Email deliverability audit

Live DNS reads of SPF, DMARC, MX, and DKIM records from your domain.

Find out why your mail lands in spam: we read your public SPF, DMARC, MX, and DKIM records and send back the exact record changes to publish.

Run free DNS check

The method reads public DNS records only, without sending test mail or querying blocklists; inbox placement and sender reputation are not measured.

The current benchmark set is 2 real sending domains, both run by us first.

A scored summary and the top findings by email
One real fix, like moving an SPF soft-fail ~all to -all

How it works

SPF soft-fail found

We read the live TXT record and flag a soft-fail ~all qualifier, with the exact -all change to publish.

DMARC policy read

A p=none policy is reported as the finding it is, with the stricter p=quarantine value shown in the fix list.

MX presence checked

We confirm a mail-handling MX record exists and include an absent-MX finding in the report when the domain has none.

DKIM probe limited

We probe common selector names only, so a not-found result is limited to the selector names checked.

What your report looks like

This is a real probe from our benchmark: our own sending domain, metabus.ca, checked on 2026-08-17. We ran it on ourselves first. The record changes it lists are in progress on our own DNS now.

Composite score

66.7/100

Needs attention: 3 of the 4 record checks surfaced a finding.

MEDIUM SPF record present but not fully enforcing
A soft-fail qualifier tells receiving servers to accept suspect mail and merely mark it. Spam filters learn your domain's reputation from that gray traffic, and you find out when replies stop coming.
Measured: v=spf1 include:_spf.google.com ~all
The fix: Tighten your SPF record's trailing "all" mechanism to a hard fail ("-all") once you've confirmed every legitimate sending source is listed -- "~all" (soft-fail), "?all" (neutral), or no qualifier at all leave room for spoofed mail to still be accepted.
MEDIUM DMARC policy not enforcing (p=none or p=quarantine)
A p=none policy asks receiving servers to report spoofed mail and deliver it anyway. Anyone can send as your domain while your own invoices and quotes compete with that traffic for inbox placement.
Measured: v=DMARC1; p=none; rua=mailto:jason@metabus.ca
The fix: Move your DMARC policy toward "p=reject" once aggregate reports (rua) confirm no legitimate mail is failing alignment -- "p=none" only monitors and takes no protective action against spoofed mail sent as your domain.
MEDIUM DKIM signing not found under common selectors
Major mailbox providers now require authenticated mail from bulk senders, and an unverifiable signature starts every delivery at a disadvantage. Publishing the selector record your provider already supports is usually a one-afternoon fix.
Measured: not found under common selectors (checked: default, google, k1, s1, s2, selector1, selector2)
The fix: Confirm DKIM signing is enabled with your mail provider and publish the resulting selector's TXT record. Our probe only checks common selector names (default/google/k1/s1/s2/selector1/selector2), so this is not proof DKIM is absent -- only that it wasn't found under those names. Ask your provider for your actual selector to verify directly.

Every check here is a read-only DNS lookup of the domain's public records; you can verify each record yourself with dig or nslookup.

The free check gives you this same shape for your own domain: the score plus what the probe found, delivered by email. The $150.00 CAD full report covers all four checks in detail with the exact record changes to publish. Monitoring at $29.00 CAD / month re-probes your domain and flags what changed since your last report.

Run free DNS check