Every mail and DNS check, one search.
MX, SPF with a full lookup tree, DKIM selector discovery, DMARC, MTA-STS, TLS-RPT, BIMI, DNSSEC, reverse DNS and 13 blocklists, scored and explained with the fix for each problem.
Lookup & propagation
Query any record type and compare answers across five public resolvers, or see what users in nine regions get back using EDNS Client Subnet. Useful after a DNS change, or for CDN and GeoDNS setups.
All tools
Every record type and check in one place. Enter a domain, host or IP, then pick a tool. DNS record lookups run live against Cloudflare and Google; the mail and security tools open the full analysis for that domain.
Toolkit
Hands-on utilities: inspect a record you've pasted, read the DMARC reports landing in your inbox, flatten an SPF record, or work out IP and subnet details. Everything runs in your browser. (DKIM key generation now lives in Record builders, next to SPF and DMARC.)
DMARC aggregate report reader
Your rua address receives a daily XML report from each inbox provider, usually zipped or gzipped. Drop one here to see who's sending as your domain and whether it passes.
Resources
Trusted external tools that pair well with DNSLighthouse — including the things a browser can't do here: attack-surface recon, breach checks, and live TLS and certificate scanning. Links open in a new tab.
Header analyser
Paste the full headers of a message (in Gmail: More → Show original; in Outlook: File → Properties). You get the delivery path with the delay at every hop, SPF, DKIM and DMARC verdicts, and red flags such as a Reply-To on another domain. Nothing leaves your browser.
Record builders
Generate correct SPF, DMARC, BIMI and CAA records. Pick a builder, check the domain's current record if you like, set your options, then copy the record into your DNS host.
SPF record · host @
include:… for each. Use this to delegate to your own domain's SPF or a provider that isn't listed above.DMARC record · host _dmarc
DKIM key · host <selector>._domainkey
DKIM signs your outgoing mail. Generate a key pair here — publish the public key in DNS, give the private key to your mail server. It's created in your browser and never sent anywhere.
BIMI record · host default._bimi
BIMI shows your brand logo beside messages in supporting inboxes. It needs DMARC enforced at quarantine or reject first, an SVG Tiny PS logo, and for Gmail and Apple Mail a Verified Mark Certificate.
default._bimiCAA record · host @
CAA records say which certificate authorities are allowed to issue TLS certificates for your domain. Any CA not listed must refuse. Add one row per authority.
Tick a CA to allow it. Use its wildcard box to also permit *.yourdomain certificates from that CA.