Tools/Email Deliverability Report

Email Deliverability Report

Predicted inbox-placement score for Gmail, Outlook/M365, Yahoo and Apple iCloud - with AI-drafted executive summary, prioritised fix list, and copy-paste DNS records. Share the saved report with a client or your team.

Critical Deliverability at risk (40/100) - 1 critical issue. Email from this domain is likely going to spam.
Overall score
40
out of 100
Grade
F
Summary
example.com has a 40/100 deliverability score with critical inbox placement risk across Gmail (35/100), Outlook (38/100), and Yahoo (37/100). Email authentication is incomplete: one critical gap blocks proper sender verification. Recommended next step: Have your email operations team implement the missing SPF / DKIM / DMARC record to restore authentication and reverse the inbox filtering.
Predicted inbox placement
Gmail
critical
35/ 100 inbox
35%
Gmail downgrades unsigned mail heavily
Outlook/M365
critical
38/ 100 inbox
38%
Outlook hard-rejects senders without matching PTR
Yahoo
critical
37/ 100 inbox
37%
Yahoo enforces DMARC alignment strictly
Apple iCloud
poor
43/ 100 inbox
43%
Findings, largest impact first
Critical dkim -35 points
No discoverable DKIM

None of 50+ common ESP selectors (Google, Microsoft, SendGrid, Mailgun, AWS SES, Postmark, Maileroo, Resend, Brevo, etc.) resolved. Without DKIM, messages can't be cryptographically attributed to your domain - Gmail and Yahoo downgrade heavily.

Copy-paste fix
Type and host
TXT <selector>._domainkey.example.com
Value
v=DKIM1; k=rsa; p=<public-key>

Generate keys via /tools/dkim-generator and publish the TXT at the selector your mail provider expects.

Warning ptr -14 points
Primary MX has no PTR / reverse DNS

Outlook/Hotmail hard-rejects messages from sending servers without matching forward+reverse DNS. Gmail reduces score.

Ask your mail provider / IP owner to set a PTR record on the sending IP pointing back to the MX hostname.

Warning dmarc -5 points
DMARC has no rua reporting

Without a rua= address, you're flying blind - no visibility into which sources are failing alignment for your domain.

Copy-paste fix
Type and host
TXT _dmarc.example.com
Value
v=DMARC1; p=...; rua=mailto:[email protected]

Add rua=mailto: pointing at an inbox you monitor, or a DMARC aggregator (Postmark, Dmarcian, Valimail).

Info mta_sts -3 points
MTA-STS not published

MTA-STS forces inbound mail to use TLS and only to whitelisted MX hostnames. Strong signal to Gmail/Microsoft but not required - missing it is common, just a bonus point loss.

Steps
  1. Publish TXT at _mta-sts.example.com: 'v=STSv1; id=20260915T000000;'
  2. Serve policy file at https://mta-sts.example.com/.well-known/mta-sts.txt
  3. Start with 'mode: testing', flip to 'mode: enforce' after a week of clean TLS-RPT reports
Info tls_rpt -2 points
TLS-RPT not published

TLS-RPT tells senders where to report TLS-delivery failures for your inbound mail. Only useful paired with MTA-STS.

Copy-paste fix
Type and host
TXT _smtp._tls.example.com
Value
v=TLSRPTv1; rua=mailto:[email protected]

Only valuable if you have MTA-STS enabled.

Info bimi -1 points
BIMI not configured

Optional. Publishing a VMC-verified BIMI record makes your brand logo appear next to your emails in Gmail/Yahoo/Apple Mail - strong trust signal.

Requires DMARC at p=quarantine/reject + SVG logo hosted at HTTPS + (Gmail/Yahoo) a Verified Mark Certificate. See bimigroup.org.

Priority plan
example.com scores 40/100. DKIM is missing entirely, which means your messages carry no cryptographic signature. Receivers—especially Gmail, Microsoft, Yahoo—treat unsigned mail as higher-risk. Your PTR record is also absent, removing a basic trust signal. Together these push you hard into spam folders and increase hard rejection rates. DMARC lacks reporting configuration, so you're blind to authentication failures and spoofing attempts. Fix DKIM first. Publish a DKIM key at [selector]._domainkey.example.com (you'll need to choose your selector, e.g. default or mail1). Once DKIM signs outbound, move to PTR: add a reverse DNS record pointing your primary MX hostname back to its A record. Then enable DMARC reporting by adding rua=mailto:[email protected] to your _dmarc.example.com TXT record so you start seeing auth reports. These three fixes will lift you out of the danger zone. After core auth works, add MTA-STS at .well-known/mta-sts.txt and _mta-sts._tcp.example.com (enforces TLS on inbound connections from other servers) and TLS-RPT at _smtp._tls.example.com (reports TLS failures). BIMI is lowest priority and requires DMARC enforcement already live; skip it until you have p=quarantine or p=reject in place.
Creates a snapshot link that works for 30 days. Anyone with the link can view it.
Raw check data
{
  "spf": {
    "ok": "true",
    "error": "",
    "host": "example.com",
    "record": "v=spf1 -all",
    "mechanisms": [
      "-all"
    ],
    "all_mechanism": "-all",
    "includes": [],
    "ip4": [],
    "ip6": [],
    "a": [],
    "mx": [],
    "exists": [],
    "ptr": [],
    "redirect": "",
    "dns_lookups": "0",
    "status": "ok",
    "status_message": "Strict SPF (-all). Unauthorized senders are rejected."
  },
  "dmarc": {
    "ok": "true",
    "error": "",
    "host": "example.com",
    "record": "v=DMARC1;p=reject;sp=reject;adkim=s;aspf=s",
    "tags": {
      "v": "DMARC1",
      "p": "reject",
      "sp": "reject",
      "adkim": "s",
      "aspf": "s"
    },
    "policy": "reject",
    "subdomain_policy": "reject",
    "percentage": "100",
    "rua": "",
    "ruf": "",
    "alignment_dkim": "s",
    "alignment_spf": "s",
    "status": "ok",
    "status_message": "Strict DMARC policy enforced. Spoofed mail is rejected."
  },
  "mx": {
    "ok": "true",
    "error": "",
    "host": "example.com",
    "records": [
      "#<struct MxLookup::Record priority=0, exchange=\"\", ips=[]>"
    ],
    "provider": "",
    "status": "ok",
    "status_message": "MX configured (1 record(s))."
  },
  "dkim": {
    "ok": "true",
    "host": "example.com",
    "selectors_probed": "84",
    "hits": [],
    "status": "warning",
    "status_message": "No DKIM records found for 84 common selectors. Either none configured or using custom selector name.",
    "error": ""
  },
  "dnssec": {
    "ok": "true",
    "error": "",
    "host": "example.com",
    "has_dnskey": "true",
    "has_ds": "true",
    "dnskey_count": "4",
    "ds_count": "1",
    "signed": "true",
    "status": "ok",
    "status_message": "Fully DNSSEC-signed - DNSKEY and DS both present."
  },
  "bimi": {
    "ok": "true",
    "error": "",
    "host": "default._bimi.example.com",
    "record": "",
    "logo_url": "",
    "authority_evidence_url": "",
    "version": "",
    "status": "info",
    "status_message": "No BIMI record at default._bimi.example.com. BIMI is optional but recommended for brand recognition in Gmail/Yahoo/Apple Mail."
  },
  "mta_sts": {},
  "tls_rpt": {},
  "ptr": {
    "ok": "false",
    "error": "Could not resolve  to an IP",
    "host": "",
    "input": "",
    "ip": "",
    "ptr_records": [],
    "status": "error",
    "status_message": "Could not resolve  to an IP"
  }
}

Scores come from deterministic rules; the summary and plan are written by Claude Haiku 4.5 and never change the numbers.

Save example.com and this check runs daily, with an email when the result changes. Sign up free