One check for the DNS layer of deliverability: SPF, DMARC, DKIM, MX, nameservers, CAA, and registration age - graded, explained, with the exact fix for every gap.
Queries go straight from your browser to public DNS (dns.google). Orbit’s servers never see what you type.
Seven checks, a few seconds. Works for any domain you’re curious about.
The three records that decide whether your mail authenticates - including the 10-lookup SPF limit most people trip on.
Mail routing, DNS host, and certificate-issuance restrictions, with providers identified where the hostnames give it away.
Domain age and expiry from the registry - new domains carry a real deliverability penalty.
Run a check above and every card lands here, worst news first in the summary.
Every number this tool shows, and where it comes from.
How the queries run. Your browser calls Google Public DNS over HTTPS (dns.google/resolve) and the registry’s RDAP endpoint via rdap.org directly. Orbit has no backend in the loop: we never see the domains you check. Google’s resolver sees the DNS queries, as it does for a large share of the internet’s traffic. Reference: Google Public DNS over HTTPS.
SPF. Parsed against RFC 7208: exactly one v=spf1 record, at most 10 DNS-querying mechanisms, and a meaningful trailing ~all or -all. Multiple records or 11+ lookups are permanent errors, not warnings.
DMARC. Checked at _dmarc.yourdomain per RFC 7489: policy present, aggregate reporting (rua=) configured, pct at 100. Gmail and Yahoo both require DMARC for bulk senders since 2024.
DKIM. Selectors are provider-specific and unlimited, so no outside tool can enumerate them all. We probe 10 common ones (google, selector1/2, k1/k2, s1/s2, mail, dkim, zoho). A miss here means “not at the common selectors”, never “no DKIM” - confirm in your mail provider’s dashboard.
Registration age. Mail filters penalize domains younger than roughly six months, which is why cold-outreach domains get warmed before real volume. Expiry under 60 days gets flagged because an expired domain takes mail down with it.
What it cannot see. Sender reputation, blocklist status, inbox-placement rates, and warm-up state live inside mailbox providers and blocklist operators - no DNS query exposes them.
Checks last reviewed 2026-07-03.
The rest of the toolkit runs in your browser too.
The copy half: spam triggers, template tells, and length bands on the draft itself.
Open the toolThe same DNS records, read the other way: what a company’s records reveal about its stack.
Open the toolBrowse the rest of the free toolkit.
Open the toolOrbit runs your revenue systems - outreach, CRM, invoicing - from one dashboard with approval queues and a full run log, so checks like these stop being a monthly chore you forget.
No credit card required. Cancel anytime.