Prepare your logo as a square SVG Tiny PS file and publish it over HTTPS.
  3. Add a TXT record to the default._bimi subdomain. Gmail needs a VMC or CMC certificate (the a= field) to show the logo; for other apps it is optional.

Example record

TXT · default._bimi.example.com

v=BIMI1; l=https://example.com/logo.svg; a=https://example.com/certificate.pem

Without a certificate you can drop the a= part and start with l= only. Replace example.com with your domain.

What is MTA-STS and how do I add it?

MTA-STS is a rule that tells servers sending email to your domain to deliver it only over an encrypted (TLS) connection with a valid certificate. That stops someone in the middle from downgrading the connection and reading the mail. It protects mail coming to your domain; it does not directly change the spam score of mail you send.

How to add it

  1. Create an A or CNAME record for mta-sts.<your domain> and install a valid HTTPS certificate on it (for example Let's Encrypt).
  2. Publish the policy file at https://mta-sts.<your domain>/.well-known/mta-sts.txt.
  3. Add a TXT record for the _mta-sts subdomain. The id value must change every time you change the policy.
  4. Start with mode: testing; if the reports show no problems, switch to mode: enforce and raise max_age.

Example records

TXT · _mta-sts.example.com

v=STSv1; id=20260101000000

https://mta-sts.example.com/.well-known/mta-sts.txt

version: STSv1
mode: testing
mx: mail.example.com
max_age: 86400

The mx line must match the host names in your MX records. Replace example.com with your domain.

What is TLS-RPT and how do I add it?

TLS-RPT makes other mail servers send you a daily report of the TLS (encryption) problems they ran into while delivering mail to you. It shows what breaks while MTA-STS is in testing mode, and it can be used on its own too.

How to add it

  1. Choose an address to receive the reports (for example [email protected]). Reports arrive as compressed JSON.
  2. Add a TXT record for the _smtp._tls subdomain.
  3. If the reports show no errors after a few days, you can move MTA-STS to enforce mode.

Example record

TXT · _smtp._tls.example.com

v=TLSRPTv1; rua=mailto:[email protected]

Replace example.com with your domain.