“Email health” is really shorthand for a stack of DNS and server settings that either quietly hold your reputation up or quietly drag it down. None of them are hard individually; the trouble is that there are a dozen of them and they’re easy to forget. Here’s the whole stack in one place. The distinction that matters most: inbound health (how your domain receives mail) is separate from outbound health (how your mail sends). A domain scan covers the first; only a sent message covers the second.
The 12 checks
| # | Check | What good looks like | Verify |
|---|---|---|---|
| 1 | MX records | One or more, resolving to real mail servers | MX Lookup |
| 2 | SPF | One record, ≤10 lookups, ends -all/~all | SPF Checker |
| 3 | SPF lookup budget | Comfortably under 10 DNS lookups | SPF Include Tree |
| 4 | DKIM | Published key, 2048-bit, signing your mail | DKIM Checker |
| 5 | DMARC | Published, moving toward p=reject, with rua | DMARC Checker |
| 6 | DMARC reporting | Aggregate reports flowing and reviewed | DMARC Monitor |
| 7 | Reverse DNS (PTR) | Sending IP has PTR that forward-confirms (FCrDNS) | Reverse DNS |
| 8 | SMTP + STARTTLS | Server reachable, STARTTLS with a valid cert | SMTP Test |
| 9 | MTA-STS | Policy published and enforced (optional but recommended) | MTA-STS |
| 10 | TLS-RPT | Reporting address so you hear about TLS failures | TLS-RPT |
| 11 | Blocklists | Sending IP and domain not listed on major RBLs | Blacklist Checker |
| 12 | Spoofing resistance | Domain can’t be forged into inboxes | Spoofing Risk |
Run it all at once
Rather than click twelve tools, the Email Health Check runs the inbound/DNS side of this list in one pass and scores it — routing, authentication, transport and operational readiness. It deliberately marks outbound sender reputation as “not tested,” because a domain scan can’t see your sending IP or the real authentication of your messages. To cover that final piece — PTR of the actual sending IP, real SPF/DKIM/DMARC alignment, blocklist status of the IP you send from — send a message to the Outbound Deliverability Test.
Priorities if you can only fix a few things
- SPF + DKIM + DMARC, aligned. This is 80% of the value. Without it, nothing else saves you.
- Reverse DNS on your sending IP. Cheap, and many receivers reject mail without it.
- Stay off blocklists by not sending to bad lists — verify addresses first.
- DMARC monitoring so problems surface before your recipients’ providers notice them.
Then, when the fundamentals are green, layer on the niceties — BIMI/logo, MTA-STS, DANE. For the sending side of the story, the deliverability cheat sheet picks up where this one leaves off.