Inspect MX, SPF, DMARC, and DKIM for any domain — get a deliverability grade and concrete fixes for what's misconfigured.
Since 2024, Gmail and Yahoo enforce mandatory authentication for any sender shipping more than 5,000 messages a day. Microsoft has tightened in parallel. The practical effect: if your domain doesn't pass SPF or DKIM and doesn't publish DMARC, your invoices, password resets, and marketing emails will get filed as spam — or rejected outright. This tool reads the four DNS configurations that mailbox providers actually check, and grades them honestly.
Each layer answers a specific question:
-all for hard reject, ~all for soft fail).none (monitor only), quarantine (junk it), or reject (bounce it).We compute a 0–100 deliverability score with the following weights:
~all or -all — 25 points. +all or missing earns 0.reject = 30, quarantine = 22, none = 8, missing = 0.google, selector1, k1, etc.); finding any earns 10, more selectors earn slightly more.The DKIM probe is best-effort: if your provider uses a non-standard selector (some custom Mailgun setups), we may show "not detected" even when DKIM is correctly configured. The fix: ask your mail provider for the selector name and verify the TXT record yourself.
include: in an SPF record adds DNS lookups; the protocol caps at 10. If you include Google + Mailgun + a CRM + a marketing tool, you can hit the limit and trigger permerror. Fix: flatten with spf-flatten tools, or consolidate senders. Many companies hit this when adding their fifth SaaS sender. rua= tag works, but you lose the operational visibility — you'll never see who's sending mail claiming to be your domain. Add an aggregate reporting address (your own, or a free service like Valimail or dmarcian). p=none forever. "Monitor mode" is the right starting point — it prevents you from breaking legitimate mail. But many companies leave it there indefinitely, which is roughly equivalent to having no DMARC at all from a deliverability perspective. After 4–6 weeks of clean reports, advance to p=quarantine, then p=reject. ~all but DMARC says p=reject. The two policies disagree. Aligned senders pass; unaligned senders are softfailed by SPF but hardrejected by DMARC. This is usually intentional and correct — DMARC is the higher authority and SPF is just one input — but worth understanding. quarantine or reject with pct=100. If your marketing team is asking why your BIMI isn't showing up, the answer is almost always "advance the DMARC policy first". _spf.google.com. DKIM uses selector google by default; the key has to be enabled in the admin console after the DNS record is added.spf.protection.outlook.com. DKIM uses selector1 and selector2, both as CNAME records pointing to selectorN-yourtenant._domainkey.yourtenant.onmicrosoft.com.zoho.com; DKIM selector is zoho.mail.yourbrand.com) so the parent SPF stays clean.default._bimi. If you need BIMI verification, use BIMI Group's tool.include: for your provider, ending in ~all or -all.p=none and rua=mailto:reports@yourdomain.com. Watch reports for 2–4 weeks.p=quarantine with pct=25. Watch for 2 weeks. Increase pct to 50, 75, 100.p=reject. You're now at A.~all tells receivers "be suspicious of unauthorized senders, but probably still deliver" (softfail). -all says "reject unauthorized senders entirely" (hardfail). Most providers recommend ~all for the first month while you discover all your legitimate sending services, then graduate to -all. The downside of -all is that any legitimate sender you forgot to authorize gets bounced.dig.pct=N tells receivers to apply the policy to N% of messages and treat the remaining (100-N)% as if the policy were one notch lower. It's a ramp control. If p=quarantine; pct=25, then 25% of failing messages get junked and 75% are treated as p=none (monitor only). Use it to slowly increase enforcement without breaking legitimate mail in one day.