Free tool · No signup

Email deliverability check

Find out why your emails land in spam: MX, SPF, DKIM, DMARC, MTA-STS and BIMI for your domain, with the exact DNS record to add.

No signup · Results in ~10 seconds · Nothing stored except the shareable report

What we check and why

What the email check covers

Whether your email lands in a client's inbox or spam folder depends largely on DNS records you publish for your domain. They tell receiving servers which systems may send email as you and what to do with messages that fail the test. We query those records directly and check them against the relevant standards.

MX records: which servers receive email for your domain, and whether they resolve.
SPF: a single valid record, its policy (~all, -all or the dangerous +all) and the 10-DNS-lookup limit.
DKIM: we probe common selectors used by Microsoft 365, Google Workspace and popular providers.
DMARC: whether a policy exists, how strict it is (none, quarantine, reject) and whether reports are collected.
MTA-STS and TLS-RPT: enforced encryption between mail servers and reporting on failures.
BIMI and CAA records, where published.

Why it matters now

Since February 2024 Google and Yahoo require bulk senders to authenticate their mail with SPF, DKIM and DMARC, and every sender to have at least basic authentication. Even if your firm never sends newsletters, receiving systems increasingly treat unauthenticated mail with suspicion.

There is also a fraud angle. Without a DMARC policy anyone can send email that appears to come from your domain. Fake payment instructions and invoice fraud are a well-known risk for notaries, law firms and accountants, because clients expect to receive banking details from them. A DMARC policy of quarantine or reject makes that kind of spoofing far harder.

How to fix common findings

Publish exactly one SPF TXT record that lists every service sending on your behalf — your mailbox provider, your practice-management software, your newsletter tool — and ends in ~all or -all. Turn on DKIM signing in each of those services and publish the keys they give you. Then add a DMARC record starting with p=none and a rua address so you receive reports, and move to quarantine and finally reject once the reports show only legitimate senders.

Changes are made at your DNS provider, which is often your domain registrar or hosting company. They usually take effect within minutes to a few hours.

Frequently asked questions

Why are my emails going to spam?

The most common technical causes are a missing or broken SPF record, DKIM not enabled, no DMARC policy, or a sending server on a blocklist. Content and sending reputation matter too, but authentication is the first thing to fix.

What is the difference between SPF, DKIM and DMARC?

SPF lists the servers allowed to send for your domain. DKIM adds a cryptographic signature to each message. DMARC tells receivers what to do when a message fails both checks, and sends you reports about it.

Why do you not find my DKIM record?

DKIM keys are published under a selector name chosen by your email provider. We test the most common selectors; if yours uses a custom one, the check shows it as not found even though DKIM may work. Your provider's admin panel will show the selector.

Is p=none DMARC enough?

It is a safe starting point because it only monitors. It does not stop spoofing. Once the reports show that all legitimate mail passes, move to p=quarantine and then p=reject.

What does the SPF 10 lookup limit mean?

The SPF standard (RFC 7208) allows at most 10 DNS lookups while evaluating a record. Each include, a, mx and redirect counts. Above the limit the check fails with a permanent error and receivers may treat your mail as unauthenticated.