Find out why your email lands in spam.
Gmail, Outlook and Yahoo decide whether to trust you before they read a single word — by checking three DNS records. Inboxproof reads those records the same way they do, and hands you the exact line to publish.
- p=noneMonitors only. Receivers are told to take no action against mail forged in your name.
- pct=20Even that non-policy is applied to a fifth of your mail. The rest is unevaluated.
- no rua=No reporting address, so nothing tells you who is already sending as this domain.
The rules changed. Most domains did not.
In February 2024 Google and Yahoo began requiring SPF, DKIM and DMARC from every sender above roughly 5,000 messages a day. Microsoft followed at Outlook.com in May 2025. Mail that cannot prove who sent it is no longer sorted into spam — increasingly it is refused at the door.
The failure is invisible from your side. Your provider reports the message as sent. Nobody bounces. The revenue simply does not arrive.
The most common DMARC policy in the wild. It publishes a valid record, satisfies a checklist, and instructs receivers to take no action whatsoever against mail forged in your name.
A hard protocol limit, counted across every nested include:. Cross it and the record does not degrade — it becomes a permanent error and receivers discard it entirely.
DNS has no changelog and no alert. A record edited on Tuesday is a deliverability collapse discovered in next month's pipeline review.
Six records, one hundred points.
Weighted the way receiving servers actually weigh them, not evenly. Each check returns the published record, what it means, and the line to change.
The policy receivers actually obey
We read your policy, your reporting address and your coverage percentage. A record sitting at p=none looks configured and enforces nothing — the most common false sense of safety in email.
Including the 10-lookup ceiling
SPF fails permanently past ten DNS lookups, and every include: you add drags its own nested lookups with it. We resolve the whole tree and count them, which is how a record that looks fine turns out to be dead.
Across 36 provider selectors
Your signing key lives at a selector only your provider knows. We probe the selectors used by Google, Microsoft, SendGrid, Mailchimp and thirty others, then check the key length.
MTA-STS and TLS reporting
MTA-STS tells receiving servers to refuse delivery over an unencrypted or untrusted connection instead of quietly downgrading. TLS reporting is how you find out when that starts failing.
Routing and provider fingerprint
Where your mail is delivered, who runs it, and whether the domain can receive the DMARC reports you asked to be sent.
Your logo in the inbox
Puts your brand mark beside your mail in Gmail and Apple Mail. It requires DMARC at quarantine or stricter first, so it doubles as proof your authentication is real.
Scan, fix, then never think about it again.
- 01
Scan
Type a domain. In about three seconds you get a score, a grade, and the raw record behind every check — no account, no credit card.
- 02
Fix
Each failing check comes with the specific record to publish, written for your setup rather than a generic template. Copy it into DNS and rescan.
- 03
Hold
Add the domain to monitoring. We re-check daily and email you the moment a record changes, breaks, or drifts out of compliance.
Scanning is free. Watching costs money.
The audit stays free forever, because a one-time answer is worth less than knowing the day it changes.
For checking a domain right now.
- Unlimited manual scans
- Full record-level breakdown
- Copy-paste fixes for every failure
- 1 saved domain with scan history
- Shareable report links
For a company that sends email that matters.
- 10 monitored domains
- Daily automatic re-scans
- Email alerts on any record change
- Full scan history and diffs
- PDF audit reports
- Priority support
For anyone answerable for other people's domains.
- 50 monitored domains
- White-label client reports
- Team seats
- Scan API access
- Bulk domain import
- Slack and webhook alerts
What people ask first.
Do you need access to my email account?
No. Every check runs against public DNS records — the same records any receiving mail server reads. We never ask for mailbox access, credentials, or an API key from your provider.
What does the score actually measure?
How completely your domain proves its own identity to a receiving server. DMARC carries 35 points because it is the record Google, Yahoo and Microsoft check first; SPF and DKIM carry 25 each because DMARC cannot pass without one of them aligned. The remaining 15 cover routing and transport hardening.
Why monitor if I already fixed everything?
Because DNS drifts. A new marketing tool gets added to SPF and pushes it past the lookup limit. Someone rotates a DKIM key and forgets to publish the new one. A registrar migration drops a TXT record. None of it announces itself — you find out from a customer who never got the invoice.
Can I audit domains I do not own?
Yes. DNS is public, so you can scan any domain — that is exactly how agencies use this on a prospect before a pitch, and how security teams check a partner before trusting their mail.
How is this different from a one-off checker?
A checker tells you today's state and forgets you. Inboxproof records every scan, so you get history, a diff when something changes, and an alert the day it breaks rather than the quarter after.
It takes three seconds
to find out.
Scan your domain, or one you are about to pitch. No account required.