Enter your domain once and we check SPF, DKIM, DMARC, BIMI, and the public domain blacklists together, then score your setup from 0 to 100. It runs free in your browser over DNS-over-HTTPS, auto-detects your DKIM selector, and stores nothing.
Create a free Unspam account to save your results and re-run these checks anytime, so you catch a broken setup before it costs you. No credit card.
This is a single scan across the five DNS signals mailbox providers weigh before they trust your mail. It reads your SPF record, finds your DKIM key by probing the common provider selectors, reads your DMARC policy, checks for a BIMI logo record, and looks your domain up on a curated set of public domain blacklists that answer over browser DNS. Each result is graded and rolled into one score, with the authentication records (SPF, DKIM, DMARC) carrying the most weight because they decide whether Gmail, Yahoo, Outlook.com, and Apple accept your mail under their bulk sender rules. Every lookup is read-only and runs entirely in your browser, so nothing is written to your DNS and nothing is stored on our side. Use it as a fast first pass, then open any single check for the full detail.
The score is weighted across the checks we can conclusively assess. SPF, DKIM, and DMARC carry the most weight because they determine whether receivers trust your mail. A passing check scores full marks, a warning scores half, and a failure scores zero. Checks we cannot assess, such as an optional BIMI record you have not published or a DKIM key under a custom selector we cannot guess, are marked informational and left out of the score rather than counted against you.
These three authentication records are the core. SPF lists who may send for your domain, DKIM signs your messages, and DMARC tells receivers what to do when the first two fail alignment. Gmail, Yahoo, Outlook.com, and Apple all require them of bulk senders, so a gap here is the first thing to fix.
DKIM is published per selector, not per domain, so we probe a list of common provider selectors (google, selector1, k1, s1, and more). If your domain uses a custom selector we cannot guess, the result reads 'not detected', which is inconclusive rather than a confirmed failure, so it is left out of the score. Open the DKIM checker to enter your exact selector.
BIMI is the optional brand logo record that supporting inboxes show next to your mail. It only works once DMARC is at enforcement, so it is best treated as a finishing touch after the core records pass. If you have not published a BIMI record, it is marked optional and left out of the score.
We check whether your domain appears on the public domain blacklists that email filters use to score the links inside a message. A listing can hurt delivery for every message that mentions your domain, even from a clean sending IP.
A record exists but the policy only monitors, so spoofed mail is never blocked and your score is capped. Use the aggregate reports from your rua= address to confirm your legitimate senders pass, then move to p=quarantine and eventually p=reject.
If you sign with a custom or provider-specific selector (Amazon SES tokens and HubSpot hashes cannot be guessed), the scan will not find it. This is not proof DKIM is missing. Read the s= value from a real DKIM-Signature header and check it directly in the DKIM checker.
An SPF record that ends in +all authorizes everyone, and one with no all mechanism is incomplete. Both weaken or disable SPF. End the record with -all for a hard fail, or ~all while you confirm every legitimate source.
Clean SPF, DKIM, and DMARC will not save you if your domain is listed on a domain blacklist, usually from spam links or a compromised site. Find and fix the cause, then file the removal form for the list that flagged you once the abuse has stopped.
Every date and figure Unspam publishes about sender requirements is kept here, checked against each provider’s own documentation. Last read August 16, 2026.
| Provider | What | Value | Applies to |
|---|---|---|---|
| Bulk sender rules in force since source | February 2024 required | mail to personal Gmail addresses | |
| Enforcement tightening since source | November 2025 observed Google calls this gradual and progressive rather than a switch that flipped on a date. | mail to personal Gmail addresses | |
| Counts as a bulk sender at source | 5,000 required This is Google’s number. Yahoo declines to publish one at all. | mail to personal Gmail addresses | |
| Spam complaint rate ceiling source | 0.3% required Google describes the effect as graduated rather than a cutoff: above the recommended figure inbox placement already suffers, and at the ceiling it suffers more. | every sender to Gmail, not only bulk | |
| Spam complaint rate to aim for source | 0.1% recommended Postmaster Tools does not divide complaints by everything you sent. It measures them against DKIM-signed messages that reached an engaged recipient’s inbox, so a sender already being filtered can see an artificially low rate. | every sender to Gmail, not only bulk | |
| Yahoo | Bulk sender rules in force since source | February 2024 required | mail to Yahoo, AOL and Yahoo’s other mailboxes |
| Counts as a bulk sender at source | not published Yahoo states it will not specify a volume threshold, so no figure can be attributed to it. | mail to Yahoo, AOL and Yahoo’s other mailboxes | |
| Spam complaint rate ceiling source | 0.3% required | mail to Yahoo, AOL and Yahoo’s other mailboxes | |
| Outlook.com | Bulk sender rules in force since source | May 2025 required | Outlook.com and Microsoft’s other consumer mailboxes, never a Microsoft 365 tenant |
| Counts as a bulk sender at source | 5,000 required The rule applies to any domain that has ever crossed the threshold, so it keeps applying on a quieter day. | Outlook.com and Microsoft’s other consumer mailboxes, never a Microsoft 365 tenant | |
| What happens to failing mail source | 550 5.7.515 observed Failing mail is refused during the SMTP conversation rather than filed in a spam folder. Microsoft’s postmaster policy page still describes junk foldering as a first step, so a sender may see either, but the bounce is the outcome to plan for. | Outlook.com and Microsoft’s other consumer mailboxes, never a Microsoft 365 tenant | |
| SPF and DKIM must both pass, not just DMARC source | required Stricter than DMARC alone. DMARC passes when either SPF or DKIM aligns, and Outlook.com asks for both checks to pass on top of that. | Outlook.com and Microsoft’s other consumer mailboxes, never a Microsoft 365 tenant | |
| Apple | Bulk sender rules in force since source | February 2025 required | mail to iCloud Mail, me.com and mac.com |
| ARC headers on forwarded mail source | required Apple is the only one of the four to ask for this, which is the honest reason to look at ARC at all. | mail to iCloud Mail, me.com and mac.com |
Unspam reads all of these from your domain name alone.
No DNS lookup can reach these. They need a real message or real sending history, which is what an inbox placement test is for.
