Email Deliverability Audit Guide: A One-Time 10-Step Free Audit for MX, SPF, DKIM, DMARC, Blocklists, and Bounce Posture

Why the 10-Step Audit Exists

Mailbox providers do not score one variable in isolation — they score a stack. Gmail weighs domain reputation, SPF / DKIM / DMARC alignment, complaint rate, blocklist status, and engagement. Outlook weighs its own per-IP filter colour, DKIM alignment at the receiving hop, PTR presence, and complaint feedback from JMRP. Yahoo reads engagement harder than IP. Across all of them, the same ten inputs do most of the work: MX posture, SPF, DKIM, DMARC, blocklist status, spam-trigger content, the composite score, header alignment, warm-up readiness, and bounce posture. A 10-step audit is the cheapest way to read every relevant input before the first production send, and the cheapest way to find the dominant negative driver when inbox placement drops.

The audit produces a prioritised list of fixes, not a single number. A repainting of the same inputs as a single composite (Step 7 below) is a useful second read — it ranks the dominant negative driver — but the audit itself runs each step in isolation. Run the 10 steps in order; treat each step as a precondition for the steps that follow.

Pre-Flight: What to Record Before Step 1

Open a single document — a spreadsheet is fine — and for every step record the running domain, the result, and the action you took. Three columns per step is enough; the goal is to end the audit with a fix list ordered by impact, not to repeat work later. Each step below pairs the input you are reading with the free checker that surfaces it.

Step 1 — MX Posture

Start at the apex: confirm your domain publishes MX records at all. A domain without MX records cannot receive replies, and several mailbox providers flag a send-only domain as a higher-risk identifier before any other signal even runs. Resolve the MX records and read three things — how many MX hosts you publish, which provider each one points to, and whether there is at least one backup MX with a higher numeric priority value than the primary.

The fail mode that hides until week 2: a single MX record, pointing to the correct provider. The day that provider has an outage, all inbound mail is rejected with 4xx SMTP codes and held by senders until their retry budgets expire. Two MX records with ascending priority values is the safe baseline.

Run the free MX lookup checker — it resolves the apex records, identifies recognized versus unknown providers, shows the numeric priority ladder, and flags a missing fallback MX.

Step 2 — SPF

Resolve the TXT record at the apex of your domain. Three checks: there is exactly one record starting with v=spf1 (RFC 7208 specifies one only; two records are treated as a PermError that fails every message), the DNS lookup count stays at or below ten, and the trailing qualifier is ~all during the audit, escalating to -all once every legitimate source is confirmed.

SPF is the entry ticket for the 2024 Gmail + Yahoo bulk-sender bar. Both providers explicitly state that missing or failing SPF prevents a domain from ascending out of the lowest reputation band in Postmaster Tools regardless of engagement. See the deep pillar for the full mechanism reference — the SPF troubleshooting guide walks every mechanism and the include-chain flattening path.

Run the free SPF checker — it walks the full include chain, counts DNS lookups against the RFC 7208 cap, and flags any PermError risk before it breaks DMARC alignment.

Step 3 — DKIM

Locate the DKIM selector your sending platform publishes (commonly google for Workspace, selector1 or selector2 for M365, and a vendor-provided selector for most ESPs) and resolve selector._domainkey.yourdomain.com as a TXT record. The record must contain a valid p= public key, ideally 2048-bit and quoted without comment markers.

The reputation-robbing misconfiguration is almost always here: the DKIM d= domain is the ESP's bounce domain (for example espdomain.net), not your brand domain. The signature passes — DKIM is happy — but DMARC alignment fails because the d= domain does not align with the visible From: header. DKIM alignment is the second arm of every modern deliverability gate; verify it explicitly rather than trusting the signature to imply alignment.

Run the free DKIM validator (and fall back to the combined SPF / DKIM / DMARC checker for the three-protocol validator) to confirm the selector resolves, the signature validates at the receiving hop, and the d= domain aligns with your visible From: header.

Step 4 — DMARC

Resolve _dmarc.yourdomain.com as a TXT record. The policy must be at least p=none with a rua= address that receives aggregate reports. Without a rua= address you are flying blind on who is sending on your behalf and what is failing alignment; every receiver still records the result, you just cannot see it.

Plan the escalation ramp before any audit ends: spend 2–4 weeks at p=none reading aggregate reports, escalate to p=quarantine pct=10, then pct=50, then pct=100, then p=reject. Each step is gated on the reports showing SPF and DKIM alignment rates consistently above 95% for every legitimate sender. The deep pillar covers the full RFC 7489 tag syntax — read it alongside the audit: DMARC record guide.

Run the free DMARC checker — it resolves the policy, checks for a rua= address, and confirms the record lives at the right subdomain.

Step 5 — Blocklist Lookup

Query the major DNSBLs in one pass — Spamhaus (SBL, XBL, DBL), Barracuda BRBL, SORBS, SenderScore, Cisco Talos. A single Spamhaus listing is enough to knock out delivery at a disproportionate share of receiving networks; a listing on day one of the audit is also the most commonly missed blocklist signal — the visible symptom is a bounce wave two weeks later, which feels like a content or list problem but is actually blocking at SMTP.

The listing reasons separate into cluster groups that drive different fixes: a Spamhaus XBL (compromised host) clears once the underlying infected-machine problem is resolved; a Spamhaus SBL (known spam sources) clears through a self-service removal form on root-cause explanation; a DBL (domain) clears as domain activity normalises; a BRBL clears within hours of approval once volume stops at the listed IP; Cisco Talos and SenderScore rebuild on observed clean sending. Each one has its own delist workflow — the deep pillar covers them all: blocklist removal guide.

Run the sender domain or IP blacklist checker against the major blocklists, the free blacklist lookup checker (with per-listing AI explanations) or the multi-DNSBL blocklist check for the standard pass.

Step 6 — Spam-Trigger Words in Your Copy

Run your latest campaign body through the spam-trigger scorer. The patterns that consistently raise the score are entirely-capitalized subjects, multiple exclamation or question marks, stacked currency symbols, URL shorteners, and classic promotional phrases used as the entire subject line. Image-only HTML at the body level is the highest-risk single formatting choice — receivers have nothing to spam-score without text fallback.

These signals are amplifiers, not root causes. A single “FREE!!!” on a clean domain barely moves the needle; the same phrase on a domain with low reputation is enough to push the message into Junk. Read the score as a relative input — a high score on a currently-clean domain is a heads-up to fix before engagement drops; a high score on a domain with low reputation is a fix-now item.

Run the free spam-trigger word checker.

For the full trigger-word glossary, the per-category amplifier scoring, and the safe-rewrite playbook, read the Spam Trigger Word Guide.

Step 7 — Composite Deliverability Score

Step the inputs from Steps 2–6 into a single 0–100 number. The composite is the cheapest single read of where the domain sits in provider-side classification, but its real value is the per-sub-component breakdown: authentication, complaint rate, blocklist status, IP / domain history, and engagement each contribute a weighted slice, and the lowest scoring sub-component is almost always the dominant negative driver.

Use the composite as the second read on the audit. Above 80 is healthy production sender territory; 60–80 means one or more sub-components is dragging the composite down; below 60 is the danger zone where spam-folder placement is the default expectation. Read the per-component breakdown first — the largest sub-score drop tells you which step to revisit. The deep pillar covers how providers weight each input: deliverability score guide.

Run the free composite self-rating.

Step 8 — Email Header Analysis

Paste a recent delivered message into the header analyzer. The headers are where the providers actually decide: Authentication-Results declares how each protocol scored at the receiving hop, ARC carries authentication through forwarding chains, and X-MS-Exchange-Organization-SCL shows the Microsoft-specific spam confidence level. Reading the four-protocol stack end to end at the receiving hop is the only way to confirm the auth chain works in production, not just in theory.

The fingerprint to look for is alignment — SPF, DKIM, and DMARC all aligning with the visible From: domain. A missing DKIM signature, a soft SPF, or a DMARC pass on DKIM only is the dominant pattern in the headers of deliverability-bad sends. Step 8 confirms what Steps 2–4 implied.

Run the free email header analyzer.

Step 9 — Warm-Up Readiness

If the domain is new or being re-activated after a long idle window, Step 9 is the readiness gate before launching volume. The worst-case pattern in deliverability casework is the first-send-day-one-10k shape: a brand-new domain arrives at thousands of sends with no reputation history and providers default to junk or rejection before any recipient even opens the message. The willingness to ramp volume over 4–6 weeks is what separates recoverable from non-recoverable.

A passing warm-up readiness check shows the auth stack clean (Steps 2–4), no current blocklist hits (Step 5), and a volume cadence compatible with the current reputation band — week 1 of a brand-new domain starts at ≤20 emails per day to known contacts, not 500 per day to a cold list. Holding the ramp flat on any of four pause signals (hard bounce rate above 2%, spam complaint rate above 0.1%, Postmaster reputation dropping to Low, or a sudden undelivered spike from a single provider) is the habit that prevents the rebound.

Run the free warm-up checker to confirm readiness, and read the deep warm-up pillar at /resources/email-warmup-guide for the full week-by-week ramp cadence.

Step 10 — Bounce Posture

A bounce wave is often the first visible symptom of a deeper auth or blocklist problem. Bucket the last 100 failed sends by SMTP code — 5xx are permanent (the recipient is gone or the message has been refused for a fixed reason), 4xx are transient (recipient server busy, greylisting, mailbox full) and safely retryable with exponential backoff. The dominant pattern in your codes usually points to the cause: 550 5.1.1 chains are list-quality, 550 5.7.606 chains point at blocked URLs in the message body, 421 4.7.28 from Microsoft is a sender-side rate limit, and 550 5.x.x in volume is a blocklist symptom.

The deep bounce-recovery checklist at /resources/bounce-handling-guide walks the recovery loop in full. A bounce wave that doubles your hard-bounce rate above 2% is the moment to pause volume, bucket the codes, and read the upstream stack (Steps 2–6) before resuming — a bounce fix that does not address the upstream cause is a single-campaign rescue, not a recovery.

For hard-bounce root-cause verification, cross-link to the blocklist check — a 550 spike that coincides with a new DNSBL hit is almost always a blocklist-rooted problem, not a list-quality one.

Summary: Lowest-Scoring Input → First Checker to Run

When the composite from Step 7 highlights a single sub-component as the dominant negative driver, jump straight to the matching free checker. The matching is one-to-one and the fix loop closes the audit on the lowest-leverage input first.

Related Guides and Tools

• SPF, DKIM, and DMARC Guide → — The deep pillar for Steps 2–4, end to end.
• Deliverability Score Guide → — The deep pillar for Step 7.
• Email Warm-Up Guide → — The week-by-week ramp referenced by Step 9.
• Email Authentication Guide → — The full SPF / DKIM / DMARC / BIMI reference.
• Free composite deliverability self-audit →
• Free SPF record checker →