How to Use Google Admin Toolbox “Check MX”

Google Admin Toolbox “Check MX” is a free, web-based diagnostic utility provided by Google that inspects your domain’s public DNS configuration for email delivery issues. If your Google Workspace users are not receiving external emails, if incoming messages are delayed, or if security records are misconfigured, Check MX audits your zone in seconds. It compares your live records against Google’s infrastructure standards to highlight missing MX priorities, malformed SPF strings, unconfigured DKIM selectors, and missing DMARC policies.

Quick Answer

Open toolbox.googleapps.com/apps/checkmx/, enter your domain name, and run the check. The tool evaluates your live DNS against Google Workspace requirements. It flags critical errors (red) and warnings (yellow) for missing MX records, multiple SPF strings, unconfigured DMARC, or DNS setup issues, giving you specific instructions to fix them.

---

What Check MX Analyzes

The Check MX tool performs an automated series of queries against public recursive resolvers to evaluate six critical DNS components:

1. Mail Exchange (MX) Records: Verifies whether your MX records point to Google’s mail servers, whether their priority values are valid, and whether your domain is using Google’s simplified single-record standard or the legacy five-record format.
2. Sender Policy Framework (SPF): Checks for syntax errors, evaluates the 10-DNS-lookup limit, and ensures you have not violated RFC rules by publishing multiple SPF TXT records.
3. DomainKeys Identified Mail (DKIM): Validates whether a DKIM public key is published on common Google selectors (such as google).
4. DMARC Policies: Audits the presence of a TXT record at _dmarc.yourdomain.com and identifies whether your enforcement policy is set to none, quarantine, or reject.
5. DNS Server Health and TTL: Flags excessively long Time to Live (TTL) values that delay updates or missing glue records.
6. Apex Domain Configuration: Checks whether your naked domain (example.com) incorrectly uses a CNAME record instead of an A record, which violates DNS specifications and breaks MX lookups.

[Administrator Runs Check MX]
               │
               ▼
   [Public DNS Zone Query]
 ┌─────────────┼─────────────┐
 ▼             ▼             ▼
[MX Records]   [SPF Record]  [DMARC & DKIM]
• Hostnames    • Syntax      • Policy status
• Priorities   • Duplicate?  • Selector key
 └─────────────┬─────────────┘
               ▼
[Categorized Diagnostic Report]
• Green Check: Compliant
• Yellow Exclamation: Suboptimal / Warning
• Red X: Critical Delivery Failure

---

Step-by-Step: Running a Diagnostic

To run the diagnostic correctly:

1. Open your browser and navigate to https://toolbox.googleapps.com/apps/checkmx/.
2. In the Domain name field, type your primary domain (for example, example.com). Do not include http://, https://, or www.
3. If you use a custom DKIM selector other than the default google, expand the DKIM selector (optional) field and enter your selector name.
4. Click Run checks!.
5. The page will populate an interactive diagnostic report divided into critical issues, warnings, and informational records.

---

Interpreting Common Check MX Results

Check MX categorizes findings using color-coded severity badges. Here is how to interpret and resolve the most common findings:

1. “Every DNS query must return at least one address” or “No MX records found”

• Status: Red (Critical).
• What it means: The tool queried your domain for MX records and received an empty response (NODATA) or NXDOMAIN. Incoming mail to your organization will immediately bounce or fail to resolve.
• Next Step: Add Google’s active MX destination to your domain registrar or DNS host. For detailed recovery steps, see Troubleshooting “No MX Records Found”.

2. “Legacy MX records used” vs. Modern Google Configuration

• Status: Yellow (Warning).
• What it means: Your domain still uses the historical five-record Google Workspace setup (ASPMX.L.GOOGLE.COM, ALT1..., ALT2...).
• Next Step: While legacy records continue to route mail, Google recommends updating to the simplified single-record destination:
  • Priority: 1 (or 10)
  • Mail Server: SMTP.GOOGLE.COM

3. “Multiple SPF records detected”

• Status: Red (Critical).
• What it means: Your domain publishes two or more TXT records starting with v=spf1. This causes receiving mail servers to return an SPF PermError and reject mail.
• Next Step: Consolidate all IP addresses and includes into one string. Review the merging process in Multiple SPF Records Detected (One Record Rule).

4. “DKIM is not configured”

• Status: Yellow/Red (Warning or Error depending on DMARC).
• What it means: The tool checked for a public key at google._domainkey.yourdomain.com and found nothing.
• Next Step: Generate a 2048-bit DKIM key inside the Google Admin Console and publish the TXT record to your DNS. Follow the procedure in How to Generate 2048-bit DKIM Key in Admin Console.

5. “DMARC is not configured”

• Status: Yellow (Warning).
• What it means: Your domain lacks a DMARC policy at _dmarc.yourdomain.com, leaving your domain vulnerable to spoofing and risking delivery failure at Yahoo and Gmail.
• Next Step: Publish an initial monitoring record: v=DMARC1; p=none; rua=mailto:dmarc@example.com;.

---

Limitations of Check MX

While Check MX is an invaluable first-line utility, administrators must keep its technical boundaries in mind:

• Public Cache Dependency: Check MX queries Google’s public DNS infrastructure (8.8.8.8). If you changed DNS records within the last hour, the tool may display stale data until the previous TTL expires.
• Custom Selectors: Check MX only audits DKIM if you leave the selector as google or explicitly type your custom selector into the optional field. It cannot automatically discover arbitrary selectors used by third-party senders (like SendGrid or Mailchimp).
• Inbound vs. Outbound: Check MX validates how the world sees your domain receiving mail. It does not test internal network routing, IP blocklists, or appliance credentials.

To perform a complete audit of both inbound DNS and outbound security mechanisms, consult The Workspace Email Authentication Master Checklist.