Email deliverability
checker.

The essentials, read live from the domain's DNS: MX records (can it receive mail?), SPF (which servers may send for it), DMARC (the anti-spoofing policy), and a DKIM probe across common selectors. These four make up the setup score. It then checks BIMI and, for domains that receive mail, MTA-STS and TLS-RPT, each with a pass, warning or problem and the reason.

They are the three records that protect a domain from email spoofing. SPF lists authorised sending servers, DKIM cryptographically signs messages, and DMARC tells receivers what to do when a message fails SPF or DKIM. Together they decide whether your mail lands in the inbox or the spam folder, and whether attackers can impersonate you.

DKIM records live under a selector you choose (like 'google' or 'selector1'), and selectors cannot be listed from DNS. The tool probes the most common ones, but if you use a custom selector it will not be detected. That is a soft warning, not a failure.

It means DMARC is in monitor-only mode: you get reports but receivers take no action on spoofed mail. It is a fine first step, but moving to 'quarantine' then 'reject' is what actually stops impersonation once you have confirmed legitimate senders pass.

BIMI shows your logo next to your mail in inboxes such as Gmail, Apple Mail and Yahoo. The checker reads the default._bimi record, the logo address (it must be an https:// link to an SVG Tiny PS file), and whether a Verified Mark Certificate or Common Mark Certificate is listed, which Gmail and Apple Mail need. It also checks your DMARC policy: logos are only shown when DMARC is at quarantine or reject for all of your mail.

MTA-STS tells other mail servers to deliver mail to you only over an encrypted connection to the servers you list. The checker reads the _mta-sts record, then fetches the policy file from https://mta-sts.<your domain>/.well-known/mta-sts.txt and checks its mode (enforce, testing or none), that every MX record is covered by its mx lines, and its max_age. TLS-RPT (the _smtp._tls record) asks senders to email you daily reports when encrypted delivery fails, which is how you spot problems before switching MTA-STS to enforce.

Both are optional extras on top of the essentials, so the score stays based on MX, SPF, DMARC and DKIM. A warning on BIMI or MTA-STS is a suggestion, not a fault.

Every active domain that sends email needs these records, and they are easy to forget on the dozens of domains in a portfolio. Track your domains in Lemon Domains so you know which ones are live and worth hardening.