Email deliverability score
Grade a domain’s whole email setup out of 100, see the points behind every check, and copy the records that fix what’s missing.
By using these tools you accept the Terms and the Privacy page.
How the deliverability score works
The deliverability score reads a domain’s public mail records in one pass and grades the whole setup out of 100. It is for anyone who sends email from their own domain and wants one ordered list of what to fix, instead of running each record check on its own.
What happens when you score a domain
zerobounce.ai’s server makes every lookup, through Cloudflare’s DNS-over-HTTPS resolver with Google’s as a fallback. It asks for the TXT, MX, DMARC, MTA-STS, TLS-RPT and BIMI records at once, together with the same 60 DKIM selectors the DKIM checker tries. Then it follows up: the SPF includes, to count lookups; the parent domains, when the domain has no DMARC record of its own; the first five mail servers by preference, with their addresses, reverse DNS and TLSA records; and the registration date, from the registry’s RDAP server or its WHOIS when RDAP isn’t available.
Each follow-up starts as soon as the answer it depends on arrives, so a slow DKIM selector doesn’t hold up the rest. The MTA-STS policy file is fetched over HTTPS only, with no redirects followed, and has to arrive within 6 seconds and 64 KB. The whole check stops after 12 seconds: anything still missing then is shown as “couldn’t check” and left out of the score. DNSSEC counts as signed when the validating resolver sets the AD bit on the answers.
Reading the grade and the fix list
The grade follows the share of available points earned: A from 90, B from 80, C from 70, D from 55 and F below that. Domain age counts too: a domain registered less than 30 days ago earns no points for it, and one under a year old earns part of them.
The fix list puts failed checks first, then sorts by the points each fix is worth. Many fixes include the exact record to publish and its host name: a starter DMARC record at p=none with a report address, an SPF record with the include already filled in for several common mail providers, recognized from your MX records, or an MTA-STS policy file in testing mode that lists your mail servers.
Domains that don’t receive mail
A domain that publishes a null MX (RFC 7505) gets no grade. The score checks only what such a domain still needs so that nobody can send as it: an SPF record of exactly v=spf1 -all and a DMARC policy of p=reject. When either is missing or different, the fix list gives the record to publish. A null MX next to real MX records is graded like any other domain, and it fails the MX check, because the two contradict each other.
Fresh results and what to check next
A score is cached at the edge for two minutes, and the result says when it comes from that cache. Check again skips that cache and runs the check again. DNS changes can take a while to show up, so check again later if a record you just published is missing. For the detail behind one record, open the SPF checker or the DMARC checker.
Updated · Maintained by Liviu Tanase
Questions
What does the score check?
MX records (including null MX, RFC 7505, and which provider handles your mail), SPF (one valid record, the all qualifier, and the 10-lookup limit counted through every nested include), DMARC (the policy receivers actually apply, found with the RFC 9989 tree walk, plus report addresses and coverage), DKIM keys at 60 common selectors with their key size, MTA-STS (the TXT record and the policy file, including whether it lists every MX host), TLS-RPT, forward-confirmed reverse DNS on the first MX addresses, DANE TLSA records, DNSSEC, BIMI and domain age.
How is the score worked out?
Each check is worth a fixed number of points, 100 in total, and every line shows its points. DMARC (27) and SPF (25) carry the most weight, then DKIM (15) and MX (10). The score is the share of available points earned. Missing SPF or DMARC holds the grade at C, and missing or broken MX holds it at D, however well the rest scores. A+ needs 95 or more with no failed check.
What does “couldn’t check” mean?
A DNS lookup or the policy download failed, timed out, or didn’t arrive within the check’s 12-second limit, so the tool doesn’t know the answer. It never reports that as missing: the check is left out of the score in both directions, the result isn’t cached, and Check again retries it right away. If a core check (MX, SPF or DMARC) couldn’t run, no grade is given.
What is a good email deliverability score?
A or A+, that is 90 or more. A+ needs 95 or more with no failed check. B (80 to 89) means the essentials work but there are gaps to close. C or lower means SPF, DMARC or MX is missing or broken, and the grade stays there however well the rest scores. The score rates the domain’s public DNS setup; whether mail reaches the inbox also depends on your sending IPs’ reputation, your content and how clean your list is, so check your IPs with the blacklist checker and addresses with the email address checker.
How do I improve my deliverability score?
Work down the fix list: failed checks come first, then the fixes worth the most points. Most fixes are a single DNS record, shown with its exact host name and value. Publish SPF and DMARC first (together 52 of the 100 points), turn on DKIM signing, then move DMARC from p=none to p=quarantine and p=reject once the reports show your own mail passing. MTA-STS, TLS-RPT, DNSSEC and BIMI add the last points. Score the domain again after publishing; DNS changes can take a while to show up.
What does the Gmail & Yahoo sender rules badge mean?
Gmail and Yahoo ask every sender for SPF or DKIM, and bulk senders (for Google, 5,000 or more messages a day to personal Gmail accounts) for SPF, DKIM and a DMARC policy of at least p=none. The badge checks the three parts public DNS can show: one valid SPF record within the 10-lookup limit, an RSA DKIM key of 1024 bits or more at one of the 60 common selectors (Gmail doesn’t accept an Ed25519 key on its own), and a valid DMARC record with p=none, quarantine or reject. Meets means all three are in place. Partly means SPF and DMARC are, but no RSA key was confirmed, which isn’t proof DKIM is off. Doesn’t meet means SPF or DMARC is missing or broken, or the only DKIM key is too short or broken. The rest of the rules depend on the mail you actually send, so DNS can’t show them: the From: domain aligned with SPF or DKIM, one-click unsubscribe for marketing mail, a spam rate under 0.3%, reverse DNS of your sending IPs, and TLS. Read Google’s sender guidelines and Yahoo’s best practices.
Why does it say DKIM wasn’t found when I sign my mail?
DKIM keys live at a selector name that only appears in your messages’ DKIM-Signature header (s=), and DNS has no way to list them. The score probes 60 common selectors and gives partial credit when none answers. Open a message you sent, find s= in the DKIM-Signature header, and check that selector in the DKIM checker.
Why isn’t blacklist status part of the score?
Blocklist answers depend on the sending IP, not the domain’s DNS, and many lists refuse queries from shared public resolvers. Use the blacklist checker for your sending IPs and domain.
Does scoring a domain send any email or store anything?
No. It reads public DNS records through DNS over HTTPS, fetches the public MTA-STS policy file if one is advertised, and asks the registry for the registration date. No mail is sent and the domain owner sees nothing unusual. zerobounce.ai’s own logs don’t keep the domain you enter; Cloudflare’s request logs do, as the privacy page explains.