What this checks, and what it does not
Four records decide whether a receiving server is willing to consider your mail at all. This reads all four from public DNS and scores them.
| Record | What it does | What a bad result costs you |
|---|---|---|
| MX | Routes mail to the domain | No MX means the domain cannot receive replies, and receivers treat that as a signal in itself |
| SPF | Lists which servers may send for the domain | Missing or permissive SPF means receivers cannot verify you, which is one of the fastest routes to the spam folder |
| DKIM | Cryptographically signs your mail | Without it, a receiver cannot confirm the message was not altered in transit |
| DMARC | Tells inboxes what to do with unauthenticated mail | Google and Yahoo have required it from bulk senders since February 2024, and Microsoft followed in May 2025 |
What it cannot see. Authentication makes you eligible for the inbox. It does not put you there. Warmup state, sending volume, list quality, complaint rate and the copy itself all sit outside DNS, and any of them will bury a perfectly authenticated domain.
How to read your score
Four out of four means the plumbing is right and everything that happens next is about how you send. Three means one gap is quietly costing you placement. Two or lower means cold sending from this domain now will damage its reputation, and reputation recovers slowly.
The most common result I see is three out of four, with DMARC sitting at p=none. That is monitoring rather than enforcement. It is a reasonable place to start and a bad place to stay.
The order to fix things in
- SPF first. One record, ending in -all. Watch the ten lookup limit: too many include statements and SPF silently stops evaluating, which looks identical to having no SPF.
- DKIM next. Your provider generates the key and gives you the record. It is usually the easiest of the four.
- DMARC at p=none. Publish it and read the reports for a couple of weeks to find anything legitimate that fails alignment.
- Then enforce. Move to p=quarantine, and to p=reject once nothing legitimate is failing.
I wrote the longer version of this in the cold email deliverability guide, including the parts that DNS cannot tell you.
Do not do any of this on your main domain
Whatever this tool tells you about the domain you run your business on, the answer for cold email is the same: do not send from it. Use separate sending domains, warmed for around two weeks before they carry real volume, so a campaign that goes wrong cannot touch the domain your invoices and support mail come from.
That separation is the single most valuable decision in a cold email setup, and it is the one most teams skip because it feels like extra work at the start. It is the difference between a bad month and a burnt domain. The warmup guide covers how long it actually takes.
Frequently asked
What does this deliverability checker actually test?
Four public DNS records: MX, which shows whether the domain can receive mail; SPF, which tells receivers which servers may send for the domain; DKIM, the cryptographic signature on your mail; and DMARC, the policy telling inboxes what to do with unauthenticated mail. These four decide whether you are even eligible for the inbox. They do not decide everything.
Is my domain emailed or stored anywhere?
No. The check runs entirely in your browser and reads public DNS records through Google's public resolver. No mail is sent to the domain, nothing is written to a database, and there is no signup.
It says no DKIM but I know we have it. Why?
DKIM keys live at a selector name that the sender chooses, and there is no way to enumerate them from outside. The checker tries about twenty of the most common selectors used by Google, Microsoft, Zoho, SendGrid, Amazon SES and others. If yours is custom, it will not be found. Confirm with your email provider before assuming it is missing.
I scored four out of four. Will my cold email land?
Authentication makes you eligible for the inbox rather than guaranteed to reach it. After this, placement is decided by list quality, how fast you ramp volume, complaint rates and what you actually write. A clean four out of four sending to a bad list still ends up in spam.
Should I be sending cold email from my main domain at all?
No. Use separate sending domains, warmed for around two weeks before they carry volume, so a bad campaign can never damage the domain your invoices and support email come from. That separation is the single most valuable thing in a cold email setup.