Email Deliverability Checker — SPF, DKIM, DMARC, MX, BIMI, MTA-STS

Check hundreds of domains in one run and get one row per domain with a 0–100 deliverability score, a letter grade, and a plain-English list of what to fix.

What it checks

• MX: mail servers, priority, null MX (RFC 7505), A-record fallback, MX hosts that don't resolve, detected email provider (Google Workspace, Microsoft 365, Zoho, Proofpoint, Mimecast, Fastmail, Proton, Yahoo …)
• SPF: parses the record, counts DNS lookups recursively against the 10-lookup limit, void lookups, broken includes, multiple SPF records, +all / ?all / ~all / -all (follows redirect=), deprecated ptr, invalid terms
• DMARC: policy p=, sp=, pct=, alignment, whether rua/ruf reporting is set (reporting domains only — addresses are redacted), fallback to the organizational domain
• DKIM: tries common selectors (default, google, selector1, selector2, k1, s1, s2, mail, dkim) plus any you add; reports key type, RSA key size and revoked keys
• BIMI: record, logo URL, whether a VMC certificate is referenced
• MTA-STS: DNS record and the policy file (mode: enforce / testing / none); TLS-RPT record
• Blocklists: mail-server IPs checked on public IP blocklists whose terms allow automated lookups (SpamCop, PSBL)

Who it's for

• Cold-email & outbound teams auditing sending domains before a campaign
• Agencies / MSPs auditing client portfolios for spoofing risk and Gmail/Yahoo bulk-sender requirements
• Lead-gen: find companies with p=none or no DMARC, sorted by score

Input

{ "domains": ["example.com", "https://www.shop.example.com"], "extraDkimSelectors": ["mandrill"], "checkBlocklists": true,
  "maxConcurrency": 10, "timeoutSecs": 20 }

URLs are reduced to the hostname, a leading www. is removed, duplicates are removed. Invalid or non-existent domains are returned with error and not charged.

Output (one item per domain)

domain, deliverabilityScore, grade, issuesCount, issues[], emailProvider, acceptsMail, nullMx, mxRecords[], spfRecord, spfAll, spfLookups, spfVoidLookups, spfIncludes[], spfBrokenIncludes[], spfValid, dmarcRecord, dmarcPolicy, dmarcSubdomainPolicy, dmarcPct, dmarcHasRua, dmarcRuaDomains[], dmarcSource, dkimFound, dkimSelectorsFound[], dkimKeys[{selector, keyType, keyBits, revoked}], bimiRecord, bimiLogoUrl, bimiHasVmc, mtaStsRecord, mtaStsMode, tlsRptRecord, mxIps[], blocklistListings[], checkedAt

Example issues: "SPF needs 13 DNS lookups (limit 10) — SPF fails (permerror) at many receivers", "DMARC policy is p=none (monitor only) — spoofed mail is still delivered".

How it works

Only public DNS lookups plus one HTTPS request to the public MTA-STS policy file (mta-sts.<domain>/.well-known/mta-sts.txt). No browser, no proxies, no SMTP connections, no mailbox probing. About 30 domains in 10 seconds. It reads public technical records only and does not collect personal data: mailto: addresses inside DMARC/TLS-RPT records are redacted.

Pricing

Pay per result: one charge per domain actually checked. Invalid and non-existent domains are free.

Limitations

• DKIM: selectors can't be listed via DNS. "No DKIM found" means none of the tried selectors exist — add your provider's selector (e.g. Google uses dated selectors like 20230601) in Extra DKIM selectors.
• Domain blocklists (Spamhaus DBL, SURBL, URIBL) are not checked — their free tiers forbid commercial use. Only the mail-server IPs are checked, on SpamCop and PSBL.
• The score is a heuristic based on public configuration, not a guarantee of inbox placement (sender reputation and content also matter).