One-click audit of MX, SPF, DMARC, MTA-STS, and BIMI for any domain. Identifies the exact reason your mail is hitting spam — and what to fix first.
Since the 2024 Gmail and Yahoo bulk-sender rules took effect, missing or misconfigured SPF and DMARC are the #1 cause of legitimate mail landing in spam. Forgotten transactional senders (password resets, receipts, magic links) are the single biggest source of preventable signup drop-off. This tool finds every missing record in one pass.
We run five DNS-over-HTTPS lookups in parallel against Google's public resolver: MX on the apex, TXT on the apex (filtered for v=spf1), TXT on _dmarc (filtered for v=DMARC1), TXT on _mta-sts (filtered for v=STSv1), and TXT on default._bimi (filtered for v=BIMI1). Each lookup has a 4-second timeout so the whole check completes in under 5 seconds even with slow resolvers. We do not send mail, we do not require credentials, and we do not store the domain you check. The deliverability score weights the three deliverability-critical records (MX, SPF, DMARC) at 85% and the two enhancement records (MTA-STS, BIMI) at 15%, producing a pass (≥80), warn (50–79), or fail (<50) verdict. DKIM cannot be checked without knowing your selector — that one you verify with your ESP's docs.
DKIM lives at `<selector>._domainkey.yourdomain.com`, and the selector is provider-specific (google = `google`, mailgun = `mg`, etc.) and often customer-specific. Without knowing your selector we cannot find the record. Once SPF and DMARC are green, verify DKIM in your provider's admin console — every modern ESP shows whether their selector is published.
Three common causes: (1) low sender reputation — fix takes 30–90 days of consistent volume from authenticated senders; (2) content triggers — link shorteners, all-caps subject lines, missing unsubscribe; (3) recipient engagement — low opens train Gmail to bin your mail. Auth fixes inbox placement to the level your content and reputation justify; they do not override either.
Most DNS providers propagate within minutes to a few hours; the longest you should ever wait is 24 hours (the standard TTL ceiling). If a record still does not appear after 24 hours, check that it is published on the apex (not www) and as the correct record type.
Yes if you handle sensitive mail (finance, healthcare, legal). MTA-STS forces inbound senders to use TLS or be rejected, preventing downgrade attacks. The setup is a TXT record plus a static policy file on a `mta-sts.yourdomain.com` subdomain — about 15 minutes of work.
A weighted 0–100 score based on which of the five records pass. Pass (≥80) means deliverability is at a healthy baseline; warn (50–79) means at least one critical record is missing or misconfigured; fail (<50) means your domain cannot be relied on for inbox delivery in 2026.
Yes — implicitly. The Gmail/Yahoo requirements (SPF + DKIM + DMARC with rua + one-click unsubscribe) translate exactly to having SPF and DMARC both passing here. DKIM you confirm in your ESP; the unsubscribe header is set by your sending platform.