Free deliverability scan

Is your domain
set up to send?

Enter your work email address and we'll read your domain's mail records the way a receiving server does. You get a verdict on this page in about 30 seconds. In most cases we also email that address a link to the full report, where you can see the exact DNS records to add or change.

A scan takes up to 30 seconds. Press the button once and keep this tab open.

The link to the fixes goes by email so that only someone who reads mail at that address sees them. If someone else types in your address, the link comes to you, not to them.

What the scan checks

  1. Mail provider

    Your MX records and the provider they point to, such as Google Workspace or Microsoft 365. A domain with no MX record can't receive replies.

  2. SPF

    Whether you publish exactly one SPF record and how many DNS lookups it needs. SPF allows 10, and past that receivers treat the record as broken. We warn from 8.

  3. DKIM

    Whether your provider's DKIM key is published, so receivers can confirm a message was signed by your domain and not altered on the way. We check your provider's standard selectors.

  4. DMARC

    Whether you have exactly one valid DMARC record and whether it asks for reports with rua=.

  5. Sending setup

    Whether your DNS suggests campaigns go out from a subdomain such as send.yourcompany.com, so a bad send doesn't hurt the domain your team writes from.

  6. Domain age

    When the domain was registered. We warn when it's under 90 days old, because mailbox providers distrust new domains.

Questions

What does the scan look at?
Public DNS records for the domain in your email address (MX, SPF, DKIM and DMARC, and the records that show how you send) and the domain's registration date from the public registry (RDAP). It doesn't send test mail and doesn't need access to your mailbox or your DNS host.
Why does it need my email address and not just a domain?
The link to the report with the records to fix goes to that address. Sending it there means the person who reads the fixes is someone at the company, not anyone who typed your domain into a form.
Why can't I scan a Gmail or Outlook.com address?
Those domains belong to Google and Microsoft, and their records are already set up correctly. The scan is for a domain you own, so enter the address you use for work.
What do the verdicts mean?
Ready to send means nothing we checked failed and there's at most one real warning; notes like "couldn't check" don't count. Needs work means at least one check failed, or two or more gave a warning. At risk means SPF or DMARC failed and at least one other check failed too.
Does it check blocklists?
No. Blocklist feeds cost money for commercial use, and IP lists rarely apply to Google Workspace or Microsoft 365 senders. The scan checks your DNS setup and your domain's age.
What happens after I scan?
You see the verdict and each check's result on this site. The report email links to a page on semaos.io where you can reveal the exact records to add. Ticking the box agrees to a few short emails on fixing what the scan found, and each one has an unsubscribe link. Leave it unticked and the report email is the only one you get. Either way we keep your email address and scan result; see our privacy policy.
Is it free?
Yes. You don't need an account or a card. SEMAOS sells sales engagement software to small teams, and a domain that fails these checks has the same problem whichever tool it sends with.