Email Domain Health Check

What gets checked

• MX — whether the domain receives mail, whether there is a backup server, whether the hostnames resolve.
• SPF — who is authorised to send as you, and whether the record stays within the ten DNS lookup limit.
• DKIM — whether a public key is published, how long it is, whether it has been revoked.
• DMARC — what policy applies to mail that fails authentication, and whether reports reach you.
• MTA-STS — whether connections are protected from being downgraded to plaintext.
• TLS-RPT — whether you receive reports about TLS problems.
• BIMI — whether your logo appears next to messages.

Where to start when the score is low

The weights set the order: MX first, then SPF, then DMARC. Without MX the domain receives no mail and the rest is premature. SPF takes ten minutes to configure and closes the basic spoofing case. DMARC goes in immediately in monitoring mode (p=none) and gets tightened two to four weeks later once reports have accumulated.

DKIM is usually a single switch in the mail provider's panel, and it either publishes the record for you or hands you a value for DNS. MTA-STS, TLS-RPT and BIMI belong last: smaller effect, more work, and BIMI also costs money for the certificate.

What this check cannot tell you

Anything that lives outside DNS. Domain and IP reputation, complaint history, bounce rates, blocklist status, message quality. A domain with flawless records goes to spam quite happily if it spent six months mailing a purchased list.

The check also does not confirm that a DKIM signature validates on an actual message: from outside only the published key is visible. Verifying the signature itself requires the raw message with its headers.

The order to fix things in

The score combines seven checks, but they do not carry equal weight, and fixing them in order matters, because each step builds on the one before.

1. MX. Without them the domain accepts no mail and nothing else matters. While you are there, confirm no records from a previous provider survived.
2. SPF. One record, inside the ten-lookup budget, ending in ~all or -all. Two v=spf1 records on a domain is a failure that breaks the check for everyone.
3. DKIM. A dedicated selector for every service that sends as you. A 2048-bit key.
4. DMARC. Start at p=none with a reporting address, the reports are what reveal whoever you missed in steps 2 and 3.
5. MTA-STS and TLS-RPT. Channel protection. These come after authentication works.
6. BIMI. The logo, which requires DMARC at quarantine or reject. Always last.

Why 100 out of 100 does not buy you the inbox

The score describes the technical configuration of the domain, meaning what is visible from outside via DNS. Providers decide using a different data set entirely: sending history for the domain and the IP, complaint rates, bounce rates, recipient behaviour, message content.

Which produces two familiar situations. One: every record is perfect and mail still lands in spam: nearly always reputation damaged by mailing a dirty list. Two: records are a mess and mail arrives fine. An old domain with good history that providers extend credit to. Configuration is a necessary condition, not a sufficient one.

What the check sees and what it cannot

All seven checks run from outside, against public DNS records. That is enough to find most breakage: missing records, syntax errors, an exhausted SPF lookup budget, a weak DKIM key, a DMARC policy that does nothing.

Some things are invisible from outside by definition. Whether a particular message is signed shows only in its headers. Whether the signing domain aligns with From — likewise. Whether some forgotten service is sending as you is revealed by DMARC reports and nothing else. Domain checks and reports complement each other; neither replaces the other.

The common case: records fine, mail in spam

A high score with mail still not arriving is almost always reputation rather than DNS. Check three things in order: how the list was built (buying or scraping kills a domain in one send), the bounce rate on recent campaigns, and whether the domain or IP has landed on a blocklist.

Dead addresses do the most damage: a provider sees a high bounce rate and concludes the sender is mailing a list they do not maintain. Which is why cleaning the list moves the needle faster than any further tuning of records.