Correct DNS records do not guarantee your email actually lands in an inbox. Email deliverability checks the records that authenticate your mail, and can also send a real email through your own system and report exactly what arrived on the other end.
What it is
Two related checks for a domain's outbound email. A passive check reads your domain's DNS records for SPF, DKIM and DMARC, the three standards that prove an email claiming to be from you is genuine. A live test goes further: TLDTrack gives you a one-time inbox address, you send it a real email from your own mail system, and TLDTrack reports exactly what arrived, including whether it authenticated correctly, whether it looks like spam, and whether your sending IP is blacklisted.
Read more
SPF, DKIM and DMARC work together to stop your domain being spoofed and to help mailbox providers trust mail claiming to be from you. SPF lists which servers are allowed to send for your domain. DKIM lets a receiving server verify a message was not altered in transit, using a cryptographic signature. DMARC tells receivers what to do if a message fails those checks, and can range from doing nothing to rejecting it outright. Each is checked independently and given its own pass, warning or missing status, with a plain-English explanation of what is wrong and why it matters.
Why it matters
A domain can have perfect-looking SPF, DKIM and DMARC records and still send mail that lands in spam or gets rejected, because how a message actually arrives depends on more than the records alone. The live test tells you what really happened to a real message, not just whether the DNS looks right.
Read more
Most deliverability problems are invisible until an email actually fails to arrive, and by then a customer enquiry or an important notification may already be lost. Checking the DNS records catches the basics; the live test catches the things DNS alone cannot show, such as a message that authenticates correctly but still trips a spam filter because of its content, or a sending IP that has ended up on a blacklist.
The passive check: SPF, DKIM and DMARC
The passive check reads your domain's DNS records, with no email needed, and scores each one:
- SPF. Checked for whether a record exists at all, and whether it ends restrictively (
-allor~all) rather than permissively (+allor no explicit ending), since a permissive SPF record does little to stop spoofing. - DKIM. There is no single fixed place a DKIM key lives, so TLDTrack looks for one under the selectors used by common providers and mail platforms. Finding a valid key at any of them counts as a pass.
- DMARC. Checked for whether a record exists, and which policy it sets: reject (strongest), quarantine, or none (monitoring only, no real protection).
Together with your MX records, these combine into an overall email health score for the domain, so you can see at a glance whether your mail setup is solid.
The live inbound test
The passive check tells you what your records say. The live test tells you what an actual email does when it is sent and received:
-
1
Press Generate test address in the Live email test panel on the site's Email tab. TLDTrack generates a one-time inbox address, unique to that test, that expires after 15 minutes.
-
2
Send any email to that address, from any mail account, the same way you would send a normal message.
-
3
TLDTrack receives it and analyses it: real SPF, DKIM and DMARC authentication results as they applied to that message, the sending IP and its reverse-DNS record, whether that IP appears on any spam blacklist, the hops the message took to arrive, and a spam-style check of the message content.
-
4
You get a delivery score out of 100 and a list of specific, prioritised suggestions, worst first, each one tied to whatever caused it.
What "reports what arrived" means
The result is not a re-check of your DNS. It reflects the actual message as it was received: its real authentication outcome, the IP it was sent from, whether that IP is on a blacklist, and content patterns (such as spam-trigger phrasing, missing plain-text version, or a mismatched reply-to address) that can hurt deliverability even when SPF, DKIM and DMARC all pass.
Running a test, step by step
-
1
Open the website from your Domains list. If you have not added it yet, see Add your first website.
-
2
Go to the site's Email tab to see the passive SPF, DKIM and DMARC results and the overall health score.
-
3
In the Live email test panel, press Generate test address and copy the one-time address it gives you.
-
4
From your usual mail account for that domain, send any email to the address shown. TLDTrack picks it up automatically, there is nothing to confirm on your side.
-
5
Review the delivery score and suggestions once the test completes, usually within 5 to 15 seconds of the email arriving.
Where to set this up
Good to know
- The one-time test address expires after 15 minutes, so start the test just before you send the email.
- The passive check needs nothing sent; it only reads DNS records and can be re-run any time.
- SPF, DKIM and DMARC each need their own DNS record. Fixing one does not fix the others, and DMARC in particular relies on SPF and DKIM already being set up correctly.
- A DMARC policy of none collects reports but enforces nothing. Moving to quarantine or reject is what actually stops spoofed mail being delivered.
Available on:StarterProAgency