email deliverability checker
One-click audit of MX, SPF, DMARC, MTA-STS, and BIMI for any domain. Identifies the exact reason your mail is hitting spam — and what to fix first.
By Deepak Shukla — Founder & CEO, Pearl Lemon
What This Tool Checks
- MX records resolve to a mail server
- SPF record exists with a valid terminator and stays under 10 DNS lookups
- DMARC record is published at _dmarc with a policy and reporting address
- MTA-STS policy advertised at _mta-sts (forces inbound TLS)
- BIMI record at default._bimi (lets your logo show in supporting inboxes)
- Weighted deliverability score with status banner (pass / warn / fail)
Why This Matters
Since the 2024 Gmail and Yahoo bulk-sender rules took effect, missing or misconfigured SPF and DMARC are the #1 cause of legitimate mail landing in spam. Forgotten transactional senders (password resets, receipts, magic links) are the single biggest source of preventable signup drop-off. This tool finds every missing record in one pass.
How to Fix Issues
- 1.If MX is missing — set MX records pointing at your provider (Google: aspmx.l.google.com, Microsoft: <tenant>.mail.protection.outlook.com)
- 2.If SPF is missing — use our SPF generator to build one with the right includes
- 3.If DMARC is missing — use our DMARC generator and start at p=none with rua reporting
- 4.If MTA-STS is missing — publish a TXT at _mta-sts plus the policy file at /.well-known/mta-sts.txt
- 5.If BIMI is missing — publish your VMC-signed SVG logo once DMARC reaches quarantine or reject
- 6.Re-run the check after DNS propagates (allow up to 24 hours)
Deliverability is decided before your message is read. A receiving server looks up your domain, checks whether the sending host is permitted, whether the message is signed, and what you have told it to do if either check fails. This page runs those lookups and scores the result the way a mailbox provider would weigh it.
The records that make the decision
MX records prove the domain can receive mail, which providers read as a sign of a real domain rather than a throwaway. SPF lists the servers permitted to send for you and must stay within the ten DNS lookup limit to evaluate at all. DMARC states your policy and gives you a reporting address, which is the only way to see who is sending as you. MTA-STS forces inbound mail to use TLS, closing a downgrade path. BIMI lets a verified logo appear beside your mail in supporting clients, which requires an enforcing DMARC policy first.
Why transactional mail is where the money leaks
Marketing email is monitored — someone watches the open rate. Password resets, receipts, invitations and magic links are not, because nobody opens a dashboard to check them. When those land in spam, the visible symptom is not a deliverability problem; it is signups that do not complete and support tickets about links that never arrived. Any domain that sends account mail should be checked here even if it never sends a newsletter.
Score, then sequence
The score is a guide to order, not a grade to collect. Fix a missing or broken SPF record first, because a failing SPF affects every message. Publish DMARC in monitoring mode next, because its reports tell you what is actually being sent in your name, including by services you have forgotten. Then tighten the policy as the reports get quiet. MTA-STS and BIMI come last; they are worth doing, but neither fixes a message that is already being filtered.
After the records are right
Authentication gets you eligible for the inbox; it does not guarantee it. Sending volume, complaint rate, list hygiene and content all still matter, and reputation builds slowly. The useful habit is to re-check these records whenever you add a sending tool, because each new platform is a new set of servers that your SPF record does not yet know about.
Methodology
We run five DNS-over-HTTPS lookups in parallel against Google's public resolver: MX on the apex, TXT on the apex (filtered for v=spf1), TXT on _dmarc (filtered for v=DMARC1), TXT on _mta-sts (filtered for v=STSv1), and TXT on default._bimi (filtered for v=BIMI1). Each lookup has a 4-second timeout so the whole check completes in under 5 seconds even with slow resolvers. We do not send mail, we do not require credentials, and we do not store the domain you check. The deliverability score weights the three deliverability-critical records (MX, SPF, DMARC) at 85% and the two enhancement records (MTA-STS, BIMI) at 15%, producing a pass (≥80), warn (50–79), or fail (<50) verdict. DKIM cannot be checked without knowing your selector — that one you verify with your ESP's docs.
Frequently Asked Questions
Related Free Tools
SPF Generator
Build a valid SPF TXT record by ticking the email providers you use. Counts DNS lookups so you stay within the RFC 7208 limit of 10.
DMARC Generator
Build a valid DMARC TXT record in under a minute. Choose your policy, set reporting addresses, and get a copy-paste record to publish at _dmarc.
DNS Lookup
View all DNS records for any domain — A, AAAA, CNAME, MX, TXT, NS records. Verify DNS configuration instantly.
HTTP Status Code Reference
Understanding HTTP status codes helps you diagnose issues found by this tool: