Checking email deliverability means looking up a small set of DNS records and reputation signals, then reading what each one tells you. You do not need to send a test email to a friend and hope for the best: the receiving mailbox makes its decision from these public records, so you can read the same signals it reads. Here is the order to check them, and what a good or bad result actually means.
Start with the MX records. If a domain has no MX record, or points to a server that does not exist, email to that domain bounces before authentication is even considered. The MX record checker looks up the MX records, resolves each mail server to its IP, and checks reverse DNS so you can see the full delivery path. A missing or broken MX is the most basic failure: fix it before anything else.
The SPF record is a list of the servers allowed to send email as your domain. Two things matter: it must include every service that sends for you (your ESP, your CRM, your transactional provider), and it should end in -all so anything not on the list is rejected. A common mistake is an SPF record that exceeds the 10-DNS-lookup limit, which makes the whole record fail. The SPF checker shows the exact record, counts the lookups, and flags the -all issue. If you are not sure what the record should say, the SPF generator writes it for you.
DKIM adds a cryptographic signature to each email so the receiver can verify it came from your domain and was not altered in transit. The check is: does the DKIM selector you publish in DNS actually have a key, and is that key strong enough? A weak or missing key means the signature fails and the email is treated as untrusted. The DKIM checker finds your key, checks its length, and flags weak or missing keys. If your DKIM is not signing at all, the DKIM not signing guide covers the usual causes.
DMARC ties SPF and DKIM together and tells receivers what to do with mail that fails both. Most domains start at p=none (report only) and move to p=quarantine or p=reject as they gain confidence. The DMARC checker shows your policy and alignment, and the DMARC record guide explains which policy to start with. If you are getting weekly DMARC reports you cannot make sense of, the DMARC report parser turns them into a who-is-sending-as-you list.
Even with perfect records, a single blocklist hit on your sending IP will sink you. Check the IP against the major lists. The IP blacklist checker tests it against nine major lists and, for the big ones like Spamhaus, the delisting guide walks through the exact request. If you are not sure whether it is the IP or the domain causing the problem, the blocklist checker covers both.
Modern mailboxes check that your mail server presents a valid TLS certificate. An expired or misconfigured certificate is a quiet deliverability killer. The TLS checker verifies the certificate on your mail server and flags anything that would make a receiver distrust the connection.
Doing these lookups one by one is slow and easy to get wrong. The free deliverability checker runs all seven checks in one pass, scores the domain, and points at the exact record to fix first. That is the fastest way to answer the question: will this email reach the inbox, and if not, what is the first thing to fix?
Want this checked automatically every day? Inboxproof Pro monitors your domain around the clock and alerts you the moment a record breaks or an IP gets listed. See pricing →