Email Deliverability Checker — SPF, DKIM, DMARC, MX

SPF, DKIM, and DMARC each contribute up to 25 points. Found and valid records earn full credit. Found but failing validation earns partial credit. Missing records earn zero. MX presence adds the final 25 points when any MX record exists.

Maximum score caps at 100. A good rating requires 80 or higher — typically all four areas present with valid authentication syntax. Fair suggests fixable gaps. Poor indicates missing MX or multiple broken records.

SPF TXT records list authorized senders and mechanisms. Invalid syntax or too many DNS lookups cause permerror in receivers. Our check flags validity alongside presence so you distinguish empty from broken.

SPF alone does not cover forwarded mail — align with DMARC and DKIM for modern receiver expectations.

The handler passes default selector when you do not specify one. If your provider uses a branded selector, re-run deliverability after updating selector input in the API or use the dedicated DKIM key checker for deep inspection.

DKIM validity requires parsable public key material in DNS, not merely a TXT record at the wrong host.

DMARC records at _dmarc.domain publish p=none, quarantine, or reject plus alignment options. Valid syntax with p=none still earns validity points but offers limited protection until policy tightens.

Gradual DMARC rollout starts at none with reporting addresses, then quarantine, then reject as confidence grows.

Domains that never receive mail may publish null MX. Sending domains need real MX hosts matching provider infrastructure. Score awards MX points when any MX exists — verify targets match your mail host documentation.

Transactional and marketing streams sharing one domain inherit the same DNS authentication — one weak record affects all streams.

Wait for TTL propagation after TXT and MX edits. Re-run this checker until score stabilizes. Send test messages to seed accounts and inspect Authentication-Results headers for live verification.

Major mailbox providers cache failures briefly — sustained correct DNS matters more than one successful lookup.

IP reputation, content filters, engagement metrics, and unsubscribe compliance affect placement beyond this score. A perfect 100 does not override blacklisted sending IPs.

Use IP reputation and blacklist tools on outbound SMTP addresses complementing this domain audit.

Some teams split mail across subdomains with separate SPF and DKIM. Run deliverability on each sending domain individually rather than assuming apex coverage extends automatically.

DMARC alignment rules determine whether subdomain mail inherits apex policy or needs explicit _dmarc labels.

Export score and record findings for SOC2 or vendor security questionnaires. queriedAt timestamps from underlying lookups anchor evidence in time.

Pair with email header analyzer on received test mail to compare DNS configuration versus live signing outcomes.