Domain DNS audit for deliverability
Enter a domain — we check everything spam filters read from DNS before they even see the message body.
What the audit checks
SPF — syntax, DNS lookup count (limit 10 — above it the record is invalid), the all mechanism, dead includes. DKIM — we look for keys under the 50 most common selectors (Google, Microsoft, Postmark, SES, Mailgun, SendGrid…) and estimate key length. DMARC — policy, rua, pct, alignment. MX — hosts resolve and have valid PTR. MTA-STS, TLS-RPT, BIMI — optional but trust-building. Domain blocklists — Spamhaus DBL, SURBL, URIBL.
Reading the score
100 points split by weight: DMARC 25, SPF 20, MX 15, DKIM 15, blocklists 15, MTA-STS/TLS-RPT/BIMI 10. A fail zeroes the weight, a warn halves it. Under each item there is a concrete recommendation — often a ready TXT record.
The “Compliance” block states whether the domain meets Google/Yahoo bulk-sender requirements (SPF or DKIM + DMARC) and Microsoft's (hard reject 5.7.515 without DMARC since May 2025).
FAQ
The DNS audit says OK but mail still goes to spam — why?
DNS is only a prerequisite. IP reputation, content, a missing PTR on the sending host or broken DKIM alignment show up only when testing a real message. Send a test email.
DKIM not found although it is configured — what now?
Your selector is unusual. Call /api/v1/domain/{domain}?selector=yourselector or send a test email — we read the selector from the real message.