Email Deliverability Checker
Enter a domain to check every DNS record that decides whether its email reaches the inbox: MX, SPF, DMARC, DKIM, BIMI, MTA-STS and TLS-RPT. Each check gets a pass, warning or fail grade, a score out of 100 and a ready-to-publish fix.
Last updated:
Click Check Deliverability to test MX, SPF, DMARC, DKIM, BIMI, MTA-STS and TLS-RPT for the domain in one report.
- MX
- SPF
- DMARC
- DKIM
- BIMI
- MTA-STS
- TLS-RPT
How to use the Email Deliverability Checker
- Enter a domain such as example.com, or paste an email address: the domain is taken from it.
- Add a DKIM selector if you know it (the
s=value in a DKIM-Signature header). Common selectors are tried automatically. - Click Check Deliverability. All lookups run in parallel and finish in a few seconds.
- Read the score and chips: red checks block delivery or allow spoofing, orange ones weaken it.
- Copy the suggested record from each card and publish it as a TXT record at the host shown, then check again.
What each check means
| Check | DNS name looked up | Passes when | Points |
|---|---|---|---|
| MX | example.com (MX) | At least one MX host exists and resolves to an A or AAAA address (or a deliberate null MX) | 15 |
| SPF | example.com (TXT) | Exactly one v=spf1 record, ends in ~all or -all, 10 or fewer DNS lookups | 25 |
| DMARC | _dmarc.example.com | p=quarantine or p=reject at pct 100 with a rua report address | 30 |
| DKIM | <selector>._domainkey.example.com | A valid key is found; RSA keys of 2048 bits or Ed25519 keys | 20 |
| BIMI | default._bimi.example.com | An https logo URL and an enforced DMARC policy | 3 |
| MTA-STS | _mta-sts.example.com | A valid v=STSv1; id=… record (and a policy file in enforce mode) | 4 |
| TLS-RPT | _smtp._tls.example.com | v=TLSRPTv1 with a mailto: or https: report address | 3 |
How SPF, DKIM and DMARC work together
SPF lists the servers allowed to send for the envelope sender (Return-Path) domain. DKIM adds a signature to each message that receivers verify with a public key published in DNS. DMARC ties them to the address people actually see: a message passes DMARC when SPF or DKIM passes and the domain it used aligns with the visible From domain. The DMARC policy then tells receivers to deliver, quarantine or reject messages that fail.
Because forwarding often breaks SPF, DKIM is the more reliable path to a DMARC pass. Make sure every service that sends as your domain (mail provider, newsletter tool, CRM, help desk, invoicing) signs with DKIM using your domain, not its own.
Fixing the most common problems
- Mail goes to spam right after setup: DNS changes take effect when cached answers expire (the TTL, often 5 minutes to an hour). Check again later, then send a test message and read its Authentication-Results header with the Email Header Analyzer.
- Two SPF records: merge them into one, for example
v=spf1 include:_spf.google.com include:sendgrid.net ~all. Two records always fail. - Too many SPF lookups: remove services you no longer use, replace
aandmxwithip4:ranges, or move a sending tool to a subdomain with its own SPF record. - Weak DKIM key: rotate 1024-bit keys to 2048-bit in your provider's admin console and publish the new selector before removing the old one.
- DMARC stuck at p=none: review aggregate reports with the DMARC Report Analyzer, fix unaligned senders, then move to
p=quarantineand finallyp=reject. - Domain that never sends mail: publish
v=spf1 -all,v=DMARC1; p=rejectand a null MX (0 .) so nobody can spoof it.
Frequently asked questions
What does an email deliverability checker test?
It looks up the DNS records receivers use to decide whether to trust mail from a domain: MX (where mail is received), SPF (which servers may send), DKIM (cryptographic signing keys), DMARC (what to do when SPF and DKIM fail) and optional extras such as BIMI, MTA-STS and TLS-RPT. Problems in these records are a common reason mail lands in spam.
Why is DKIM shown as not found when I have it?
DNS has no way to list a domain's DKIM selectors, so the tool tries about 40 common names such as google, selector1, k1 and s1. If your provider uses a custom selector, open a message you sent, find the DKIM-Signature header, copy its s= value and enter it in the Extra DKIM selector field.
What do Gmail and Yahoo require from bulk senders?
Since February 2024, Gmail and Yahoo require senders of more than about 5,000 messages a day to their users to have SPF and DKIM, a DMARC record (p=none is the minimum), alignment between the From domain and SPF or DKIM, and one-click unsubscribe. All senders need at least SPF or DKIM and valid forward and reverse DNS.
How is the score calculated?
Core checks carry 90 points: DMARC 30, SPF 25, DKIM 20 and MX 15. Optional checks carry 10: MTA-STS 4, BIMI 3 and TLS-RPT 3. A pass earns full points, a warning half and a failure none. 90 or more is an A, 80 a B, 65 a C and 50 a D.
What is the SPF 10 DNS lookup limit?
RFC 7208 allows at most 10 mechanisms that need extra DNS queries (include, a, mx, ptr, exists and redirect), counted across all nested includes. Records over the limit return a permanent error, so SPF fails for every message. The checker counts them recursively for you.
Do I need BIMI and MTA-STS?
No. They are optional. BIMI can show your logo in supporting inboxes once DMARC is enforced, and MTA-STS with TLS-RPT forces encrypted delivery of mail sent to you. They do not affect spam filtering as directly as SPF, DKIM and DMARC.
Is anything sent to FreeToolCabin?
No. Your browser sends DNS queries for the domain directly to Cloudflare's or Google's public DNS-over-HTTPS resolver and builds the report locally. Nothing is stored or logged by this site.
Are all the tools on FreeToolCabin tested for quality and accuracy?
Yes! Every tool on our site undergoes automated Q/A testing in real browser environments to ensure high precision, correct output, and zero errors. If you happen to spot a bug or have a suggestion, please contact us at [email protected] and our team will review it right away.