Full email authentication check

What the scan covers

• SPF parsed and expanded against RFC 7208, with the ten-lookup budget counted the way a receiving server counts it.
• DMARC parsed against RFC 9989, including the DNS Tree Walk that replaced the Public Suffix List, and detection of the tags RFC 9989 removed.
• DKIM discovered from your detected providers' documented selectors, reported as not determined rather than as a failure where DNS cannot settle it.
• Mail routing from MX, with the inbound provider reported separately from the systems authorised to send as you. Those are different questions and conflating them is a common error.
• Transport security: MTA-STS, TLS-RPT, DNSSEC and CAA, as secondary signals.
• Provider readiness against the published Gmail, Yahoo and Outlook.com requirements.

Configuration health, and what it is not

The score is a transparent subtraction. Each category starts at a budget, each finding takes its published points off, and you can open the arithmetic and see which rule caused which deduction. It measures how your published configuration compares with the standards and the providers' stated requirements.

It is not a prediction of inbox placement, and it is not presented as one. Mailbox providers decide placement using reputation, recipient behaviour and complaint data that no external tool can read. A domain can score 100 here and still have mail filtered, because the score measures configuration and filtering measures behaviour.

Where a domain scan runs out

Four things matter for the large providers that no DNS lookup can establish: which IPs your mail leaves from, your spam-complaint rate, whether your messages carry one-click unsubscribe headers, and whether your messages are actually signed. All four are properties of your sending, not of your domain, and all four are reported as not determined here until you supply a message.