Check a domain
How it works
Paste the domains
One per line. The domain must be the one in your From: address — that is where Gmail looks.
Optionally paste headers
Open a message you actually sent, view the original source, and paste it. That unlocks the unsubscribe and receiver-verdict checks.
DNS is read live
SPF is expanded and counted, DKIM keys are hunted across common selectors, DMARC and PTR are read over DNS-over-HTTPS.
Fix in order
Blocking failures first, then the review items. Re-run after each DNS change once it has propagated.
The rules, in plain terms
Since February 2024 Google and Yahoo apply a shared set of requirements to anyone sending significant volume into their mailboxes. Google's threshold is roughly 5,000 messages a day to Gmail addresses; Yahoo has no published number and applies the rules to any sender it classifies as bulk. Miss one and the response is graduated — first temporary failures with a 5.7.26 or 4.7.28 code, then outright rejection.
The requirements are: SPF and DKIM both configured on the sending domain; a DMARC record published (a p=none policy is enough to pass); the From: domain aligned with either SPF or DKIM; valid forward and reverse DNS on every sending IP; TLS on the connection; a spam rate under 0.10% in Postmaster Tools and never above 0.30%; and, for marketing or subscribed mail, one-click unsubscribe headers with removal honoured within two days.
What this tool can and cannot see
Everything published in DNS is checked directly. SPF is expanded recursively and the lookup count is compared against the limit of ten, because a record over the limit fails silently for every message. DKIM keys are found by trying the selectors used by the mail provider your MX records point at, then a list of common third-party selectors. DMARC is read and its policy interpreted. Reverse DNS is checked on the MX hosts as a stand-in for your sending IPs, which the browser cannot know.
Three things live outside DNS. Alignment and the receiver's real verdict are in the headers of a delivered message, which is why the tool accepts pasted headers and reads Authentication-Results and List-Unsubscribe from them. Spam rate lives only in Google Postmaster Tools. TLS is a property of the connection and is handled for you by any reputable provider.
The failures I see most on audits
DKIM on the provider's domain, not yours. A sending tool signs with its own domain and the check shows dkim=pass, but the signing domain does not match your From: domain, so DMARC fails alignment. Gmail counts that as unauthenticated. The fix is a custom DKIM record on your own domain, which every serious ESP supports.
SPF over ten lookups. A record that was fine in January picks up an include from a new CRM in April and a helpdesk in June. Nothing warns you. The flattener or a cleanup of stale includes gets you back under.
One-click unsubscribe half done. A mailto: in List-Unsubscribe without the https URL and the List-Unsubscribe-Post header does not satisfy Gmail. Both headers, https, and a POST endpoint that removes the address without a confirmation page.
Cold email and the bulk rules
One-to-one cold email from individual mailboxes sits below the volume threshold per domain by design, which is the whole reason fleets are built from many small domains. The authentication rules still apply because they are what reputation is built on, and a domain that fails them is throttled long before it reaches 5,000 a day. Unsubscribe headers are not required on personal correspondence, but including a plain opt-out line in the body costs nothing and reduces complaints, which is the metric that actually kills domains.
Frequently asked questions
What counts as a bulk sender for Gmail?
Google's guidance says roughly 5,000 or more messages a day to personal Gmail accounts, measured on the primary domain including all subdomains. Once a domain crosses that line the requirements apply permanently, even if volume later drops.
Is p=none enough for the DMARC requirement?
Yes. Google and Yahoo require a DMARC record to exist with a valid policy; p=none satisfies that. It enforces nothing, though, so the record is a floor rather than a destination. Move to quarantine and then reject once your aggregate reports show only legitimate sources.
Why does the tool check PTR on MX hosts rather than my sending IPs?
A browser cannot know which IPs send your mail. MX hosts are shown because on Google Workspace and Microsoft 365 the same infrastructure sends and receives, and both publish correct PTR records. If you send through a dedicated IP or your own MTA, check its reverse DNS with the PTR lookup tool.
Do I need one-click unsubscribe on cold email?
Not under the published rules, which target marketing and subscribed mail. Adding List-Unsubscribe headers to individual outreach can look odd to recipients and some sending tools do it badly. A clear opt-out sentence in the body is the better choice for one-to-one mail.
What error does Gmail return when a requirement fails?
Typically 550 5.7.26 for authentication failures, 421 4.7.28 or 550 5.7.28 for rate limiting on unauthenticated or high-complaint mail, and 550 5.7.1 for policy rejections. The exact text names the failing check.
How quickly do fixes take effect?
DNS changes are visible to receivers within the record's TTL, usually an hour. Reputation-based throttling lifts more slowly — expect a few days of clean sending before limits relax.
Last reviewed
What to run next
The checks that most often follow this one.
More in this category
Guides that go deeper
When the tools tell you something is wrong
The diagnostics here are free and always will be. When the fix is bigger than a DNS record, this is the work I do.
Deliverability rescue
Mail landing in spam, replies gone quiet, or a domain suddenly blocked. I find the actual cause rather than guessing, and fix it.
- Authentication and alignment failures
- Blocklist delistings and reputation repair
- Gateway and filter-level blocks
- A written report on what broke and why
Email & sending infrastructure
Sending domains, inboxes, authentication and warmup, built to survive volume instead of burning down in a month.
- Domain and inbox fleets at any scale
- SPF, DKIM, DMARC and tracking domains
- Google Workspace and Microsoft 365 inboxes
- Handover documentation you actually own
Domain, DNS & migration
Changing registrar, mail provider or host without a day of downtime or a week of mail silently failing.
- Registrar and nameserver moves
- Workspace and Microsoft 365 migrations
- MX, SSL and subdomain cutover
- Staged rollout with rollback at every step
Monitoring & retainer
Infrastructure drifts. Records get edited, certificates expire, domains get listed. Ongoing eyes on the fleet.
- Scheduled checks across every domain
- Alerts before your clients notice
- Monthly reporting
- Priority response when something breaks
Start with a call
Bring a domain and the symptom. I will tell you what is actually wrong and whether you need me at all — plenty of people leave that call able to fix it themselves.
Thirty minutes, no pitch
We will run the checks together on your actual domains, and you will leave knowing what is broken, what it takes to fix, and what it should cost. If that is a job you can do in-house, I will say so.