What the score measures
Every mailbox provider runs the same opening interrogation on an incoming message: does SPF authorize the sending server, does a DKIM signature verify, does DMARC align either of them with the From domain, and does the infrastructure behind the domain look like a real mail operation. This check runs that interrogation from the outside — the same composite DNS audit we publish as a standalone tool — and converts the findings into one number you can track over time.
The weights follow what receivers actually punish:
- SPF — 20 points, plus 5 for hygiene. A valid record earns the base; the bonus 5 require exactly one record within the 10-DNS-lookup limit, because duplicates and lookup overruns are permerrors that make receivers ignore SPF entirely.
- DKIM — 15 points, or excluded. The check probes selectors used by major platforms. A hit earns full points. A miss is treated as inconclusive and removed from the calculation — custom selectors are normal, and a scoring model that punished them would be guessing.
- DMARC — up to 30 points across three components. Publishing a record (15), enforcing it at quarantine or reject (10), and collecting aggregate reports via rua (5). The split mirrors the real rollout path: publish, observe, enforce.
- MX — 15 points. Records that exist and resolve. An intentional null MX (RFC 7505) also earns full points — declaring "no mail here" is a valid configuration, silently receiving none is not.
- Reverse DNS — 10 points. Forward-confirmed reverse DNS on the MX hosts' IPs, scored proportionally when only some pass.
- BIMI — up to 5 bonus points. Bonus tier only: it can raise a score, never lower one, because a logo record is cosmetic rather than authentication.
A setup score, not an inbox placement test
The naming is deliberate, and it is the part of this tool we care most about getting right. Plenty of pages call a DNS check a "deliverability test" and let you conclude that a green result means the inbox. It does not. Inbox placement is measured by actually sending: seed-list tools (the GlockApps class) deliver test messages to real mailboxes at each provider and record where they land — inbox, Promotions, spam, or missing. Our own platform benchmark works the same way, by sending through each service and counting placements; the protocol is documented in how we test.
This tool sends nothing, so it can honestly claim only what DNS can show: whether receivers are able to authenticate your mail. That is the floor of deliverability. A domain scoring 95 here can still hit spam through a burned IP, a stale list, or content problems — and a domain scoring 40 will struggle no matter how good its content is, because unauthenticated mail is discounted before anyone reads it.
Reading your result
The breakdown table shows each component, the points it earned, and why. Below it, the findings repeat as a worklist grouped critical → warning → passing, each with a recommendation and a link to the dedicated checker for the drill-down. Fix criticals in the order listed: MX first if mail is being lost, then SPF and DKIM, then DMARC on top of them. Moving DMARC to p=reject before SPF and DKIM align is the one sequence that makes things worse.
Two components can show as excluded rather than failed. A DKIM probe that finds no key on common selectors proves nothing about a domain signing with a custom selector, and a domain with no MX has no host IPs to reverse-DNS check. In both cases the component leaves the denominator entirely, so the score reflects verified facts instead of guesses. The exclusion is stated in the table when it happens.
When to re-run it
Scores drift. A new ESP adds an include to your SPF record and pushes it over the lookup limit; a DNS migration drops the DMARC record nobody remembered was there; a new marketing tool starts sending as your domain without a signature. Re-run the score after every infrastructure change and every new sending service, and treat a drop as an incident rather than a curiosity — the receivers noticed before you did.
If your score is healthy and mail still misbehaves, the problem lives above DNS. The deliverability troubleshooter walks from your symptom — spam folder, silent loss, bounces, a blocklist — to ranked probable causes. And for choosing infrastructure that starts you off well, our platform rankings measure how the major sending services actually place mail.
Frequently asked questions
Is this an email deliverability test or a setup score?
A setup score. It audits the DNS configuration receivers use to authenticate your mail — SPF, DKIM, DMARC, MX, reverse DNS, BIMI — and maps the findings onto a weighted 0–100 scale. It does not send any mail, so it cannot measure inbox placement. Tools that do measure placement send messages to seed mailboxes at each provider and report where they landed; that is a different instrument answering a different question.
How is the score calculated?
Eight weighted components: a valid SPF record (20 points), SPF hygiene — single record within the 10-lookup limit (5), DKIM found on probed selectors (15), a DMARC record (15), DMARC at quarantine or reject (10), DMARC aggregate reporting via rua (5), sane MX records (15), and forward-confirmed reverse DNS on the MX hosts (10). BIMI adds up to 5 bonus points on top, capped at 100. The score is the weighted share of points earned, renormalized when a component is inconclusive.
Why was DKIM excluded from my score?
DKIM keys live under a selector name chosen by whoever sends your mail, and selectors cannot be enumerated from outside. The check probes 16 selectors major platforms use. Finding one proves DKIM exists and earns the points; finding none proves nothing — many well-run domains use custom selectors. Rather than punish an unknowable, the DKIM weight is removed from the denominator, so your score reflects only what the check could actually verify.
What do the score bands mean?
90 and above is excellent — the authentication stack is in place and enforced. 70–89 is good: the foundations pass but something is loose, typically DMARC still at p=none. 50–69 needs work — a major layer is missing or broken. Below 50 is poor: receivers cannot properly authenticate the domain, and every message is discounted for it before content is even considered.
My score is high but mail still lands in spam. Why?
Because configuration is the floor, not the ceiling. A high setup score means receivers can authenticate your mail; it says nothing about your sending reputation, list quality, complaint rates, or content — the factors that decide placement once authentication passes. Work through those with the deliverability troubleshooter, and check your sending IP and domain against blocklists.