Email Deliverability Checker
Check SPF, DKIM, and DMARC readiness for inbox placement. Enter values for instant results with step-by-step formulas.
Formula
Security Score = SPF(30) + DKIM(30) + DMARC(40)
We weight the three pillars of email authentication. DMARC 'Reject' policy carries the most weight as it is the only mechanism that actively blocks fraudulent emails. SPF and DKIM are prerequisites for DMARC.
Worked Examples
Example 1: Full Protection
Problem:SPF: -all, DKIM: Yes, DMARC: Reject
Solution:Score 100/100. Domain is fully secured against spoofing.
Result:100/100 (Secure)
Example 2: Monitoring Only
Problem:SPF: ~all, DKIM: Yes, DMARC: None
Solution:Score 60/100. Good for visibility, but attackers can still spoof you.
Result:60/100 (Monitoring)
Example 3: Vulnerable
Problem:SPF: None, DKIM: No, DMARC: None
Solution:Score 0/100. Emails likely to land in spam; domain reputation at risk.
Result:0/100 (Vulnerable)
Frequently Asked Questions
Will 'p=reject' block my own emails?
Yes, if you haven't authorized all your senders (like Mailchimp, Salesforce, etc.) in your SPF/DKIM setup. Always start with 'p=none' to audit your traffic first.
What is the Google/Yahoo 2024 requirement?
As of Feb 2024, Google and Yahoo require bulk senders to have SPF + DKIM + DMARC set up, or emails will be rejected.
Background & Theory
How Authentication Works
Think of it like a passport check:
- SPF: "Is this person on the guest list?" (IP Check)
- DKIM: "Is the wax seal on the envelope unbroken?" (Signature Check)
- DMARC: "If the guest list OR seal fails, guard, throw them out." (Policy)
The Journey to 'Reject'
- Phase 1: Audit (p=none): Turn on monitoring. See who is sending as you. Identify unauthorized tools or spammers.
- Phase 2: Enforce (p=quarantine): Send failing emails to spam. Good for testing.
- Phase 3: Secure (p=reject): Block failing emails entirely. This is the gold standard.
Why Deliverability Improves
When you protect your domain, ISPs (Gmail, Outlook) trust you more. High trust = Inbox placement. Low trust = Spam folder.
History
The Wild West of Email (1982-2000s)
SMTP, the protocol for email, was built with no security. Anyone could send an email claiming to be "president@whitehouse.gov". As spam and phishing exploded, verifyng identity became crucial.
The Rise of Standards
SPF (2000s) tried to verify IPs. DKIM (2004) tried to verify content integrity. But neither told the receiver what to do if validation failed.
DMARC: The Enforcer (2012)
PayPal, Google, and others created DMARC to give domain owners control. It turned email authentication from a "nice to have" into a policy enforcement tool. In 2024, Gmail and Yahoo mandated these standards for bulk senders, effectively retiring the era of unauthenticated email.
Common Misconceptions
- Myth: "SPF is enough." Reality: SPF breaks when emails are forwarded. You need DKIM too.
- Myth: "DMARC is set-and-forget." Reality: You need to monitor reports to ensure you don't block legitimate tools (like your HR system).