What this test checks
Four DNS records decide whether your e-mails reach the inbox or the spam folder. This test reads them the way recipients' mail systems do:
- MX: your receiving servers exist and have an IP address. Without them, replies and reports get lost.
- SPF: the list of servers allowed to send on your behalf, its syntax, its final mechanism (-all, ~all, ?all, +all) and the number of DNS lookups it requires (limit: 10).
- DKIM: the public key used to verify the signature of your e-mails, its size and state, for the common selectors or the one you enter.
- DMARC: the policy applied when SPF and DKIM fail (none, quarantine, reject), the report addresses, the enforcement percentage and the subdomain case.
Every point is translated into plain language, with the fix to apply. We do not consider the reputation of your IP addresses or the content of your messages: those are other topics.
SEOForge methodology v1 (September 2026)
The score is the weighted average of four dimensions scored out of 100. Weights and thresholds are published here and applied as-is.
| Dimension | Weight | Why |
|---|---|---|
| Receiving (MX) | 20 | Without a receiving server, replies and DMARC reports never arrive. |
| SPF | 30 | The first check mail systems run: who may send for this domain. |
| DKIM | 20 | The signature that survives forwarding and mailing lists; the basis of DMARC alignment. |
| DMARC | 30 | The only real protection against spoofing, and the source of the reports. |
Scoring per dimension
- MX: 100 when the declared servers resolve, 60 when some do not, 20 when none does, 0 without MX. An explicit Null MX scores 100 with an information note.
- SPF: 100 with -all or ~all; 60 without "all"; 50 with ?all; 10 with +all; 0 without a record or with several. Invalid syntax: capped at 20. More than 10 DNS lookups: capped at 30; 8 lookups or more: -10; includes without SPF: -10.
- DKIM: 100 for a key of 2048 bits or more (or Ed25519); 80 between 1024 and 2048 bits; 30 under 1024 bits; 20 when every key found is revoked. No selector found: dimension not evaluated, weight redistributed.
- DMARC: 100 for p=reject, 80 for quarantine, 50 for none; 10 when the record is invalid; 0 when missing or duplicated. No rua: -15; pct below 100: -10.
- A subdomain without DMARC inherits the record of its parent domain (one level), as RFC 7489 provides.
Why DKIM can be "not evaluated"
A DKIM key lives at <selector>._domainkey.<domain>, and only your provider knows the selector. We query the 17 most common selectors:
default, google, selector1, selector2, k1, k2, mail, dkim, s1, s2, ovh, mandrill, pm, smtp, brevo, sendgrid, amazonses
Grades
A from 90, B from 80, C from 65, D from 50, F below.
What this test does not measure
- The reputation of your IP addresses and domain at the large mail providers (blocklists, sending history).
- The actual alignment of your e-mails: it is verified on sent messages, not in DNS. DMARC reports reveal it.
- The content of your messages (trigger words, links, images) and the configuration of your sending tools.
- BIMI, MTA-STS and TLS-RPT records, useful but secondary until SPF, DKIM and DMARC are in place.
This free test vs the business e-mail service
The test observes; the service sets up, adjusts and monitors, in your console and with your sending tools.
| Free test | Business e-mail - from €290 excl. VAT | |
|---|---|---|
| SPF | Reading, syntax, final mechanism, DNS lookups | Inventory of your senders (mail, CRM, newsletter, website) and a single record covering them all under the limit |
| DKIM | Common selectors or the one you enter | Keys generated and published for every sending tool, rotation, alignment with the sending domain |
| DMARC | Policy, reports, pct, subdomains | Set up at p=none, reports read, moved to quarantine then reject without breaking a legitimate sender |
| Receiving | MX and resolution | Mailbox migration or creation on Microsoft 365 or OVH, aliases, signatures, mobile |
| Follow-up | Snapshot at test time | DMARC report monitoring and an alert when a new sender appears |
Discover the domain name and business e-mail service
Frequently asked questions
What exactly does this test check?
Your domain's public DNS records used to authenticate your e-mails: MX (receiving), SPF (authorised senders, syntax, final mechanism, number of DNS lookups), DKIM (public key for the common selectors or the one you enter) and DMARC (policy, reports, percentage, subdomains). No e-mail is sent and nothing is changed.
Does "DKIM not detected" mean I have no DKIM?
No. A DKIM key is published under a selector chosen by your provider, and we cannot guess it. We test the most common selectors; if none answers, we say so, without counting DKIM in the score. Enter your selector (visible in the DKIM-Signature header of a sent e-mail, after "s=") and run the test again.
Why do my e-mails land in spam despite a good score?
The score measures the DNS configuration, not reputation or content. A brand-new domain, a poorly rated shared IP address, bulk sending or a message that looks like spam can be enough. SPF, DKIM and DMARC are the prerequisite: without them, nothing else works durably.
Which DMARC policy should I choose?
Start with p=none and a rua address to receive the reports, list all your legitimate senders and align them (SPF and DKIM), then move to p=quarantine and finally p=reject. Jumping straight to reject without this step often blocks legitimate sending (website, CRM, invoicing).
What do you keep from a test?
The tested domain name, the date, the score, the per-dimension scores and the codes of the points found, the test duration and, for 30 days, a truncated, irreversible fingerprint of your IP address to detect abuse. The DNS records read are displayed but not stored. This data serves to run and improve the tool and is deleted after 24 months. If you request the report by e-mail, the test is attached to your request.
Unsure about a fix? Write to us, the first answer is free.