Mail Check
Moved from Mimecast, Proofpoint or another filter to Exchange Online, and seeing more spam? Check your domain's mail records for what the old filter left behind, and get the fix for each problem.
Reads public DNS only (MX, SPF, DKIM, DMARC, MTA-STS), from your browser. No sign-in, and nothing about your tenant is touched.
About this tool
How Mail Check works
Enter your domain. The check reads its public DNS records from your browser over DNS-over-HTTPS and looks at how mail reaches you (MX), who may send as you (SPF), whether Exchange Online can sign your mail (DKIM), what happens to spoofed mail (DMARC), and whether senders must encrypt (MTA-STS).
If you've moved from a filtering service such as Mimecast or Proofpoint, it recognises that service in your records and flags anything still pointing at it as a leftover: a backup MX record, an SPF include, DKIM selectors or DMARC reports going to a service you no longer use.
DNS is only part of the picture. Most extra spam after a move comes from settings inside Exchange Online left over from the old filter, such as transport rules that skip spam filtering or allow lists imported from it. The checks use the same IDs as AKC-MailGuard, the full read-only audit for those settings.
Questions
Does it sign in to Microsoft 365?
No. It only reads public DNS records for the domain you enter, the same records any mail server sees.
Where do the lookups go?
Your browser asks Cloudflare's public DNS-over-HTTPS service (or Google's, if Cloudflare doesn't answer). Nothing is sent to an Andy Kemp server apart from an anonymous count that the tool was used.
Why has spam gone up since we left our old filter?
Usually because the tenant is still set up for the old filter: rules that skip spam filtering for its IP addresses, its IPs in the allow list, allowed sender lists imported from it, and an old MX record senders can still use. This check finds the DNS side; AKC-MailGuard checks the Exchange Online side.
Related tools
Use it with
- Tenant Security Self-AssessmentScore your own Microsoft 365 tenant across eight security and compliance domains, using read-only access. For an audit of your real tenant, see Tenant Audit.
- DNS & Domain Cutover ChecklistGenerate a prioritised, interactive checklist for domain cutover covering DNS, mail routing, certificates, and validation.
- Zero Trust ScorecardAssess your Microsoft 365 and Entra ID environment against core Zero Trust security principles.