Pink PostHow the email deliverability test works
- DNS authentication. Your browser asks Cloudflare's DNS-over-HTTPS resolver for the SPF, DMARC, DKIM and MX records of the domain, the same public records receiving servers read.
- Blacklists. A Pink Post function finds the IPv4 addresses of your mail servers and website and checks each one, plus the domain, against public DNS blocklists (DNSBLs).
- Domain age. We ask the registry's RDAP service, the successor to WHOIS, when the domain was registered.
- Score and fixes. Each check earns points on a fixed rubric. Anything that loses points becomes a fix, ordered by priority and points, with an example record where one applies.
Everything runs live when you click the button. Nothing is cached or logged.
How the 0 to 100 score is calculated
| Check | Max points | How points are given |
|---|---|---|
| SPF | 20 | 20 valid with ~all or -all and 10 lookups or fewer; 12 neutral/missing all or warnings; 5 for +all or over 10 lookups; 0 missing |
| DKIM | 20 | 20 key of 2048 bits or more (or provider CNAME) on a common selector; 17 for 1024-bit; 5 under 1024; 0 none found |
| DMARC | 20 | 20 quarantine or reject; minus 3 if pct is under 100, minus 2 with no rua; 10 for p=none; 3 invalid; 0 missing |
| Blacklists | 20 | Start at 20; minus 15 per Spamhaus IP listing, 8 per other IP listing, 20 for Spamhaus DBL, 12 per other domain listing. Lists that do not answer cost nothing |
| MX | 10 | 10 with at least one MX host; 0 with none |
| Domain age | 10 | 10 at 1 year or more; 7 at 6 to 12 months; 4 at 1 to 6 months; 0 under 30 days; 5 if the registry does not publish a date |
SPF: which servers may send for you
SPF is a TXT record at the root of your domain that lists the servers allowed to send mail for it. We follow every include: and count DNS lookups: more than 10 is a permanent error and SPF then fails for every message. We also read the ending: ~all (soft fail) and -all (hard fail) are good, ?all is neutral, and +all lets anyone send as you. For more detail use the SPF record checker.
DKIM: is the message signed
DKIM adds a cryptographic signature to each message; the public key is published at selector._domainkey.yourdomain. The selector is chosen by your provider, so we try about 40 common ones, including Google Workspace (google) and Microsoft 365 (selector1, selector2). If we find nothing and you know your selector, check it in the DKIM checker. Not finding a key on common selectors does not prove there is none.
DMARC: what to do when checks fail
DMARC at _dmarc.yourdomain tells receivers what to do with mail that fails SPF and DKIM alignment, and where to send reports. p=none only monitors; p=quarantine and p=reject protect your domain from spoofing. Since February 2024 Google and Yahoo require a DMARC record from bulk senders. The DMARC checker explains every tag.
MX: can the domain receive replies
MX records name the servers that accept mail for a domain. A sending domain with no MX cannot receive replies or bounces, which matters for outreach where the reply is the whole point. See the MX lookup.
Blacklists: including Spamhaus
We check each IP against Spamhaus ZEN, Barracuda, SpamCop, PSBL, Mailspike, UCEPROTECT level 1, DroneBL, 0spam and SEM Backscatter, and the domain against the Spamhaus DBL, NordSpam DBL and SEM URIBL.
Spamhaus refuses queries that come through large public resolvers such as Cloudflare and Google DNS, and returns an error code instead of an answer. Before each test we send Spamhaus's own test entries through a short list of DNS-over-HTTPS resolvers and use the first one that answers them correctly. If none does, Spamhaus shows "No answer" and is left out of the score rather than reported as clean. Lists that do not answer are never counted against you. The email blacklist checker covers more lists and accepts a raw IP.
Domain age: why new domains need warm-up
A domain registered last week has no sending history, so mailbox providers treat its mail with more caution. Age is not a problem to fix, but it tells you how slowly to ramp up. We read the registration date from RDAP; some country-code registries do not publish it, in which case age scores a neutral 5 of 10. Check several domains at once with the domain age checker.
What this test cannot see
A deliverability test of DNS and reputation cannot see your content, your sending volume, your complaint rate or how recipients engage. Those matter as much as records. For copy, use the spam word checker and subject line tester. A high score means the foundations are in place; it does not guarantee the inbox.
Before you send outreach
Run this test on every domain you send pitches from, fix anything Critical or High, then warm the mailbox up slowly. In Pink Post each connected mailbox has daily and hourly caps, warm-up that starts at 5 emails a day, and automatic pausing when bounces pass 5%.