Mail Deliverability Scanner Run a free test

Deliverability, measured

Know what thereceiving serversees.

Send one real message to a one-time address. Get back the judgement a mailbox provider reaches — authentication from the IP that actually connected, reputation, content, headers — itemised, sourced, and scored out of ten.

Run a free test Check DNS without sending

No signup. No card. The first test costs nothing.

One message. Five inspections. What is left is the score.

Built against

The specifications, not a blog post about them

Every authentication verdict traces to a published standard, and the report cites the clause it applied. Where a specification leaves something to the receiver, we say so rather than inventing a ruling.

  • RFC 7208 SPF Including the ten-lookup limit, counted recursively.
  • RFC 6376 DKIM Signature verified over the body we received.
  • RFC 7489 DMARC Policy, alignment and reporting authorisation.
  • RFC 8461 MTA-STS Policy fetched and parsed, not just resolved.
  • RFC 8460 TLS-RPT Reporting endpoint validated.

No invented statistics. Every figure on this page is read out of the code that produces the report.

The gap

Your records look fine.Your mail still lands in spam.

Reading a DNS record tells you what you published. It cannot tell you what happened when your server opened a connection and handed over a message. Those are different questions, and only one of them is the one a filter answers.

A single inspection plate with nothing passing through itOne upright glass plate in a machined shoe, standing alone. There is no bench, no message and no beam of light — nothing is being measured.

What a record checker sees

A policy, read out of a zone file. Nothing is passing through it.

Sending IP
Not observed
DKIM
A key is published
SPF
Syntax is valid
Filter rules
Not evaluated
Verdict
Looks good
A message crossing five inspection plates on a measuring benchA sealed envelope enters a machined bench at the left and a beam of light carries it through five upright glass plates set along a rail. The beam is brightest as it enters and dimmer after every plate it crosses. What is left at the far end is the score.

What the receiving server decides

A message, judged on arrival, by every plate it has to cross.

Sending IP
The one that connected
DKIM
Signature checked over this body
SPF
Evaluated for that IP, lookups counted
Filter rules
Every rule that fired, with its weight
Verdict
A score, with its arithmetic

We test the second question. You send a real message from the sender you care about, and we report what a receiver would have concluded — including the parts a zone file cannot show.

Capabilities

Four things it settles that a record cannot

01

Authentication, from the IP that actually connected

Catches the failures a record checker cannot see.

SPF is a policy about sending addresses and DKIM is a signature over a real body. Neither can be settled without a message. We evaluate both against the connection we received, then check whether either aligns with the domain in your From header — which is the part DMARC cares about.

  • SPF alignment & policy
  • DKIM signature validation
  • DMARC policy & alignment
  • Reverse DNS (PTR)
  • Forward-confirmed rDNS
  • HELO / EHLO hostname

02

Reputation, with a way back out

Finding the listing is easy. This tells you how to clear it.

We query 35 public blocklists against the IP that connected, decode each list’s return code to say why it flagged you, and link you to that list’s removal form with the address already filled in. When a list refuses our query or times out we mark it unknown — an unverifiable list is not a clean one, and reports that blur the two are how people get surprised.

  • Spamhaus ZEN
  • SpamCop
  • Barracuda
  • PSBL
  • Manitu
  • UCEPROTECT
  • SpamAssassin rule scoring

03

The parts a filter reads before a human does

The quiet marks that get a legitimate message binned.

A missing plain-text alternative, an image-heavy body with nothing to read, a dead link, an absent Message-ID: none of these is dramatic on its own, and together they are the difference between the inbox and the promotions tab. We report each one with the rule that fired.

  • Plain-text alternative
  • Text / image balance
  • Broken links
  • Message-ID
  • Date & From headers
  • List-Unsubscribe
  • Precedence

04

A score you can argue with

Ten out of ten, minus exactly what you can see.

The score starts at 10 and every problem subtracts from it, weighted by how much it actually costs you at a real mailbox provider. Each deduction is shown with its size and its reason, so the number is arithmetic rather than a black box — and so a fix can be proved to have moved it.

  • Per-check deductions
  • Weighted by real-world impact
  • Shareable permalink
  • Designed PDF on paid plans
A message on a machined bench, carried by a beam of violet light through five upright glass inspection plates. The beam is bright where it enters and faint where it leaves.

Every capability above is one plate on the bench. The score is what the light still carries when it reaches the end.

Interactive

Watch the score do its arithmetic

This is the deduction model the report runs. Toggle a finding to see what it costs — and what clearing it would give back. Every weight here is the weight the real scorer applies.

Deliverability score

5.5/10

At risk

Placement will vary by provider and by day.

A 10/10 means the message gives filters nothing obvious to object to. Placement also depends on your sending history, list quality and recipient engagement — none of which one message can show.

  • Twelve DNS lookups after recursive expansion. Evaluation stops with a permanent error, so SPF fails for every message — with a record that reads perfectly.

  • A selector is published in DNS but this message carried no DKIM-Signature header. The key is there; nothing is using it.

  • Monitoring only. Nothing is enforced yet, and a receiver has no instruction for what to do when alignment fails.

  • The connecting address has no PTR record. Several large providers treat a missing PTR as a strong bulk signal on its own.

  • Listed on a single public list of the 35 queried. The report decodes the return code and links you to that list’s removal form.

  • HTML-only. Filters read the text part first, and a message that offers none gives them nothing to weigh in your favour.

  • Bulk senders are now expected to offer one-click unsubscribe. Its absence is a documented requirement failure at the largest providers.

How it runs

Three steps, about a minute

Three stations on one bench: an empty mount, a message in transit, and a readingA machined rail carries a beam past three stations — an empty mount where the one-time address is issued, the message itself in transit, and a graduated scale at the far end where the verdict is read off.
  1. 01

    Generate an address

    We mint a one-time inbox. Nothing to sign up for, nothing to install, no list to upload.

  2. 02

    Send it a real message

    From the sender you actually care about — your app, your CRM, your mail server. Any subject and body works.

  3. 03

    Read the verdict

    We parse what arrived and score it out of ten, with every check itemised, evidenced and explained.

What it finds

Four failures that look like nothing

Every one of these passes a casual inspection. Every one of them is silently costing delivery right now at somebody reading this page.

SPF

The record is perfect. SPF fails for everything.

Ten DNS lookups is a hard ceiling, and every include: pulls in whatever its own record includes. Past ten, evaluation stops with a permanent error.

CostSPF fails on 100% of mail

We expand the record recursively and report the real total, naming which include contributed what — so you can flatten the one that is costing you six lookups instead of guessing.

DKIM

The key is published. Nothing is signing with it.

The selector resolves, the public key is valid, the DNS looks immaculate — and the messages going out carry no DKIM-Signature header at all.

CostDMARC fails whenever SPF does

Because we verify the signature over a message we actually received, a published-but-unused key is caught immediately. A DNS-only check cannot tell the two apart.

DMARC

A correct DMARC record that produces no reports.

Reports are addressed to a mailbox on another domain, and that domain never published the record authorising it to receive them. Every report is silently dropped.

CostZero visibility, indefinitely

We check the external reporting authorisation as part of the DMARC verdict, and hand back the exact record the reporting domain has to publish.

Reputation

Listed, delisted, listed again by Friday.

An IP gets removed from a blocklist while the traffic that got it listed is still going out. Most lists simply re-add it.

CostA weekly cycle that never ends

The report decodes the list’s return code to say why you were flagged and whether removal is self-service, reviewed, or automatic — so the cause gets fixed before the form gets filed.

Stop guessing atthe spam folder.

One message. About fifteen seconds. Every reason, in writing.

Run a free test Read the guides