Two questions every developer sending email has to answer. Both from live DNS, both free.
These are two completely different things, and almost everyone conflates them. It’s the single most common reason a domain that seems perfectly fine gets an F.
Let mail reach your inbox. If you’re on Google Workspace or Microsoft 365, this already works. It says nothing about the mail you send.
Prove that mail claiming to be from you actually is. Without them, anyone on the internet can send email as your domain today.
Gmail, Yahoo and Microsoft reject at SMTP — 550 5.7.26, 550 5.7.9, 550 5.7.515 — once you cross ~5,000 messages/day without auth. Not spam‑foldered. Rejected.
Every finding returns the exact record to paste, not a vague warning. That’s the whole point.
Full RFC 7208 parse with recursion. We count the 10-lookup limit correctly — mx costs 1, not one per MX host. Most checkers get this wrong and flag healthy records as broken.
Over 10 lookups means PermError — SPF fails entirely. Our free flattener resolves every include: down to raw IPs, which cost zero lookups.
We probe 37 known selectors and read the real RSA key size out of the DER. A 1024-bit key is rejected by Yahoo. A missed probe never counts against your score — absence isn’t provable.
Policy, alignment, subdomain policy and reporting, with bounded RFC 9989 DNS tree-walk discovery.
A straight answer per provider: does your DNS meet Gmail, Yahoo and Microsoft’s bulk requirements — and if not, which check fails.
The rest of the modern stack, checked and scored as bonuses once the fundamentals are right.
Before you send: syntax, whether the domain can receive mail at all, burner/disposable inboxes, role accounts, and typos (gmial.com → gmail.com). One call on your signup form.
We don’t verify a mailbox exists or detect catch-alls — that needs an SMTP probe on port 25, which we don’t run. We check what DNS can actually prove, and say so plainly.
The rate-limited browser checker is free. You pay when you want it programmatic — in CI, across a client roster, or watching your domains around the clock.
| Plan | Price | Includes | |
|---|---|---|---|
| Free | $0 | Browser checker · 100 API audits/mo · SPF diagnostics | |
| Starter | $19 | 2,000 API audits/mo · monitor 10 domains | |
| Agency ★ | $79 | 25,000 checks · bulk endpoints · monitor 100 domains · retryable alerts | |
| Platform | $199 | 250,000 checks · monitor 1,000 domains · higher rate limits |
Every plan runs the same engine. No “contact sales” — the entire market does that, and we don’t.
Both — they're two different questions and CanItSend answers each. “Can my domain send?” audits your DNS (SPF, DKIM, DMARC) so the mail you send authenticates and isn't rejected by Gmail or Yahoo. “Should I send to this?” validates someone else's address before you send to it — syntax, whether the domain can receive mail, burner inboxes, role accounts and typos. One honest caveat: we do not confirm a mailbox exists or detect catch-alls, because that requires an SMTP probe on port 25 which we deliberately don't run.
Because receiving and authenticating are unrelated. Your MX records get mail into your inbox — that’s why sending and receiving “works”. SPF, DKIM and DMARC are what prove to other mail servers that a message claiming to be from you really is. Plenty of domains run flawless Google Workspace inboxes while publishing zero sender authentication: anyone can spoof them right now, and their bulk mail will start bouncing at Gmail.
RFC 7208 permits at most 10 DNS lookups while evaluating SPF. Exceed it and you get PermError — SPF fails completely, exactly as if you had no record. include, a, mx, ptr, exists and redirect each cost one. The common bug: counting mx as one lookup per MX host. It isn’t — mx costs exactly 1, and the A/AAAA lookups behind it sit under a separate per-mx limit. Over-counting flags perfectly valid records as broken. Read the full explainer →
They’re the SMTP rejection codes from Google, Yahoo and Microsoft when a bulk sender fails authentication. Your message is rejected outright — it doesn’t reach the inbox or the spam folder. It simply never arrives.
The checker reads public DNS. We don’t read your mail and never see message content. Enter an email address and we use only the domain after the @.
Yes — that’s the actual product. It is self-serve and publicly priced. Bulk auditing and continuous monitoring with regression webhooks are available for agencies and platforms. See the docs →