Most deliverability problems aren’t caused by what you send, they’re caused by how your domain is configured. A sender with clean lists and great content can still end up in spam if their SPF record is broken, their DKIM signature isn’t set up, or their DMARC policy is missing. The problem is invisible until something goes wrong.

This free email deliverability test checks your authentication setup from the outside: the same perspective a receiving mail server has when your email arrives. Enter a sending address and see whether your SPF, DKIM, and DMARC records are configured correctly and what’s failing if they’re not.

[alterable_email_deliverability_tester]

What this email deliverability test checks

Most deliverability testing tools either require you to send a test email to a seed address or focus only on content scoring. This one focuses on your domain’s authentication layer, the DNS configuration that mailbox providers check before they even look at your content.

Here’s what the test evaluates:

SPF (Sender Policy Framework): Whether your domain has a valid SPF record, whether it’s within the 10-lookup limit, and whether the syntax is correct. An SPF record that exists but is malformed is almost as bad as not having one.

DKIM (DomainKeys Identified Mail): Whether a valid DKIM public key is published for your domain’s signing selector. Note that this check confirms the DNS record exists, actual signature validation requires a live email to be sent and inspected.

DMARC: Whether a DMARC record exists, what policy it’s set to, and whether reporting addresses are configured. A p=none policy with no reporting addresses is functionally useless, you’re getting no data and enforcing nothing.

The combined score gives you a quick read on your authentication health. A passing score doesn’t guarantee inbox placement (content, sending reputation, and list hygiene all factor in), but failing authentication is one of the clearest reasons email gets blocked or filtered, and it’s fixable.

Why email deliverability testing matters more than it used to

Getting email delivered used to be relatively forgiving. Mailbox providers were lenient, authentication was loosely enforced, and even misconfigured domains could often squeak through.

That window has closed.

In early 2024, Google and Yahoo updated their requirements for bulk senders: SPF or DKIM is required, DMARC is required (at minimum p=none), and one-click unsubscribe is mandatory for certain senders. Microsoft followed with similar signals for Outlook. These aren’t spam filter preferences; they’re published requirements with real enforcement behind them.

We’ve seen companies discover they had a broken SPF record only after their open rates dropped 40% in a week. The fix took 15 minutes. The recovery took months. Testing your authentication setup regularly isn’t paranoia, it’s maintenance.

Understanding your results

SPF pass: Your domain has a valid SPF record, and the sending IP is authorized. This is the baseline.

SPF softfail or fail: Either your SPF record doesn’t include the sending source, or the record has syntax errors. Check that every platform sending email on your behalf has an include: entry in your SPF record. Use our free SPF record generator to rebuild the record correctly.

DKIM pass: A valid DKIM public key is published for the selector being checked. If you’re using an ESP, confirm you’ve completed the DKIM setup in both their platform and your DNS, it typically involves adding a CNAME or TXT record at a specific subdomain.

DKIM not found: The DKIM record for the checked selector doesn’t exist in DNS. If you recently set up DKIM, allow up to 48 hours for propagation. If it’s been longer, check that the record was added to the correct subdomain.

DMARC pass: A valid DMARC record exists. Check the policy level; if it’s p=none, your authentication is technically in place but not enforcing anything. A p=reject or p=quarantine policy provides real protection.

DMARC missing: No DMARC record exists at _dmarc.yourdomain.com. This is one of the most common gaps we see. Use our free DMARC record generator to create one.

How email authentication affects deliverability

SPF, DKIM, and DMARC are sometimes described as separate checks, but mailbox providers evaluate them as a system. Here’s roughly how that works in practice:

When an email arrives, the receiving server checks SPF first: is this IP authorized to send from this domain? Then it verifies the DKIM signature: was this message signed by the domain it claims to be from? Then it checks DMARC: does the domain in the From: header align with the domain that passed SPF or DKIM? And finally, what does the DMARC policy say to do with failures?

An email that passes all three checks is treated very differently from one that fails even one. Consistent failures, or a missing DMARC record, signal to mailbox providers that a domain isn’t properly managed. Over time, that affects your sender reputation, which affects deliverability even for emails that would otherwise be fine.

The good news: authentication is entirely in your control. It’s DNS configuration. It doesn’t require a new platform, a new process, or budget. It just requires knowing what’s wrong.

Authentication is the foundation. Once it’s solid, the rest of deliverability work, list hygiene, engagement metrics, content quality, sits on top of it properly. If you found gaps in your SPF or DMARC setup, our free SPF record generator and free DMARC record generator will help you fix them.

And if you want to check your content alongside your authentication, whether your subject line or body copy is triggering spam filters, our free email spam checker covers that side of the picture.

For Alterable users: every personalized campaign you send is only as good as its chance of being delivered. Getting authentication right is the first thing we’d recommend checking.