Email Deliverability Checker

What each check means

MX - where inbound mail goes, in priority order. SPF - which servers may send as the domain. The checker follows every include: the way a receiver does and counts DNS lookups; past ten, receivers return PermError and ignore the record entirely, which is the most common silent SPF failure. DMARC - what receivers should do when SPF and DKIM both fail (p=none reports only, quarantine junks, reject refuses) and where aggregate reports go. DKIM - the public key that signs outbound mail; selectors are chosen by the sender, so the checker tries the ones Google Workspace, Microsoft 365, Fastmail, Mailgun, SendGrid, Postmark and others use by default. MTA-STS and TLS-RPT - optional but cheap: they stop attackers downgrading inbound TLS and tell you when senders cannot negotiate it.

Blacklist checks

Every address behind the MX records is queried against Spamhaus ZEN, SpamCop, Barracuda, PSBL and UCEPROTECT Level 1, and the domain itself against the Spamhaus Domain Block List. A listing means a share of the world's mail servers will reject or junk mail from that host until it is delisted. Shared hosting and cloud ranges get listed because of a neighbour; a dedicated relay or a provider with its own reputation is the usual fix. Note that most senders relay through Google, Microsoft or an ESP, so the MX hosts checked here are the receiving side; outbound IPs live in the SPF record and are a separate question.

The order to fix things in

The email setup wizard writes the records for your providers and stages the DMARC rollout; the outline is below.

SPF with -all first, then DKIM on every sender, then DMARC at p=none with a rua= address. Read the reports for two weeks, fix anything legitimate that fails alignment, then move to p=quarantine and finally p=reject. Domains that never send mail still need v=spf1 -all and p=reject, otherwise they are the easiest ones to spoof.