Why is my email going to spam, and what do I paste where?
Type a domain. You get a grade in plain English, weighted by what the domain actually sends, every record we saw, and the exact record to paste at GoDaddy, Cloudflare, Namecheap, Squarespace or wherever your DNS lives.
We look up public DNS only. Nothing is stored unless you create a shareable snapshot.
What a report looks like
Examplenorthwind-bakery.example
Nothing tells receivers to stop mail that pretends to be this domain, and nobody sends it reports. SPF and DKIM are in place; DMARC is missing. The fix is one TXT record in monitor-only mode.
Example built on a reserved .example name (RFC 2606), not a real domain.
What’s checked
usually a few seconds- SPFInclude tree, 10-lookup limitEvery nested include resolved live, cost per row, void lookups (RFC 7208).
- DMARCGraded against RFC 9989Policy found by the DNS tree walk, t= testing, np=, legacy pct= and report destinations.
- DKIMCommon selectors probedGoogle, Microsoft 365, Zoho, Proton, Fastmail and more, or type your own. Key type and size.
- MXWho runs your mailProvider detected from MX, so the fix is written for it.
- MTA-STS · TLS-RPTEncrypted delivery to youPolicy file fetched over HTTPS and matched against your MX hosts.
- CertificateExpiry on your websiteDays left, issuer, and whether browsers trust it.
- RegistrationRDAP expiry and locksRegistrar, renewal date and EPP status codes explained.
- DNSSEC · CAA · BIMIShown, not scoredUseful extras, never counted against you.
How the grade works
100 minus these points| Check | When | Points |
|---|---|---|
| SPF | No SPF record | −20 |
| SPF | PermError (two records, over 10 lookups, syntax, missing include) | −25 |
| SPF | +all (authorises every server) | −30 |
| SPF | ?all, no all, or ptr | −6 / −4 / −2 |
| DKIM | No key at the common selectors we probe | −10 |
| DKIM | RSA key under 1024 bits / exactly 1024 bits | −15 / −3 |
| SPF + DKIM | Neither works (Gmail requires one of them from every sender) | −15, grade capped at D |
| DMARC | No usable record, by your answer: more than 5,000 a day / not sure / no | −35 / −22 / −14 |
| DMARC | p=none / p=quarantine with t=y / p=quarantine (p=reject: 0) | −8 / −5 / −2 |
| DMARC | No rua (no reports) / external rua not authorised (RFC 9990 §4) | −4 / −3 |
| TLS certificate | Expired / untrusted or wrong name / under 7, 14, 30 days | −20 / −12 / −10, −6, −2 |
| Registration | Expired or on hold / under 7 days / under 30 days | −30 / −15 / −6 |
| MTA-STS, TLS-RPT | Published but broken (missing ones cost nothing) | −4 / −1 |
| BIMI, DNSSEC, CAA | Shown, never scored | 0 |
A is 90 or more, B 75, C 55, D below. DMARC weighs more if you send over 5,000 emails a day to Gmail, because Gmail and Outlook.com require it from bulk senders and only recommend it below that (Google, Microsoft, both checked 5 Oct 2026).
Authentication is necessary but not sufficient: content, reputation and engagement also decide inbox placement, so a grade is never a delivery guarantee.