Test your domain's email deliverability

Why are emails going to spam? Run a deliverability audit

Every email sent goes through a series of DNS checks before reaching the inbox. If a single record is missing or misconfigured, your messages may land in spam - or be silently rejected by recipient servers. This is why you need an email spam test before sending campaigns.

This online email deliverability test (also called "DMARC checker", "SPF lookup tool", "DKIM validator", "domain health check", or "inbox placement test") lets you check your domain email configuration and identify errors to fix to improve your deliverability. The audit analyzes 8 protocols organized into 3 pillars:

Sending (outbound):

Receiving (inbound):

Three main use cases:

• Before an email campaign → Validate that your domain is ready to send
• After deliverability issues → Identify which configuration is failing
• After a platform change → Verify that new DKIM selectors are published

How to use the deliverability audit in 3 steps

Step 1: Enter your domain

Type your sending domain (captaindns.com). If you send through multiple platforms (Mailchimp, Brevo, Google Workspace), add the corresponding DKIM selectors for a complete check.

Where to find your DKIM selectors:

• Mailchimp: k1 (settings → domain → authentication)
• Brevo: mail (settings → senders → DKIM)
• Google Workspace: google (Admin Console → Apps → Gmail → Authentication)
• Microsoft 365: selector1, selector2 (Admin → Domains → DNS records)

Step 2: Run the analysis

The tool automatically queries your DNS records:

Sending:

• ✅ SPF: Syntax, 10 lookup limit, -all mechanism
• ✅ DKIM: Valid selectors, key ≥2048 bits
• ✅ DMARC: Policy, reports configured
• ✅ BIMI: Valid record, accessible logo

Receiving:

• ✅ MX: Presence, resolution, redundancy
• ✅ MTA-STS: DNS record, HTTPS policy, enforce/testing mode
• ✅ DANE: TLSA records per MX, DNSSEC validation
• ✅ TLS-RPT: Valid record, report destinations configured

Step 3: Review the results

You get:

• Overall score out of 100 with deliverability badge (Excellent, Good, Fair, Poor)
• Protocol-by-protocol diagnostics with pass/fail status
• Corrective actions ranked by priority
• JSON export to share with your technical team

How does the deliverability score work?

The overall score out of 100 is calculated from 3 weighted pillars:

Each pillar is scored out of 100 points, then weighted accordingly. The result gives an overall score and grade:

• Excellent (90-100%): All protocols are correctly configured
• Good (75-89%): Solid configuration with some optimizations possible
• Fair (55-74%): Errors or warnings impacting deliverability
• Poor (<55%): Major blockers, sending compromised

Points breakdown by pillar

Sending (100 points):

Receiving (100 points):

DNS security (100 points):

Common errors detected by the audit

SPF: too many DNS lookups (permerror)

SPF is limited to 10 DNS lookups. Beyond that, resolvers return permerror and ignore your policy. The audit counts your lookups and flags overages.

Symptom: Low SPF score despite having a record

Diagnosis:

• Number of lookups = 12 ❌
• Nested include: detected

Action: Replace include: directives with direct IP ranges or use our SPF Flattener to automatically flatten your record.

DKIM: selector not found

Each sending platform uses a different DKIM selector. If the selector isn't published in your DNS, DKIM signing fails consistently.

Symptom: DKIM fails even though you configured it

Diagnosis:

• Selector k1._domainkey.yourdomain.com = ❌ NXDOMAIN
• Key not found

Action: Get the correct selector from your ESP and publish the corresponding TXT record.

DMARC: policy too permissive

A p=none policy offers no protection against impersonation. Email providers won't block unauthenticated emails.

Symptom: DMARC present but no active protection

Diagnosis:

• Policy = p=none ⚠️
• Reports = not configured

Action: Gradually move to p=quarantine then p=reject while monitoring DMARC reports (rua).

MX: missing or invalid record

Without an MX record, your domain cannot receive emails. Some filters also consider a domain without MX as not legitimate for sending.

Symptom: MX score at 0

Diagnosis:

• MX = ❌ No record found

Action: Publish at least one valid MX, or a null MX (0 .) if the domain isn't meant to receive emails.

How to improve your domain's email deliverability?

Here are priority actions to improve your deliverability, ranked by impact:

Sending:

Receiving:

Tip: Use this tool regularly (before each campaign, after ESP changes) to detect issues before they impact your sends.

Real-world use cases

Issue 1: Marketing campaign with 80% in spam

Symptom: You send a newsletter via Mailchimp, but most of it lands in spam.

Audit diagnosis:

• MX = ✅ Pass
• SPF = ❌ Fail → 14 lookups (limit exceeded)
• DKIM = ❌ Fail → Selector k1 not found
• DMARC = ⚠️ p=none

Priority actions:

1. Flatten SPF to get under 10 lookups
2. Publish Mailchimp's DKIM CNAME
3. Move DMARC to p=quarantine

Issue 2: B2B emails rejected by Microsoft 365

Symptom: Your business emails are rejected by clients using Outlook/Microsoft 365.

Audit diagnosis:

• SPF = ✅ Pass
• DKIM = ✅ Pass
• DMARC = ❌ Fail → Policy p=reject but alignment failed

Priority actions:

1. Verify that the From domain matches the DKIM domain (strict alignment)
2. Configure aspf=r and adkim=r for relaxed alignment

Issue 3: Migration to Google Workspace

Symptom: After migrating to Google Workspace, emails land in spam.

Audit diagnosis:

• SPF = ⚠️ Warning → include:_spf.google.com missing
• DKIM = ❌ Fail → Selector google not published

Priority actions:

1. Add include:_spf.google.com to SPF
2. Generate and publish DKIM key from Admin Console

FAQ - Frequently asked questions

Q: What exactly does the deliverability audit check?

A: The audit analyzes 8 protocols organized into 3 pillars:

Sending: SPF (authorized servers), DKIM (cryptographic signature), DMARC (authentication policy), BIMI (brand logo)

Receiving: MX (receiving servers), MTA-STS (forced TLS encryption), DANE (certificate authentication via DNSSEC), TLS-RPT (TLS failure reports)

DNS security: DNSSEC (DNS zone signing)

Q: How does the deliverability score work?

A: The score out of 100 combines 3 weighted pillars:

• Sending (50%): SPF (30 pts), DKIM (25 pts), DMARC (40 pts), BIMI (5 pts)
• Receiving (35%): MX (40 pts), MTA-STS (30 pts), DANE (15 pts), TLS-RPT (15 pts)
• DNS security (15%): DNSSEC (100 pts)

Each pillar is scored out of 100, then weighted. A score above 90% indicates optimal configuration.

Q: Why does my SPF show "too many lookups"?

A: SPF is limited to 10 DNS lookups (RFC 7208). Each include:, a:, mx:, or redirect= counts as a lookup. If you use multiple ESPs (Mailchimp + Brevo + Google), you can easily exceed this limit.

Solution: Use our SPF Flattener to resolve includes into direct IPs.

Q: How do I add a DKIM selector?

A: Each ESP uses a different selector:

• Mailchimp: k1
• Brevo: mail
• Google Workspace: google
• Microsoft 365: selector1, selector2

Add the selector to the audit form to verify it's correctly published.

Q: What DMARC policy should I use?

A: Recommended progression:

1. p=none: Monitor without action (start)
2. p=quarantine: Send suspicious emails to spam
3. p=reject: Reject unauthenticated emails (maximum protection)

Always configure reports (rua) to track authentication failures.

Q: Is the audit free?

A: Yes, the deliverability audit is 100% free with no registration required. Enter your domain and get results immediately.

Q: Is my data stored?

A: The audit only queries your domain's public DNS records. This information is accessible to anyone via standard DNS queries. We don't store your data.

Complementary tools

Useful resources

• RFC 7208 - SPF (official SPF specification)
• RFC 6376 - DKIM (official DKIM specification)
• RFC 7489 - DMARC (official DMARC specification)
• RFC 8461 - MTA-STS (SMTP MTA Strict Transport Security)
• RFC 8460 - TLS-RPT (SMTP TLS Reporting)
• RFC 6698 - DANE (DNS-Based Authentication of Named Entities)
• Google - Email Authentication (Gmail guide)
• Microsoft - Email Authentication (Microsoft 365 guide)