Tools for people who run
their own mail infrastructure.

These tools work with sensitive material — DKIM private keys, raw message headers, real recipient addresses, your actual DNS records. So they run entirely client-side: the logic executes in your browser, and what you paste or type is never uploaded to a server or stored anywhere. The DNS-facing tools query public resolvers over DoH to read records, but the keys you generate and the messages you analyse stay on your machine. You can confirm it the honest way — open them with your network tab watching, and you’ll see nothing leave.

That matters most for the generators and analysers. A DKIM key pasted into a server-side “tool” is a private key handed to a stranger; a header dump can carry internal hostnames and addresses you’d rather not share. Doing the work in the browser removes that risk entirely, which is also why there’s no signup — there’s no account because there’s nothing to store.

Mail is going to spam. Start with the header analyzer to see what’s passing, then the compliance checklist — and the emails-going-to-spam diagnostic walks the causes in order.

SPF is throwing PermError. Count the lookups with the SPF checker, then collapse the record with the SPF flattener; the PermError fix explains why.

You’re standing up a new server. Generate records with the SPF/DKIM/DMARC generator and a config with the config generator, then follow the install guide.

You’re bringing a new IP online. Build the ramp with the warm-up scheduler and size it with the throughput calculator.

A message bounced and you don’t know why. Paste the code into the SMTP & bounce code lookup for the cause and the fix.

You’re moving to DMARC enforcement. Read your aggregate reports with the DMARC report reader to find every sender before you tighten the policy.

You need to clean a list before sending. Run it through the email address validator for syntax, MX and role/disposable flags — a quick pre-send hygiene pass.

These tools are genuinely free and genuinely complete for what they do. You can generate every record, validate every check, diagnose a bounce and plan a warm-up without paying for anything or creating an account — and plenty of people use them exactly that way, alongside a setup they run entirely themselves. Nothing here is a crippled demo of a paid feature; the generators produce real keys and real config, and the checkers give you the real answer.

What the tools don’t do is the doing. They’ll tell you the SPF record is over its lookup limit, but they won’t deploy the fixed one to your server; they’ll build a warm-up schedule, but they won’t run it day by day and adjust to each provider. That gap — from knowing to done — is where the Auto PMTA Configurator and the services live. Use the tools freely; reach for the product when you want the work done and operated rather than just diagnosed.

Most of these tools are engine-agnostic. SPF, DKIM, DMARC, reverse DNS, blacklists, bounce codes and list hygiene are the same whether you run PowerMTA, another self-hosted MTA, or a hosted platform — so the checkers, analysers, calculators and the compliance checklist are useful to any sender doing deliverability work, not exclusively PowerMTA operators. A handful are PowerMTA-flavoured by design: the config generator writes /etc/pmta/config, and the DKIM and record generators emit the matching domain-key directive alongside the DNS line.

The point is that you don’t have to be a customer, or even a PowerMTA user, to get real value here. If you send legitimate, opt-in mail and want to understand or improve where it lands, the toolkit is yours to use. And if you decide self-hosting is the right move after all, the same records and plans you built here carry straight into a real deployment.

Email’s rules move, and a tool that encodes last year’s thresholds quietly gives wrong answers. These are kept to the current state of play: the compliance checklist reflects the 2026 Gmail, Yahoo and Microsoft bulk-sender requirements, the List-Unsubscribe generator builds the one-click headers those providers now demand, the SPF tools enforce the real ten-lookup limit, and the reverse-DNS check mirrors what receivers actually test. They come out of running production PowerMTA infrastructure, so they encode the checks that matter in practice rather than the ones that merely look thorough.

That’s also why each tool tends to link to the deeper explanation behind it — a checker tells you what’s wrong, and the linked guide or fix tells you why and what to do next. The tools are the fast answer; the docs and fixes are the understanding underneath. Between them you should be able to get from a symptom to a resolved cause without leaving the site. And because the tools run in your browser rather than on a server we have to maintain, there is no usage cap, no queue and no reason to ration them — run any of them as often as the work demands.