Email Deliverability Report
Predicted inbox-placement score for Gmail, Outlook/M365, Yahoo and Apple iCloud - with AI-drafted executive summary, prioritised fix list, and copy-paste DNS records. Share the saved report with a client or your team.
None of 50+ common ESP selectors (Google, Microsoft, SendGrid, Mailgun, AWS SES, Postmark, Maileroo, Resend, Brevo, etc.) resolved. Without DKIM, messages can't be cryptographically attributed to your domain - Gmail and Yahoo downgrade heavily.
Generate keys via /tools/dkim-generator and publish the TXT at the selector your mail provider expects.
Outlook/Hotmail hard-rejects messages from sending servers without matching forward+reverse DNS. Gmail reduces score.
Ask your mail provider / IP owner to set a PTR record on the sending IP pointing back to the MX hostname.
Without a rua= address, you're flying blind - no visibility into which sources are failing alignment for your domain.
Add rua=mailto: pointing at an inbox you monitor, or a DMARC aggregator (Postmark, Dmarcian, Valimail).
MTA-STS forces inbound mail to use TLS and only to whitelisted MX hostnames. Strong signal to Gmail/Microsoft but not required - missing it is common, just a bonus point loss.
- Publish TXT at _mta-sts.example.com: 'v=STSv1; id=20261104T000000;'
- Serve policy file at https://mta-sts.example.com/.well-known/mta-sts.txt
- Start with 'mode: testing', flip to 'mode: enforce' after a week of clean TLS-RPT reports
TLS-RPT tells senders where to report TLS-delivery failures for your inbound mail. Only useful paired with MTA-STS.
Only valuable if you have MTA-STS enabled.
Optional. Publishing a VMC-verified BIMI record makes your brand logo appear next to your emails in Gmail/Yahoo/Apple Mail - strong trust signal.
Requires DMARC at p=quarantine/reject + SVG logo hosted at HTTPS + (Gmail/Yahoo) a Verified Mark Certificate. See bimigroup.org.
Raw check data
{
"spf": {
"ok": "true",
"error": "",
"host": "example.com",
"record": "v=spf1 -all",
"mechanisms": [
"-all"
],
"all_mechanism": "-all",
"includes": [],
"ip4": [],
"ip6": [],
"a": [],
"mx": [],
"exists": [],
"ptr": [],
"redirect": "",
"dns_lookups": "0",
"status": "ok",
"status_message": "Strict SPF (-all). Unauthorized senders are rejected."
},
"dmarc": {
"ok": "true",
"error": "",
"host": "example.com",
"record": "v=DMARC1;p=reject;sp=reject;adkim=s;aspf=s",
"tags": {
"v": "DMARC1",
"p": "reject",
"sp": "reject",
"adkim": "s",
"aspf": "s"
},
"policy": "reject",
"subdomain_policy": "reject",
"percentage": "100",
"rua": "",
"ruf": "",
"alignment_dkim": "s",
"alignment_spf": "s",
"status": "ok",
"status_message": "Strict DMARC policy enforced. Spoofed mail is rejected."
},
"mx": {
"ok": "true",
"error": "",
"host": "example.com",
"records": [
"#<struct MxLookup::Record priority=0, exchange=\"\", ips=[]>"
],
"provider": "",
"status": "ok",
"status_message": "MX configured (1 record(s))."
},
"dkim": {
"ok": "true",
"host": "example.com",
"selectors_probed": "84",
"hits": [],
"status": "warning",
"status_message": "No DKIM records found for 84 common selectors. Either none configured or using custom selector name.",
"error": ""
},
"dnssec": {
"ok": "true",
"error": "",
"host": "example.com",
"has_dnskey": "true",
"has_ds": "true",
"dnskey_count": "4",
"ds_count": "1",
"signed": "true",
"status": "ok",
"status_message": "DNSSEC validates - the chain of trust from the parent zone checks out.",
"keys": [
{
"tag": 36315,
"role": "ZSK",
"algorithm": 13,
"algorithm_name": "ECDSAP256SHA256",
"deprecated": false
},
{
"tag": 9776,
"role": "ZSK",
"algorithm": 13,
"algorithm_name": "ECDSAP256SHA256",
"deprecated": false
},
{
"tag": 34505,
"role": "ZSK",
"algorithm": 13,
"algorithm_name": "ECDSAP256SHA256",
"deprecated": false
},
{
"tag": 2371,
"role": "KSK",
"algorithm": 13,
"algorithm_name": "ECDSAP256SHA256",
"deprecated": false
}
],
"ds_records": [
{
"tag": 2371,
"algorithm": 13,
"digest_type": 2,
"digest_name": "SHA-256",
"deprecated": false,
"matched": true
}
],
"validation": "secure",
"resolver_error": "",
"issue": ""
},
"bimi": {
"ok": "true",
"error": "",
"host": "default._bimi.example.com",
"record": "",
"logo_url": "",
"authority_evidence_url": "",
"version": "",
"status": "info",
"status_message": "No BIMI record at default._bimi.example.com. BIMI is optional but recommended for brand recognition in Gmail/Yahoo/Apple Mail."
},
"mta_sts": {},
"tls_rpt": {},
"ptr": {
"ok": "false",
"error": "Could not resolve to an IP",
"host": "",
"input": "",
"ip": "",
"ptr_records": [],
"status": "error",
"status_message": "Could not resolve to an IP"
}
}
Scores come from deterministic rules; the summary and plan are written by Claude Haiku 5.5 and never change the numbers.