01What does this score grade?
Four families of checks — the ones mailbox providers evaluate before filing your email: authentication (SPF, DKIM, DMARC — 40 points), the reputation of your mail server's IP address on the main spam blocklists (25 points), the infrastructure (MX servers, reverse DNS and its FCrDNS consistency — 20 points) and transport encryption (MTA-STS, TLS-RPT, DANE, BIMI — 15 points).
Each category is detailed line by line with a link to the specialized tool to fix things: SPF/DKIM/DMARC diagnosis, record generator, DKIM key generator, blocklist check. Without a DKIM selector, the most common ones (google, selector1, k1…) are probed automatically.
02Understanding the criteria
- SPF
- The list of servers allowed to send on behalf of the domain. Graded on its presence, the strictness of its trailing policy (-all > ~all) and its 10-DNS-lookup budget.
- DKIM
- The cryptographic signature of your email. The public key must be published in the DNS under a selector — provided by you, otherwise detected among the most common ones.
- DMARC
- The anti-spoofing policy built on SPF and DKIM. p=reject protects best; p=none is only an observation phase.
- DNSBL
- Spam blocklists queried by mail servers. The IP tested here is your primary MX's — also test your actual sending IP if it differs.
- PTR / FCrDNS
- The server IP's reverse DNS, and its consistency (the pointed name must resolve back to the same IP). Required by most major mailbox providers.
- MTA-STS / TLS-RPT
- MTA-STS forces TLS upon servers writing to you; TLS-RPT sends you encryption-failure reports. Adopted by Gmail and Outlook.
03From the command line
The same URL as this page answers in plain text to CLI clients — handy to watch a domain after every DNS change:
$ curl "its-my-ip.com/email-audit?domain=exemple.fr" score: 82/100 (B) auth: A (36/40) reputation: A+ (25/25)
04Frequently asked questions
How is this different from the classic email check?
The email check (/email) is a diagnosis: it shows the raw detail of your MX, SPF, DKIM and DMARC records and explains each error. This score goes further and wider: it adds your server IP's reputation on blocklists, reverse DNS, MTA-STS, TLS-RPT and DANE, then distills everything into a mark out of 100 — the overview before diving into the detail.
Why test the MX's IP rather than my sending IP?
From the outside, only the MX (receiving server) is knowable through the DNS: the IP that actually sends your email is only visible in the headers of sent messages. For many self-hosted setups it is the same machine. If you send through a provider (Google Workspace, Microsoft 365, Brevo…), they manage that reputation; if you know your exact sending IP, test it directly on our blocklist page.
DKIM shows “not found” even though I have a key. Why?
Without a selector, we probe the eight most common ones (google, selector1, selector2, k1, s1, dkim, default, mail). If your key lives under another selector — many providers generate a random one — it escapes the probe. Fill in the exact selector in the dedicated field: you can read it in the DKIM-Signature header (the s= value) of an email you sent yourself.
My email goes through fine, yet my score is average. Should I worry?
Deliverability degrades silently: nothing breaks the day DMARC is missing or your IP gets listed — your messages simply drift towards some recipients' spam folders. Since 2024, Gmail and Yahoo massively reject senders without SPF/DKIM, and DMARC becomes mandatory at volume. A high score is a safety margin before the problem becomes visible.
What do MTA-STS and TLS-RPT bring?
By default, encryption between mail servers is opportunistic: an attacker in an interception position can strip it (downgrade). MTA-STS publishes a policy that forces TLS upon servers writing to you; TLS-RPT gets you reports whenever encryption fails. DANE goes even further via DNSSEC but remains rare — hence its low weight here.
Does a score of 100 guarantee reaching the inbox?
No: it guarantees that your technical setup is not working against you. Placement also depends on the domain's reputation (history, complaints, recipient engagement) and on message content. But the converse is certain: with shaky authentication or a listed IP, even the best content ends up in spam.
05More tools
My IP & network — BGP / RPKI · Subnet · Port check
DNS & domains — DNS lookup · DNS propagation · Whois · Punycode / IDN
Web & SEO — Page audit · HTTP headers · Security headers · Link preview · Robots.txt tester · TLS certificates · Redirects · Site down? · User agent
Privacy & passwords — WebRTC leak · Passwords · Password leak
Dev & encoding — JWT decoder · Unix timestamp · Cron expressions · Base64 · MD5/SHA digests · UUID generator