Before a domain sends a single cold email, four things need to be true. Most deliverability problems that get blamed on copy are one of these four being false on one domain out of twelve.
The four records
| Record | Pass condition | If it fails |
|---|---|---|
| SPF | Exactly one record, ten or fewer lookups, every sender included | Unauthorised mail; two records fails everything. Check it |
| DKIM | A valid 2048-bit key at the right selector, not truncated | No signature, so DMARC has nothing to align. Check it |
| DMARC | One record at _dmarc, with a reporting address |
Expected by Gmail and Yahoo; absence counts against you. Check it |
| MX | Present and resolving | Replies and bounces vanish, and the domain looks disposable. Check it |
What a grade is actually measuring
An A to F grade is a convenience, not a deliverability score. It tells you whether the mechanical prerequisites are in place. A domain can grade A and still land in spam, because authentication removes reasons to be filtered rather than adding reasons to be delivered, list quality, volume pacing and reputation do the rest.
So read the grade as a gate: below an A, fix the records. At an A, the remaining problems are elsewhere.
Fix in this order
- Nameservers. If NS records point somewhere you are not editing, nothing else you do will resolve. This is the most common cause of “I published it and it is not there”.
- MX. Cheapest fix, and it restores your ability to see replies and bounces, which you need to diagnose anything else.
- SPF. One record, under ten lookups, every sender listed. Merge duplicates rather than deleting one.
- DKIM. Correct selector, complete key. Confirm by checking the signature on a real sent message.
- DMARC. Publish
p=nonewith a reporting address first, then stage the rollout. Never start at reject. - A record. Point the domain at something. A sending domain that resolves to nothing is a pattern.
Run it per domain, and on a schedule
Reputation and DNS are per domain, so a health check on one domain says nothing about the other eleven. The two moments that matter: before any new domain sends to real prospects, and whenever one domain in an estate underperforms the others on reply rate, which is a DNS or reputation difference far more often than a copy difference.
Monthly across the estate is a reasonable cadence. At forty domains nobody does this by hand, which is the argument for bulk DNS management and for authentication that is published automatically when a domain is added.
Once the grade is clean, the next diagnostic is placement rather than authentication: a placement test tells you which folder you land in, which is the question a health check cannot answer.
Next: staging a DMARC rollout, or how many domains you should have in the first place.
Frequently asked questions
What does a domain health check test?
The four records that decide whether a sending domain is credible: SPF, DKIM, DMARC and MX. It is a check on mechanical prerequisites rather than a deliverability score.
Can a domain pass a health check and still land in spam?
Yes. Authentication removes reasons to be filtered rather than adding reasons to be delivered. Once the records are clean, list quality, volume pacing and reputation decide placement.
What order should I fix problems in?
Nameservers first, because nothing resolves otherwise, then MX, SPF, DKIM, DMARC and finally an A record. Publish DMARC at p=none rather than starting at reject.
How often should I check?
Before any new domain sends to real prospects, whenever one domain underperforms the rest on reply rate, and monthly across the estate.
Does each domain need its own check?
Yes. DNS and reputation are per domain, so a clean result on one says nothing about the others.