Email deliverability test

Four things, from one input. MX: that the domain can receive mail, because replies and bounces need somewhere to land, and mail from a domain that can take nothing back looks suspect to some receivers. SPF: the full record, every include resolved, the lookup count against the limit of 10, and the errors that break SPF outright. DKIM: a probe of 15 common selectors. DMARC: the record, the policy it actually applies, and whether reports flow anywhere.

Each section links to the dedicated checker with your domain filled in, for the deep dive this summary deliberately is not. Everything runs live against DNS when the page loads, so the result URL is shareable: send it to whoever owns the DNS and they see what you see, checked fresh.

DMARC passes when either SPF or DKIM passes with a domain that aligns with your From address. Two legs, and one is enough, which is exactly why nobody notices when only one exists. A domain with no SPF record, or with SPF whose envelope domain can never align, passes DMARC every day on DKIM alone, right up until a forwarder or a middlebox rewrites the message, the signature breaks, and there is no second path.

The common version of this is not a missing record: it is a sending service whose default envelope domain is its own. Amazon SES is the textbook case. Unless you configure a custom MAIL FROM domain, the envelope points at a subdomain of amazonses.com, so SPF passes for Amazon and aligns with nothing of yours, and your DMARC rests entirely on DKIM. This test flags both versions: definitively when the SPF leg is missing, and as a question to go answer when DNS shows an SES setup whose envelope we cannot see from outside.

Three states, not a score out of 100. Healthy means everything we can check from DNS looks right. Gaps means it works today with weaknesses worth closing, listed in order of damage. At risk means something is broken enough to affect whether your mail gets delivered or whether your domain can be forged. A number would imply precision DNS cannot give; three states plus a prioritized fix list is what the evidence supports.

One honest limit, stated rather than hidden: a DNS test cannot see inbox placement, sender reputation, or content filtering, and the DKIM probe cannot see providers that use randomized selectors, Amazon SES above all. When DKIM shows as unknown here, it is excluded from the overall grade instead of dragging it down, and the fix is to check your real selector directly with the DKIM checker.