Email Deliverability Report
Predicted inbox-placement score for Gmail, Outlook/M365, Yahoo and Apple iCloud - with AI-drafted executive summary, prioritised fix list, and copy-paste DNS records. Share the saved report with a client or your team.
None of 50+ common ESP selectors (Google, Microsoft, SendGrid, Mailgun, AWS SES, Postmark, Maileroo, Resend, Brevo, etc.) resolved. Without DKIM, messages can't be cryptographically attributed to your domain - Gmail and Yahoo downgrade heavily.
Generate keys via /tools/dkim-generator and publish the TXT at the selector your mail provider expects.
Outlook/Hotmail hard-rejects messages from sending servers without matching forward+reverse DNS. Gmail reduces score.
Ask your mail provider / IP owner to set a PTR record on the sending IP pointing back to the MX hostname.
Without a rua= address, you're flying blind - no visibility into which sources are failing alignment for your domain.
Add rua=mailto: pointing at an inbox you monitor, or a DMARC aggregator (Postmark, Dmarcian, Valimail).
MTA-STS forces inbound mail to use TLS and only to whitelisted MX hostnames. Strong signal to Gmail/Microsoft but not required - missing it is common, just a bonus point loss.
- Publish TXT at _mta-sts.example.com: 'v=STSv1; id=20260915T000000;'
- Serve policy file at https://mta-sts.example.com/.well-known/mta-sts.txt
- Start with 'mode: testing', flip to 'mode: enforce' after a week of clean TLS-RPT reports
TLS-RPT tells senders where to report TLS-delivery failures for your inbound mail. Only useful paired with MTA-STS.
Only valuable if you have MTA-STS enabled.
Optional. Publishing a VMC-verified BIMI record makes your brand logo appear next to your emails in Gmail/Yahoo/Apple Mail - strong trust signal.
Requires DMARC at p=quarantine/reject + SVG logo hosted at HTTPS + (Gmail/Yahoo) a Verified Mark Certificate. See bimigroup.org.
Raw check data
{
"spf": {
"ok": "true",
"error": "",
"host": "example.com",
"record": "v=spf1 -all",
"mechanisms": [
"-all"
],
"all_mechanism": "-all",
"includes": [],
"ip4": [],
"ip6": [],
"a": [],
"mx": [],
"exists": [],
"ptr": [],
"redirect": "",
"dns_lookups": "0",
"status": "ok",
"status_message": "Strict SPF (-all). Unauthorized senders are rejected."
},
"dmarc": {
"ok": "true",
"error": "",
"host": "example.com",
"record": "v=DMARC1;p=reject;sp=reject;adkim=s;aspf=s",
"tags": {
"v": "DMARC1",
"p": "reject",
"sp": "reject",
"adkim": "s",
"aspf": "s"
},
"policy": "reject",
"subdomain_policy": "reject",
"percentage": "100",
"rua": "",
"ruf": "",
"alignment_dkim": "s",
"alignment_spf": "s",
"status": "ok",
"status_message": "Strict DMARC policy enforced. Spoofed mail is rejected."
},
"mx": {
"ok": "true",
"error": "",
"host": "example.com",
"records": [
"#<struct MxLookup::Record priority=0, exchange=\"\", ips=[]>"
],
"provider": "",
"status": "ok",
"status_message": "MX configured (1 record(s))."
},
"dkim": {
"ok": "true",
"host": "example.com",
"selectors_probed": "84",
"hits": [],
"status": "warning",
"status_message": "No DKIM records found for 84 common selectors. Either none configured or using custom selector name.",
"error": ""
},
"dnssec": {
"ok": "true",
"error": "",
"host": "example.com",
"has_dnskey": "true",
"has_ds": "true",
"dnskey_count": "4",
"ds_count": "1",
"signed": "true",
"status": "ok",
"status_message": "Fully DNSSEC-signed - DNSKEY and DS both present."
},
"bimi": {
"ok": "true",
"error": "",
"host": "default._bimi.example.com",
"record": "",
"logo_url": "",
"authority_evidence_url": "",
"version": "",
"status": "info",
"status_message": "No BIMI record at default._bimi.example.com. BIMI is optional but recommended for brand recognition in Gmail/Yahoo/Apple Mail."
},
"mta_sts": {},
"tls_rpt": {},
"ptr": {
"ok": "false",
"error": "Could not resolve to an IP",
"host": "",
"input": "",
"ip": "",
"ptr_records": [],
"status": "error",
"status_message": "Could not resolve to an IP"
}
}
Scores come from deterministic rules; the summary and plan are written by Claude Haiku 4.5 and never change the numbers.