Checking mail routing

The Mail routing health card on each domain's page (Domains → the domain → Check mail routing) checks the domain the way other mail servers will, live, and says what to fix. Where Check DNS compares each record with the exact value it should have, this asks whether mail will actually flow:

Check	What it asks
MX	Does mail for the domain come here? Are other servers listed first, or hosts with no address? A missing or null MX loses mail
SPF	Does SPF pass for the addresses your mail really leaves from? Is there exactly one record, and does it end in `-all` or `~all` rather than letting anyone send (`+all`, `?all`)?
DKIM	Is the key that signs your mail published as it is? A missing or old key makes every signature fail
ARC	Mail your people forward is sealed with the domain's DKIM key, so it works when DKIM does
DMARC	Is there one policy receivers can read? Is it stronger than `p=none`? Have the domains your reports go to agreed to take them?
Reverse DNS	Does each sending address have a PTR name that points back at it? Many receivers refuse mail without it
MTA-STS	When it is on: is the policy published and served?
TLS-RPT	Will you hear when senders cannot reach the domain over TLS?

Each check is ok, warning (mail flows, but something should change), fail (mail is lost, delayed or sent to spam until it is fixed), info (optional, not set up) or unchecked (the lookup did not answer; try again). Under each is what to do, and what DNS has now.

DNS changes can take a while to reach everyone; check again later. Report addresses on another domain only get reports once that domain publishes yourdomain._report._dmarc.theirdomain TXT v=DMARC1; collecting reports here (Collect DMARC reports) avoids that.

Tenant owners and admins, and roles with the Domains part, can run it. From the command line: corpsuite domain health TENANT DOMAIN.