About the Email Deliverability Analyzer
Enter a domain and every email-authentication record gets fetched and actually parsed, not just displayed: the SPF record is walked mechanism by mechanism with its DNS lookups counted the way RFC 7208 counts them (nested includes and all), the DMARC policy is decoded into plain English, sixteen common DKIM selectors are probed in parallel with key strength checked, and the MX set is sanity-checked with your provider identified.
It is built for anyone whose mail lands in spam: small businesses on Google Workspace or Microsoft 365 who never finished the DNS setup, developers debugging a transactional-mail integration, and admins staring down the 2024 Gmail/Yahoo bulk-sender rules. The grade tells you where you stand; the fix list gives you the exact records to paste into your DNS host.
Lookups run server-side over DNS-over-HTTPS with a conventional-resolver fallback, and only the domain you type is queried — nothing is stored or tied to an account.
One honest caveat: authentication is necessary, not sufficient. A clean A grade rules out the most common technical cause of spam-foldering — content, list quality, and sender reputation are the rest of the game.
Saved domains are re-graded on every visit; the delta shows movement since your last check.
How to Use the Deliverability Analyzer
Type the domain from your From address — the part after the @ — and run the
analysis. Pasting a full email address or URL works too; the tool strips the rest. If your mail
provider issued you a custom DKIM selector (the label in front of
._domainkey), add it in the second field; otherwise the sixteen most common
selectors are probed automatically. Read the four cards top to bottom, then work the fix list
in order: each entry is the literal DNS record to publish, with a copy button. DNS changes
propagate in minutes to hours — re-test after publishing and the Pro diff shows exactly
what changed.
The Authentication Trio in Plain English
SPF is a guest list: a TXT record naming every server allowed to send mail for your domain. DKIM is a wax seal: your server signs each message with a private key, and receivers verify it against the public key in your DNS. DMARC is the enforcement policy: it tells receivers what to do with mail that fails both checks (nothing, quarantine, or reject) and — critically — mails you aggregate reports listing every source claiming to be you. The three interlock: SPF breaks on forwarding, DKIM survives it, and DMARC only passes when at least one of them passes and aligns with the visible From domain. That alignment requirement is why a vendor sending “on your behalf” through their own domain still fails DMARC until you configure their include or their DKIM key.
The 10-Lookup Rule and SPF Flattening
An SPF check may trigger at most ten DNS lookups; the eleventh produces a
permanent error and receivers commonly treat the mail as unauthenticated. Every
include:, a, mx, exists:, and
redirect= costs one — and includes nest, so a single
include:_spf.google.com quietly spends three. Companies accumulate includes the
way kitchens accumulate mugs: the CRM, the newsletter tool, the helpdesk, the survey platform
from 2021 nobody uses. The repair order is: prune dead services first, then replace deep
includes with the provider’s published ip4: ranges (“flattening”)
— with the caveat that flattened IPs go stale when providers renumber, so flatten only
what you must.
Reading DMARC Policies
The p= tag is the teeth. p=none means “deliver anyway but send
me reports” — the correct starting point, worthless as an endpoint.
p=quarantine sends failing mail to spam; p=reject refuses it
outright. pct=25 applies the policy to a quarter of failing mail, which is how
you ramp without a cliff. rua= is the reporting address — without it you
cannot see the shadow senders (a payroll system, a partner portal) that will break the moment
you enforce. The classic rollout failure is skipping straight to p=reject and
discovering a week later that invoices from your billing platform have been silently refused.
The Gmail/Yahoo Sender Requirements
Since early 2024, Gmail and Yahoo enforce a baseline that turned best practice into a
gate: every sender needs SPF or DKIM; bulk senders (about 5,000 messages a day to
Gmail) need SPF and DKIM and at least p=none DMARC, plus
one-click unsubscribe and a spam-complaint rate under 0.3%. Non-compliant mail is increasingly
bounced, not spam-foldered — which is arguably kinder, since at least you see the
failure. If this tool grades you C or below and you send any volume, treat the fix list as
this week’s work, not a backlog item.
When Authentication Is Fine but Delivery Still Fails
An A grade removes the technical excuse, and what remains is reputation and behavior: sending-IP and domain reputation (shared pools on cheap ESP plans carry their neighbors’ sins), list hygiene (bought lists and stale addresses spike complaints and traps), engagement (mail nobody opens gradually trains filters), volume discipline (a 20× spike reads as compromise), and content (link shorteners and image-only mail still score badly). Debug in that order. Postmaster tools from Google and Microsoft show your reputation directly — pair them with the DMARC reports this tool helps you switch on.
Working through your domain’s technical posture? Pair this with the DNS Lookup and the HTTP Security Grader. Browse all Dev & Tech tools for more.
Frequently Asked Questions
What do SPF, DKIM, and DMARC each actually do?
SPF lists which servers may send mail for your domain. DKIM cryptographically signs each message so receivers can verify it was not altered. DMARC ties them together: it tells receivers what to do when a message fails both checks and sends you reports about who is sending as your domain. You need all three.
Why does mail fail with more than 10 SPF lookups?
RFC 7208 caps the DNS queries an SPF check may trigger at ten; beyond that, receivers return a permanent error and many treat the mail as unauthenticated. Every include, a, mx, exists, and redirect costs one lookup, and nested includes from services like Google, Mailchimp, and HubSpot add up fast. Flattening or pruning unused services is the fix.
Is p=none DMARC worthless?
No — it is step one. With p=none plus a rua reporting address you receive aggregate reports showing every source sending as your domain, legitimate or not, without risking real mail. After two to four weeks of clean reports, move to quarantine, then reject. Publishing reject on day one is how companies accidentally block their own invoices.
Since 2024, do Gmail and Yahoo really require this?
Yes. Bulk senders — roughly 5,000 or more messages a day to Gmail — must have SPF, DKIM, and at least p=none DMARC, along with one-click unsubscribe and low spam-complaint rates. Smaller senders still need SPF or DKIM at minimum. Non-compliant mail is increasingly rejected outright rather than spam-foldered.
My grade is an A but mail still lands in spam — why?
Authentication is the entry ticket, not the whole game. Content signals, list quality, engagement rates, sending-IP reputation, and volume spikes all affect placement. An A here rules out the most common technical cause; persistent spam placement with clean authentication usually points to list or reputation problems.
