Type your domain and see your grade in about a second.
Most teams have no idea their mail is hitting spam — until someone says "I never got that." No form to fill in first, no waiting for someone to get back to you.
Where your mail actually routes. Website-hosting mailboxes share an IP reputation with strangers — including whoever else on that server is sending spam today.
Declares which servers may send as you. Missing or wrong is the most common reason legitimate mail fails authentication.
Cryptographically signs your mail. Without it, Gmail and Outlook have no way to verify a message really came from you.
Tells receivers what to do with mail that fails the checks above. Without a policy, anyone can send email that looks like it came from you.
The emailed report adds the why it matters and the exact record to change for every finding.
Curious how your domain compares? We checked 1,685 of them — see the study.
If your email is broken, you'll see exactly how. If it's healthy, I'll tell you that too — and you'll have ruled out DNS for free.
Check my domain →MX records say which servers receive mail for your domain. If they point at your website host rather than a real mail provider, you share an IP reputation with every other site on that server — including whoever is sending spam from it today. That is the single biggest structural cause of legitimate mail landing in junk.
SPF (Sender Policy Framework) is one DNS record listing which servers are allowed to send email as you. If it is missing, receiving servers have no way to distinguish you from someone forging your address. If it exists but omits a tool you actually send through — a newsletter platform, a CRM, a booking system — that tool's mail fails authentication even though everything "looks" configured.
DKIM adds a cryptographic signature to every message so the receiver can verify it was not altered and really came from your domain. Google Workspace and Microsoft 365 can both sign your mail, but neither turns it on by default — it is a step someone has to take, and frequently nobody did.
DMARC ties the other two together and tells receivers what to do when a message fails: nothing, quarantine, or reject. Since 2024 Gmail and Yahoo require a DMARC record from anyone sending in volume. Without one you are not just unprotected against spoofing — you are non-compliant with the two biggest mailbox providers.
Authentication is necessary, not sufficient. It proves a message is genuinely from you; it does not prove people want it. Reputation — how recipients have historically treated your mail — carries at least as much weight, and it is built from complaints, bounces, deletions without reading, and how many dead addresses you send to.
So a green scorecard here means one specific thing: DNS is not your problem. That is genuinely useful, because it redirects the investigation to list quality, sending volume, or content, instead of leaving you rewriting records that were already fine.
The inverse is more common. Most domains we check fail at least one item, and for those, fixing DNS is the highest-leverage change available: it is a one-time edit that lifts every message you send from then on.
Everything here is a read of your public DNS — the same records any mail server queries before deciding what to do with your message. Nothing is sent, no mailbox is contacted, and we never ask for a password or any access to your systems. It takes about a second because it is four lookups, not a crawl.
What it cannot tell you: whether a specific mailbox exists, whether your IP is on a blocklist today, or what your reputation looks like inside Gmail. Those need either a test send or access to your sending data. If you want the written report we go further and note which of your findings matter most and the exact record to change — but the grade above is the same grade either way.
Church and ministry domains fail in a recognisable way, because they accumulate senders faster than anyone updates DNS. The weekly bulletin goes out through Mailchimp or Flocknote, giving runs through a separate platform, and the office still sends from Workspace — but the SPF record only ever authorised one of the three. The result is that the messages the congregation most needs to receive are precisely the ones failing authentication.
The second pattern is a missing or monitor-only DMARC policy, which is what makes "from the pastor" gift-card scams possible: without an enforced policy, nothing stops a stranger sending mail that appears to come from your domain. Eligible churches also get Google Workspace at no license cost through Google for Nonprofits, which makes fixing the underlying hosting cheaper than most offices expect. More on church email →