---
title: "Free Email Deliverability Checker — SPF, DKIM, DMARC"
description: "Free email deliverability checker. Tests MX, SPF, DMARC, MTA-STS, BIMI in parallel. Plain-English fixes, no signup, instant results."
canonical: "https://lemwatch.com/tools/email-deliverability-checker"
source: "https://lemwatch.com"
---

# email deliverability checker

> One-click audit of MX, SPF, DMARC, MTA-STS, and BIMI for any domain. Identifies the exact reason your mail is hitting spam — and what to fix first.

## What this tool checks

- MX records resolve to a mail server
- SPF record exists with a valid terminator and stays under 10 DNS lookups
- DMARC record is published at _dmarc with a policy and reporting address
- MTA-STS policy advertised at _mta-sts (forces inbound TLS)
- BIMI record at default._bimi (lets your logo show in supporting inboxes)
- Weighted deliverability score with status banner (pass / warn / fail)

## Why it matters

 Since the 2024 Gmail and Yahoo bulk-sender rules took effect, missing or misconfigured SPF and DMARC are the #1 cause of legitimate mail landing in spam. Forgotten transactional senders (password resets, receipts, magic links) are the single biggest source of preventable signup drop-off. This tool finds every missing record in one pass.

## How to fix what it finds

- If MX is missing — set MX records pointing at your provider (Google: aspmx.l.google.com, Microsoft: <tenant>.mail.protection.outlook.com)
- If SPF is missing — use our SPF generator to build one with the right includes
- If DMARC is missing — use our DMARC generator and start at p=none with rua reporting
- If MTA-STS is missing — publish a TXT at _mta-sts plus the policy file at /.well-known/mta-sts.txt
- If BIMI is missing — publish your VMC-signed SVG logo once DMARC reaches quarantine or reject
- Re-run the check after DNS propagates (allow up to 24 hours)

## Methodology

 We run five DNS-over-HTTPS lookups in parallel against Google's public resolver: MX on the apex, TXT on the apex (filtered for v=spf1), TXT on _dmarc (filtered for v=DMARC1), TXT on _mta-sts (filtered for v=STSv1), and TXT on default._bimi (filtered for v=BIMI1). Each lookup has a 4-second timeout so the whole check completes in under 5 seconds even with slow resolvers. We do not send mail, we do not require credentials, and we do not store the domain you check. The deliverability score weights the three deliverability-critical records (MX, SPF, DMARC) at 85% and the two enhancement records (MTA-STS, BIMI) at 15%, producing a pass (≥80), warn (50–79), or fail (<50) verdict. DKIM cannot be checked without knowing your selector — that one you verify with your ESP's docs.

## Frequently asked questions

### Why do you not check DKIM?

 DKIM lives at `<selector>._domainkey.yourdomain.com`, and the selector is provider-specific (google = `google`, mailgun = `mg`, etc.) and often customer-specific. Without knowing your selector we cannot find the record. Once SPF and DMARC are green, verify DKIM in your provider's admin console — every modern ESP shows whether their selector is published.

### My mail still goes to spam after fixing everything. Why?

 Three common causes: (1) low sender reputation — fix takes 30–90 days of consistent volume from authenticated senders; (2) content triggers — link shorteners, all-caps subject lines, missing unsubscribe; (3) recipient engagement — low opens train Gmail to bin your mail. Auth fixes inbox placement to the level your content and reputation justify; they do not override either.

### How long does DNS propagation take?

 Most DNS providers propagate within minutes to a few hours; the longest you should ever wait is 24 hours (the standard TTL ceiling). If a record still does not appear after 24 hours, check that it is published on the apex (not www) and as the correct record type.

### Is MTA-STS worth setting up?

 Yes if you handle sensitive mail (finance, healthcare, legal). MTA-STS forces inbound senders to use TLS or be rejected, preventing downgrade attacks. The setup is a TXT record plus a static policy file on a `mta-sts.yourdomain.com` subdomain — about 15 minutes of work.

### What does the score mean?

 A weighted 0–100 score based on which of the five records pass. Pass (≥80) means deliverability is at a healthy baseline; warn (50–79) means at least one critical record is missing or misconfigured; fail (<50) means your domain cannot be relied on for inbox delivery in 2026.

### Do you check Gmail/Yahoo bulk-sender compliance specifically?

 Yes — implicitly. The Gmail/Yahoo requirements (SPF + DKIM + DMARC with rua + one-click unsubscribe) translate exactly to having SPF and DMARC both passing here. DKIM you confirm in your ESP; the unsubscribe header is set by your sending platform.


## Related

- [All free tools](https://lemwatch.com/tools)
- [SPF Record Generator](https://lemwatch.com/tools/spf-generator)
- [DMARC Record Generator](https://lemwatch.com/tools/dmarc-generator)
- [DNS Lookup](https://lemwatch.com/tools/dns-lookup)
- [robots.txt tester](https://lemwatch.com/tools/robots-txt-tester)
- [hreflang checker](https://lemwatch.com/tools/hreflang-checker)
- [Lemwatch pricing](https://lemwatch.com/pricing)
- [All monitoring checks](https://lemwatch.com/features)