Free diagnostic tools

HostRepute’s free email deliverability tools on hostrepute.com/tools work without an account: 19 single tools that each check one record, host or message, SuperTool, which runs the main checks on a domain or IP together, and the reputation check at hostrepute.com/check.

Email authentication records

Tool	What you enter	What it checks
SPF record checker	A domain	Finds the domain’s SPF record (the TXT record that starts with v=spf1), explains each part, follows every include: and counts the DNS lookups, warning at 10 or more because receivers may return PERMERROR.
DKIM record checker	A domain and a selector	Looks up the DKIM key at <selector>._domainkey.<domain> and lists its tags. The selector starts as default.
DMARC analyzer	A domain	Finds the DMARC record at _dmarc.<domain> and reads its policy, alignment and reporting tags.
BIMI record checker	A domain	Finds the BIMI record at default._bimi.<domain> and checks that the logo URL (l=) and the Verified Mark Certificate URL (a=) are published and use HTTPS.
MTA-STS policy checker	A domain	Finds the MTA-STS record at _mta-sts.<domain>, fetches the policy file from https://mta-sts.<domain>/.well-known/mta-sts.txt and checks its version, mode, max_age and mx lines.
TLS-RPT record checker	A domain	Finds the TLS-RPT record at _smtp._tls.<domain> and checks that each rua= report address is a mailto: or HTTPS URI.

In the portal, email authentication checks can test SPF, DMARC and the related records with every scheduled scan; they don’t check DKIM.

Record generators

Tool	What you enter	What it gives you
SPF record generator	Include domains, IPv4 and IPv6 addresses, and the all qualifier	An SPF record with an explanation of each part and the DNS lookups it needs, with a warning from 8 lookups and a PERMERROR warning from 10.
DMARC record generator	Policy, report addresses (rua, ruf), alignment, percentage, subdomain policy	A DMARC record that starts with v=DMARC1 and the policy, an explanation of each tag, and warnings for a p=none policy or a missing rua= address.
DKIM record generator	A domain, a selector and the key type (RSA or Ed25519)	The record name and a TXT template with a placeholder for your public key. It doesn’t create keys: your mail provider or key tool does, and you publish only the public key.
SPF flattener	A domain	One SPF record with every ip4: and ip6: address from the domain’s include chain written out, the lookup count before and after, and the parts it couldn’t reduce to addresses, kept as they are.

The SPF flattener changes nothing in your DNS. The addresses behind an include change over time, so run it again when your senders change.

DNS, network and certificates

Tool	What you enter	What it checks
DNS lookup	A domain	The domain’s A, AAAA, MX, NS, TXT and CNAME records.
MX record lookup	A domain	The domain’s MX records, the servers that receive its mail, sorted by priority, with their TTL.
Reverse DNS lookup	A public IP address	The IP’s PTR record, and whether that hostname resolves back to the same IP (forward-confirmed reverse DNS).
DNS propagation checker	A domain and a record type	Asks Google, Cloudflare, Quad9 and OpenDNS for an A, AAAA, MX, TXT, CNAME, NS, SPF or DMARC record at the same time, and says whether they all give the same answer.
WHOIS lookup	A domain	The domain’s registration record from its registry’s WHOIS server: registrar, creation, update and expiry dates, name servers, status and DNSSEC.
ASN and IP lookup	A public IP address or a domain	The network that announces the IP: its AS number and name, the prefix, country, registry and allocation date. A domain is looked up by its first public IP address.
SSL certificate grade	A domain	Connects over HTTPS on port 443 and checks the certificate: whether browsers trust it, whether it matches the hostname, its dates, CAA records, its signature algorithm and HSTS, then grades it.

In the portal, certificate monitoring grades your certificates on a schedule, and domain expiry monitoring reads WHOIS every day and warns you before a registration lapses.

Messages and lookalike domains

Tool	What you enter	What it checks
Email header analyzer	Raw headers, 20 to 20,000 characters	The SPF, DKIM and DMARC results in Authentication-Results, whether there is a DKIM-Signature, each Received hop with the delay between hops, and the sender, subject, date and message ID.
Lookalike domain checker	A domain	Builds up to 200 lookalikes of your domain: swapped characters such as rn for m, typos, your name with words such as secure or login, and other top-level domains. It looks up the 50 closest in DNS, checks which accept mail, and rates each risk high, medium or low.

To check a whole message before you send it, links included, use campaign preflight in the portal.

Run the main checks at once

SuperTool runs the main checks on one domain or IP address at once, and shows each result as soon as it’s ready.

Check	What it checks	Domain	IP
SPF policy	The SPF record and its policy.	Yes	No
DMARC policy	The DMARC record and its tags.	Yes	No
DKIM keys	Tries the selectors default, google, selector1, selector2, k1, mail, smtp and dkim, and shows the first key it finds.	Yes	No
Email posture	BIMI, MTA-STS and TLS-RPT together.	Yes	No
MX servers	The servers that receive the domain’s mail.	Yes	No
DNS records	A, AAAA, NS, TXT and CNAME records.	Yes	No
Reverse DNS	PTR records and forward-confirmed reverse DNS.	Yes	Yes
TLS certificate	The certificate served on port 443.	Yes	No
WHOIS	Registrar, creation and expiry details.	Yes	Yes
Blacklist sample	10 public blocklists, one per provider where possible.	Yes	Yes

The blacklist sample looks up IPv4 addresses only; for a domain, it checks the first public IPv4 address the domain resolves to. For every blocklist, run the reputation check below. A domain or IP that SuperTool scanned in the last 10 minutes shows that result again, and it doesn’t count as a new scan. You can share a result as a link.

Reputation check

The reputation check looks up a domain or IP address on every public blocklist HostRepute checks, shows the blocklists that list it first, with how to ask each one for removal, and gives a score out of 100. That score counts only listings on those public blocklists, so it isn’t the reputation score the portal shows. HostRepute’s private sources aren’t part of this check. Each IP address can run 3 reputation checks a day, and a result can be shared as a link. Blocklists HostRepute checks lists every blocklist. In the portal, a manual scan checks a domain or IP right away on the blocklists in your check profile.

Limits

Setting	Default	How to change
Lookups with one free tool	10 per minute per IP address, for each tool	Fixed
Security checks (Cloudflare Turnstile) across all free tools and SuperTool	20 per minute per IP address	Fixed
New SuperTool scans	3 per IP address per day	Fixed
SuperTool result for a domain or IP scanned recently	Shown again for 10 minutes, without counting as a new scan	Fixed
Shared link to a reputation check result (/check)	Expires after 7 days	Fixed
Shared link to a SuperTool result	Expires after 7 days	Fixed

Notes

• Every single tool and SuperTool runs a Cloudflare Turnstile security check before it looks anything up. The reputation check doesn’t.
• The tools don’t monitor anything: each check runs once, when you ask. To check domains and IPs on a schedule and get alerts, use the portal: read How HostRepute works and the Quickstart.
• The glossary explains SPF, DKIM, DMARC and the other terms on this page.