Emailsherlock
home / free tools

Nine free tools for
email & DNS investigators.

Live answers from authoritative DNS. No signup, no quotas.

111M searches run
9 tools, all free
2014 online since
how email moves

From send to inbox, in five steps.

Every message runs through the same chain. Each tool checks a different link.

// pipeline.email 5 stages · 9 free tools
stage 01

Domain & DNS

An email starts as a name. DNS records resolve that name to servers.

stage 02

MX routing

MX records list the servers that accept mail for the domain, ordered by priority.

stage 03

Authentication

SPF, DKIM and DMARC tell receivers the sender is allowed to send for the domain.

stage 04

Reputation

Receivers check the sending IP and domain against public blocklists.

stage 05

Inbox

If reputation holds, the recipient mailbox accepts and stores the message.

// why every step matters

Each step has its own failure mode.

An SPF record won't help if the sending IP is on Spamhaus. A clean blocklist won't help if MX records point to an offline server. Each step needs to hold for mail to reach the inbox.

Use the tools above to isolate which step is failing, instead of guessing.

// senders, recipients, investigators

Three jobs, same five steps.

Marketers run these checks before campaigns to confirm authentication. IT teams use them to debug specific bounces. Security analysts use them to fingerprint phishing infrastructure.

The same DNS records that route legitimate mail also expose impersonation. Every result here is pulled live from authoritative DNS.

Common failure modes, and which tool finds them

// cheatsheet.md
451
Greylisted on first try

Standard anti-spam behaviour. The retry succeeds. Don't page on it.

MX Lookup →
RBL
Listed on a public blocklist

The sending IP appears on Spamhaus or similar. Receivers may reject or quarantine.

Email Blacklist →
10+
SPF too-many-DNS-lookups

SPF goes to permerror once the includes resolve to 11+ DNS lookups. Flatten or trim.

SPF Lookup →
rua
DMARC reports going nowhere

Policy published but no rua= mailbox. Alignment failures stay invisible.

DMARC Check →