Methodology
What we check, and what we refuse to infer.
The public checker and the hourly job use the same DNS reads. Public results are not written to the database. There is no counter of “domains checked” on this site, because we do not store those lookups.
Authentication and mail routing
- SPF at the apex. We count direct mechanisms. Two SPF records, a missing record, or
+allare failures.~allis a soft fail and is acceptable when DKIM and DMARC are strict. - DKIM at 22 common selectors, plus up to three you add on the result page. An empty
p=is treated as revoked. - DMARC at
_dmarc.p=noneis weaker than quarantine or reject. - MX hosts. Missing MX is called out. It does not by itself mean the domain is burned.
Blacklists
IP lists are queried with the domain's A records and the A records of its MX hosts, up to eight addresses. Domain lists are queried with the domain name. An answer of NXDOMAIN is clean. A timeout or a DNS error is unavailable. Return codes in 127.255.255.0/24, 127.0.0.1, and any code the operator does not document as a listing are unavailable. Unavailable is not listed and not clean.
- NordSpam domain,
dbl.nordspam.com. A listed domain returns127.0.0.2. NordSpam says to block at the MTA. That is a major hit. - NordSpam IP,
bl.nordspam.com. A listed address returns127.0.0.2. Same weight. - PSBL,
psbl.surriel.com. A listed address returns127.0.0.2after mail reaches a PSBL spamtrap. Major. - Mailspike,
bl.mailspike.net.127.0.0.2is a zero-hour spam wave.127.0.0.10,127.0.0.11, and127.0.0.12are reputation levels L5, L4, and L3. Mailspike says to block those at the MTA, so they are major.127.0.0.13is L2, suspicious, and is only a minor hit.127.0.0.14through127.0.0.20are neutral or good reputation and are not listings. - LashBack UBL,
ubl.unsubscore.com.127.0.0.2means the IP sent mail to an unsubscribe probe. Minor: confirm it before you keep sending. It does not by itself mark the domain burned. - s5h,
all.s5h.net.127.0.0.2means the IP sent spam to the operator's own servers. Minor, same as LashBack. - UCEPROTECT Level 1,
dnsbl-1.uceprotect.net.127.0.0.2means that one IP is listed. Levels 2 and 3 are not queried. SendGrid says a UCEPROTECT listing has little to no effect on delivery, because major mailbox providers do not use the list. A Level 1 hit is shown and does not, by itself, burn the domain or move the Monday note off keep.
Spamhaus, SURBL, SpamCop, and Barracuda are not queried. The result still has a Spamhaus row that says "Not checked automatically — check Spamhaus manually" and links to check.spamhaus.org. That row has no automated result.
Domain age
Registration date comes from RDAP, first via rdap.org and then from the TLD's registry server in the IANA bootstrap if that hop is blocked. A domain under 14 days old is a reason to rest it in the Monday note. It does not, by itself, mark a public check as burned.
Reply rate and bounce rate
These exist only after an Instantly API v2 key or a Smartlead API key is connected. Instantly uses daily analytics and prefers unique replies. Smartlead's mailbox health endpoint returns one total for the window. We do not scrape either product.
The baseline locks the first time the window from 28 days ago through 8 days ago contains at least 80 sent messages. It does not move when the domain gets worse. The recent window is the last 7 days, including today. A bounce rate of at least 8% with 30 or more sent is replace. At least 4% and under 8% is rest. A reply rate under 30% of the locked baseline is replace. Under 50% and at least 30% is rest. Both reply rules require a baseline above zero and at least 30 sent.
A domain added by hand, with no key, still gets the DNS checks, the blacklist and authentication alerts, and a line in the Monday note. The reply and bounce rules do not run, because there is no sent mail to measure.
What the public verdict means
Burned means a major blacklist hit: NordSpam, PSBL, or a Mailspike block code. At risk means authentication or a minor list (LashBack UBL, s5h, or Mailspike L2) is off. UCEPROTECT Level 1 does not change the verdict by itself. Healthy means the records we look for are in place and no major or minor list hit. A young domain is a note, not a downgrade from healthy.
Rules we cite, and do not pretend to measure
Google's sender guidelines, effective 1 February 2024, require SPF or DKIM for all senders to Gmail, and SPF, DKIM, plus a DMARC policy for anyone sending more than 5,000 messages a day. The same page tells senders to keep Postmaster Tools spam rates under 0.30%, and also to stay under 0.10%. Google's email sender guidelines.
Yahoo said in October 2023 that bulk senders would need SPF, DKIM, and DMARC, one-click unsubscribe, and a low complaint rate, with enforcement from February 2024 and one-click unsubscribe from June 2024. More Secure, Less Spam and the 20 December 2023 update.
We do not read Google Postmaster Tools or Yahoo complaint data. We will not show you a spam-rate percentage. We check whether the DNS those rules depend on is published.