Email Deliverability Check

5 MX record(s) found.

MX records define where email for your domain is delivered. Without them, no mail can be received. Multiple MX records with different priorities provide automatic failover. An RFC 7505 Null MX (priority 0, host “.”) is detected and shown here — it explicitly declares the domain does not accept email.

SPF uses ~all (soft fail). Consider upgrading to -all.

SPF lists which IP addresses are authorised to send email as your domain. A hard fail (-all) is strongest — receivers reject anything not on the list outright.

v=spf1 include:_spf.google.com ~all

DKIM records found for selector(s): google. Provider: Google Workspace.

DKIM adds a cryptographic signature to every outgoing message. Receiving servers use your public key (published in DNS) to verify the message hasn't been altered in transit.

google._domainkey Google Workspace RSA  1024-bit ⚠ collapse

Tag	Value	Status	Notes & Guidance
v=	DKIM1	✓
k=	rsa	✓
p=	MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCSYE2OjxFNy7pT…	✓

DMARC policy is quarantine. Consider upgrading to reject.

DMARC ties SPF and DKIM together with an enforcement policy. p=reject is the gold standard — it instructs receivers to block unauthenticated mail entirely and protects your domain from spoofing.

v=DMARC1; p=quarantine; pct=100; rua=mailto:dmarc@signal.org

DMARC reporting configured. Aggregate (rua): mailto:dmarc@signal.org.

DMARC can send you daily XML reports (rua=) about which servers are sending mail as your domain and whether they pass authentication. Forensic reports (ruf=) include individual failure samples. Without these you are flying blind.

Tip: Add ruf=mailto:forensic@yourdomain.com to receive individual failure samples for investigation.

MTA-STS is configured.

MTA-STS forces other mail servers to use TLS encryption when delivering to you, blocking downgrade attacks that would expose messages in transit. It works together with TLSRPT for visibility.

v=STSv1;id=20260327162351;

TLSRPT is configured.

When TLS negotiation fails during inbound delivery, TLSRPT sends you a structured JSON report. This lets you detect misconfigured sending servers or active downgrade attacks targeting your MTA-STS policy.

v=TLSRPTv1;rua=mailto:smtp-tls-reports@signal.org;

No BIMI record. BIMI enables brand logo display in supporting email clients.

BIMI lets you display your verified brand logo in supporting inboxes (Gmail, Apple Mail, Yahoo). It requires DMARC with quarantine or reject, and an SVG logo hosted at a published URL.

All MX server IPs have valid PTR records with forward-confirmed reverse DNS (FCrDNS).

Checks that each MX server IP has a PTR record and that the PTR hostname forward-resolves back to the same IP (FCrDNS). Most spam filters require FCrDNS to pass — a missing or non-confirming PTR raises the spam score of your outbound mail.

Listed on: 2a00:1450:4001:c21::1b on dnsbl.spfbl.net.

Checks whether your MX server IPs (IPv4 and IPv6) appear on major spam blocklists (Spamhaus, SpamCop, Barracuda, SORBS, and others). A single listing can cause severe delivery failures at major providers.