Email Deliverability

What it does

The Email Deliverability tool tells you how a real inbox will treat mail sent from your systems. Rather than inspecting DNS records in isolation, it scores an actual message: you send mail from the system you want to test to a private address DNS Watchdog gives you, and each message you send becomes a scored test with a full per-check breakdown.

This catches problems that a records-only check cannot — a broken DKIM signature, a sending IP on a blocklist, a message that trips spam filters, or a missing List-Unsubscribe header — because it inspects the message exactly as it arrived.

Your test address

Each organisation gets one stable inbound address, shown at the top of the page with a copy button:

<your-org>@inbound.dnswatchdog.io

The address is fixed and tied to your organisation — it does not rotate and there is no per-test address to generate. Send from as many different systems as you like; every message that arrives is scored independently.

Send a message from the system you want to test — your marketing platform, transactional mail provider, CRM, or your own mail server — and within a few moments it appears in the Inbox tab as a new test.

Reading the results

The tool has two tabs:

• Inbox — every message received, newest first, each with its overall score. You can filter by state and sort by score or receipt time.
• Sending systems — the same tests grouped by the sending domain, so you can see how each system you send from performs over time.

Click any test to open its detail page, which shows the overall score, every individual check with its verdict and evidence, the recommended remediation, a parsed view of the message, and the raw .eml source.

Test states

The checks

Each message is graded against ten checks. Every check contributes to the overall score by its weight, so the checks that most affect real deliverability count for more:

A few checks are worth understanding in detail:

• DKIM is verified cryptographically, not taken on trust. This matters because some legitimate third-party signers (for example Google Workspace's *.gappssmtp.com) produce an inconclusive receive-time verdict even when their signature is valid; DNS Watchdog verifies the signature directly and only falls back to the receive-time verdict when it cannot.
• SpamAssassin scoring flags a message as a failure at a score of 5.0 or above, passes it below 2.0, and warns in between. The evidence lists the rules the message hit, most impactful first, and the remediation names the top scoring rules to address.
• Message size warns above roughly 100 KB, the point at which Gmail begins clipping message content.
• Link and image reachability probes the http(s) URLs in the message (bounded to the first 20) through an SSRF-safe fetcher.

How the score is calculated

The overall score is on a fixed 0.0–10.0 scale, rounded to one decimal place. Each check earns its full weight on a pass, half its weight on a warning, and nothing on a failure. Checks that do not apply to a message — for example reverse DNS when no sending IP was observed — are excluded entirely, so they can never lower your score. A message that passes every applicable check scores exactly 10.0.

Recommended fixes

Where a failed or warned check comes down to a missing or incomplete DNS record, the test detail page shows the exact record to add at your DNS provider. The recommendations are deliberately conservative and cover SPF and DMARC:

• For SPF, it infers your sending system from the message's DKIM signing domain and suggests the matching include: mechanism (for example include:_spf.google.com for Google, include:spf.protection.outlook.com for Microsoft 365, include:amazonses.com for Amazon SES), falling back to the observed sending IP. If you already publish an SPF record, it suggests inserting the mechanism before your terminal all term and leaving everything else untouched.
• For DMARC, when no record exists it suggests publishing v=DMARC1; p=quarantine; rua=mailto:dmarc@<your-domain>. Quarantine is the deliberate default — a p=none policy is treated as weak.

DNS Watchdog never changes your DNS — you add the suggested record at your provider yourself, then re-send a test message to confirm the check now passes.

Limits and retention

What it does not check

The Email Deliverability tool scores a delivered message. It does not check inbound mail-transport policies such as MTA-STS or TLS-RPT. MTA-STS is validated separately by the scanner as part of your zone's TXT records — see Invalid MTA-STS Record. For the DNS-record view of your email authentication posture, see the email authentication issues under Issues and the email security summary on the Zones page.

Prerequisites

• Connect a DNS provider so DNS Watchdog knows your domains — when the sending domain matches one of your zones, its recommended records are tailored to that domain.