The Email Stack Scan a domain
Independent · Read from public DNS · No account

The email stack behind any domain, with the evidence.

Check SPF, DKIM and DMARC, see every tool a domain sends with and the record that gave it away, and compare those tools on the same terms.

Or open a real report
Real report
stripe.com
Fintech · read from public DNS
Authentication
SPF
v=spf1 ip4:198.2.180.60/32 ip4:13.111.2.227/32 include:spf1.stripe.com include:greenhouse-outbound-mail.stripe.com include:_spf.qualtrics.com ~all
Pass
DKIM
selectors google, s1, s2, mandrill
Pass
DMARC
v=DMARC1; p=reject; pct=100; fo=1; rua=mailto:dmarc-reports@stripe.com; ruf=mailto:dmarc-forensics@stripe.com;
Enforced
Detected stack
Mailbox
Google Workspace
MX aspmx.l.google.com
Marketing
Mailchimp
DKIM mandrill._domainkey
Transactional
SendGrid
DKIM s1._domainkey → s1.domainkey.u2680008.wl009.sendgrid.net
All three checks pass, and DMARC tells inboxes to reject anything that fails.
136
real, well-known domains in the index, read from public DNS
96%
of them enforce DMARC. Every result shows the record behind it
47
tool fingerprints, matched only when DNS names the vendor
0
inboxes accessed, accounts required, or scanned domains stored. Browser checks never reach our servers
Detected in the indexReal domains, real records
Amazon SESon1password.comviaSPF include:amazonses.comSendGridon1password.comviaDKIM s1._domainkey → s1.domainkey.u1834393.wl144.sendgrid.netZendeskon1password.comviaSPF include:mail.zendesk.comActiveCampaignonactivecampaign.comviaSPF include:_spf-lrn.activecampaign.comMailchimponadobe.comviaDKIM k1._domainkey → dkim.mcsv.netMailgunonairtable.comviaSPF include:_spf.mailgun.orgMarketoonasana.comviaSPF include:mktomail.comSalesforce Marketing Cloudonatlassian.comviaSPF include:cust-spf.exacttarget.comKlaviyoonautodesk.comviaDKIM kl._domainkeyHubSpotonautodesk.comviaDKIM hs1._domainkey → autodesk-com.hs01a.dkim.hubspotemail.netSparkPostonclickup.comviaDKIM scph1220._domainkeyPostmarkoncursor.comviaSPF include:spf.mtasv.netHelp Scoutoncustomer.ioviaSPF include:helpscoutemail.comBrevoondeel.comviaSPF include:spf.brevo.comMailjetonhuggingface.coviaSPF include:spf.mailjet.comFreshdeskonoutreach.ioviaSPF include:fdspfus.freshemail.io
Reports

Not just checks. Reports you can act on.

Five reports built on the same DNS reads, so they never disagree with each other. All five are live, and all of them run in your browser.

Live Domain Report Enter any domain and get a full read of its email setup, from public DNS alone.
  • Eight checks scored to 100: SPF, DKIM, DMARC, MX, MTA-STS, TLS-RPT, BIMI and DNSSEC, each with the record and a plain-English reason
  • Every tool visible in DNS with the exact record that revealed it, and a Google, Yahoo and Microsoft scorecard
  • A fix list with the exact records to publish, its own shareable address, and a PDF
For: Everyone who sends from a domain Build one for your domain
Live EML Viewer & Message Report

Open any .eml or .mbox in your browser: the message, every header, and a report on who really sent it and whether it is safe.

Marketers checking a send, IT checking a report, anyone asking "is this real?" → Live DMARC Report Reader

Drag in DMARC aggregate reports and read them like a person, not a parser.

Anyone who turned on DMARC and cannot read what it sends back → Live Inbox Mix Report

Upload a prospect list and see where it will land before you send.

Cold email and sales teams → Live New Domain Readiness

Enter a newly bought sending domain and get a pre-launch verdict.

Outbound teams setting up new domains →
How a report is made

Four steps, all of them in the open.

A report is built from records anyone can look up. We show the record beside every claim, so you can check our work with dig if you want to.

1Your domainTyped into a box. Never stored, never sent to us.yourcompany.com
2Public DNSFour kinds of record, read over DNS-over-HTTPS from your browser.MX · TXT · _dmarc · 31 selectors
3SignaturesRecords are matched against fingerprints of known tools.47 tool fingerprints
4The reportPass or fail per check, each tool with its evidence, and what to fix.stamped, with the record shown

What we can't see: a tool that only reads mail, a white-labelled setup, or a provider we don't fingerprint yet. We would rather show nothing than a guess. Read the full method.

What you won't find here

  • Rankings anyone can pay for. Authentication results come straight from DNS. No tool can change them.
  • A login, a trial, or a sales call. Every check runs without an account.
  • Access to your inbox. We never ask for it, and we never send mail on your behalf.
  • A record of what you scanned. Browser checks go to public resolvers, not to our servers.

The tools stay free. If a listing is ever sponsored, it says so next to the listing. How this site is funded.

The Stack Index · read on September 27, 2026

What 136 well-known domains actually run.

A point-in-time read of real companies we chose by hand: SaaS, fintech, e-commerce, media, developer tools. A sample, not a census.

Authenticated end to end

Valid SPF, a DKIM key we could find, and DMARC at quarantine or reject.

94%

128 of 136 domains pass all three checks. 96% enforce DMARC, and 100% publish a valid SPF record.

DMARC policy

What each domain tells inboxes to do with mail that fails authentication.

  1. p=rejectFailing mail is blocked 75% · 102
  2. p=quarantineFailing mail goes to spam 21% · 29
  3. p=noneMonitoring only 3% · 4
  4. No recordNo policy at all 1% · 1

Who receives their mail

Mailbox provider or security gateway, from MX records.

  1. Google Workspace 93% · 126
  2. Proofpoint 13% · 18
  3. Microsoft 365 10% · 13
  4. Mimecast 4% · 5
  5. Cisco Secure Email 1% · 2

Most detected sending tools

Marketing, transactional and support senders visible in SPF and DKIM.

  1. SendGridTransactional 65% · 88
  2. MailchimpMarketing 46% · 62
  3. ZendeskSupport 33% · 45
  4. HubSpotMarketing 25% · 34
  5. Amazon SESTransactional 19% · 26
  6. MarketoMarketing 17% · 23
  7. MailgunTransactional 9% · 12

Counts are from public DNS only, so a tool that leaves no DNS trace is not counted, and a shared DKIM selector is only attributed when its CNAME target names the vendor. How we detect tools. Browse all 136 public reports, or get the monthly letter below.

Start from a stack that already works.

Pick what you send. We’ll show the tools that fit together, layer by layer, with an alternative for each.

Revenue comes from flows: welcome, abandoned cart, win-back. Pick a marketing platform that reads your store data, and keep receipts on a separate transactional service so a campaign problem never delays an order email.

See the full online store stack
LayerOur pickAlternative
Mailbox
Google Workspace
or Microsoft 365
Marketing flows
Klaviyo
or Omnisend
Order emails
Postmark
or Amazon SES
List hygiene
ZeroBounce
or NeverBounce
Monitoring
Google Postmaster Tools
or Microsoft SNDS

Every email tool, compared on the same terms.

Pricing, sending limits, deliverability features and real alternatives, laid out the same way for every tool.

12 categories
Email service providers Campaigns, lists and automations. /directory/esp Cold email software Sequences sent from your own mailboxes. /directory/cold-email Email warmup Build reputation on new mailboxes. /directory/warmup Email verification Remove bad addresses before you send. /directory/verification Transactional email APIs Receipts, resets and alerts from your app. /directory/transactional Newsletter platforms Publish, grow and monetize a list. /directory/newsletter Deliverability monitoring Placement, reputation and blocklists. /directory/deliverability DMARC reporting Turn aggregate reports into decisions. /directory/dmarc-reporting Email finders Find the right address for a prospect. /directory/email-finders Lifecycle and automation Onboarding and behavior-based email. /directory/lifecycle Shared inboxes Team email for support and sales. /directory/shared-inbox Template builders Design emails that render everywhere. /directory/templates

Plain-English guides to the hard parts.

All guides
Authentication What Google and Yahoo now require from bulk senders Authentication, one-click unsubscribe and a spam rate under 0.3%. What each rule means, and how to check you meet it. Read the guide
AuthenticationMoving DMARC from p=none to p=reject without losing mailDeliverabilityWarming up a new sending domain, week by weekOutboundCold email infrastructure that keeps your main domain safe

The Stack Index

One letter a month on which email tools are gaining and losing ground, counted from the public DNS records of the top 1,000 domains.

Plus the month’s deliverability changes worth knowing about. Unsubscribe in one click.

You’re on the list.