Grade your domain's email deliverability in one check
Enter a domain and get an A to F report card of everything that decides whether your mail authenticates and reaches the inbox: SPF, DKIM, DMARC, MTA-STS, TLS-RPT, BIMI, and DNSSEC, read live from DNS. Mapped to the Gmail and Yahoo bulk-sender rules, with the exact records to paste in to fix what is wrong.
What goes into the grade, and what it deliberately won't claim
The score is weighted the way real deliverability works. Authentication is the overwhelming majority of it, because SPF, DKIM, and DMARC are what mailbox providers actually check. The rest is hardening that lifts a good domain to a great one.
- Authentication (the bulk of the grade). SPF is walked through its full include chain and counted against the 10-lookup limit in RFC 7208; a record ending in
+allscores near zero because it authorises the whole internet. DKIM is checked for a live, non-revoked key (RFC 6376). DMARC follows the organizational-domain inheritance in RFC 7489, wheresp=governs subdomains. - Transport and integrity. MX (can you receive replies and bounces), MTA-STS which enforces TLS (RFC 8461), TLS-RPT reporting (RFC 8460), and DNSSEC.
- Brand. BIMI shows your logo in the inbox, but only once DMARC is at enforcement, so we only count it when it will actually display.
What it will not do is guess. It does not claim to know whether you are in the spam folder or on a blocklist, because inbox placement depends on sender reputation that lives inside Google and Microsoft, and most blocklists are keyed to your sending IP, not your domain. This report describes how your domain is configured to be trusted. Building the reputation on top of that is what warming up and sending well actually do.
About the report
What does this email deliverability checker actually check?
It reads everything about your domain that is published in DNS and decides whether your mail can authenticate and be trusted. That means SPF (walked through its full include chain against the 10-lookup limit), DKIM (checked for a live, non-revoked key at common selectors), and DMARC (including a policy inherited from your root domain). On top of authentication it checks your MX records, DNSSEC, MTA-STS and TLS-RPT (transport security), and BIMI (your logo in the inbox). It then grades all of it A to F and maps it onto the Gmail and Yahoo bulk-sender requirements.
What is a good email deliverability score?
Authentication is the overwhelming majority of the grade, because SPF, DKIM, and DMARC are what actually decide whether mail authenticates. A domain with all three configured correctly, with DMARC at quarantine or reject, scores a B on its own. The advanced items, MTA-STS, TLS-RPT, DNSSEC, and BIMI, are what lift a B to an A. Anything at C or below usually means an authentication record is missing, broken, or set too loosely, and the fix list will show you exactly which one.
Do I really need MTA-STS, BIMI, and DNSSEC?
Not to reach the inbox, no. SPF, DKIM, and DMARC are the ones that matter for deliverability, and this tool weights them accordingly, so a domain without the advanced extras is not marked as failing. MTA-STS enforces encryption in transit, DNSSEC protects your DNS from tampering, and BIMI shows your verified logo next to your mail in Gmail and Apple Mail. They are hardening and brand trust, worth doing once your authentication is solid, which is why they are treated as the difference between a good grade and a perfect one rather than as requirements.
The checker says DKIM is not detected. Is my DKIM broken?
Probably not. DKIM has no fixed lookup location: the selector is chosen by whoever set up sending, so any checker can only try a list of common ones. Google Workspace is the classic trap, because its selector is a rotating date string that cannot be guessed. A miss means we could not confirm DKIM, not that it is missing, so we mark the result unverified and leave DKIM out of the score rather than grading you down for it.
Can this tell me if I am in the spam folder or on a blacklist?
No, and any tool that claims to from a domain alone is guessing. Whether you land in spam depends on sender reputation, which lives inside Google and Microsoft and is not published anywhere we can read. Most blacklists are also keyed to the sending IP address, not the domain, and your sending IP depends on your provider. This tool reports what DNS can prove about your configuration and is honest about the line: it tells you whether you are set up to be trusted, not whether you currently are.
What are the Gmail and Yahoo bulk-sender requirements?
Since 2024, senders of bulk mail to Gmail and Yahoo must authenticate with SPF and DKIM, publish a DMARC record (p=none is the minimum), align their From domain, offer one-click unsubscribe, and keep spam complaints under 0.30%. Microsoft has since followed. This tool checks every requirement that is visible in DNS and pass/fails it, and clearly marks the two that are not, one-click unsubscribe and your complaint rate, as things you must confirm yourself, because no DNS lookup can see them.
Where do the checks and the fixes come from?
Each check follows the relevant specification directly: RFC 7208 for SPF lookup limits, RFC 6376 for DKIM key state, RFC 7489 for DMARC policy and inheritance, RFC 8461 for MTA-STS, and RFC 8460 for TLS-RPT. The records in the fix list are generated from those specs and your own result, so what you paste is specific to your domain, not a generic template.