Mail Deliverability Test
Send an email from the mail system you want to test to the one-time address below. We inspect the message exactly as a receiving server sees it: authentication alignment, sender reputation, blacklists, transport TLS, spam score, message content and links. The result is a live 0–100 deliverability report with measured values and fixes, not only a DNS-record lookup.
Starting…
What it checks
- Authentication & alignment — SPF, DKIM and DMARC results as your MTA evaluated them, plus whether each identity aligns with the visible From domain, which is what DMARC actually enforces.
- Auth depth — the published SPF record, its lookup count (RFC 7208 caps at 10) and its
allqualifier; DKIM key length, selector, algorithm and signed headers; the DMARC policy, percentage,adkim/aspfandrua; and ARC sealing for forwarded mail. - Sending-IP reputation — forward-confirmed reverse DNS (PTR), ASN and network name, DNS blacklist listings, and AS-level reputation (Spamhaus ASN-DROP, UCEPROTECT, StopForumSpam confidence).
- Transport security — the TLS version used to deliver the message, with bonus credit for MTA-STS, DANE/TLSA, TLS-RPT and DNSSEC on the domain.
- Spam score — the spam-engine score plus the individual rules that fired and their point contributions, so you can see exactly what pushes the message toward the junk folder.
- Content & link safety — HTML/plain structure, links (including URL shorteners and mismatched or blacklisted link domains), images, attachments and risky attachment types, with a ClamAV malware scan of the message parts.
- List hygiene — List-Unsubscribe and RFC 8058 one-click unsubscribe, a present Message-ID and Date, and exactly one valid From header — the basics bulk receivers now require.
- BIMI and identity hygiene — BIMI DNS presence, visible sender identity basics, Message-ID/Date/From header quality, and list-unsubscribe signals that real receivers use as trust and bulk-sender hygiene inputs.
How to read the result
- The score is a summary, not the answer. Treat the 0–100 figure as a headline and read the per-signal explainers below it — each says what the signal is, why it matters, and the exact step to fix it.
- Watch alignment, not just pass/fail. An SPF or DKIM pass still fails DMARC if the authenticated domain is not aligned with your From domain. The report shows the SPF and DKIM domains next to From so you can spot the mismatch.
- Bonuses only add, never penalise. DNSSEC, BIMI, MTA-STS, DANE and ARC are awarded as badges when present; their absence does not lower your score, so the baseline stays achievable for any sender.
- Use the headers and raw view. Expand the headers panel to see the Received chain, Authentication-Results and DKIM signatures the receiver actually got — the ground truth behind every verdict.
Frequently asked questions
How is this different from an SPF, DKIM or DMARC record checker?
A record checker queries DNS for the policies you publish. This test inspects a real message your server actually sent, so it sees what a receiving mail server sees: the authentication results your MTA stamped, whether each identity aligns with the From domain, the connecting IP and its reverse DNS and reputation, the TLS used to deliver, a spam-engine score, and the message content itself. It is the difference between checking your records and checking a real delivery.
How is it different from mail-tester.net?
It works the same way — you send a message to a one-time address and get a score — but the report is weighted toward authentication and security rather than just a spam number. You get SPF/DKIM/DMARC alignment depth (key length, lookup count, policy, ARC), sending-IP and AS-level reputation, transport TLS with credit for MTA-STS, DANE, TLS-RPT and DNSSEC, BIMI/list hygiene, content and link/attachment safety with a malware scan, and measured what/why/how-to-fix explainers.
Is my email stored or read by anyone?
No. The test address is single-use, and your message is shown back only to you so you can review what was received, then discarded when the session ends. We never retain the message past the session and never share it — we keep only the deliverability result, never your content.
What does the deliverability score mean?
It is a single 0–100 figure summarising authentication, sending-IP reputation, transport security, spam score and content hygiene for the exact message SysGlass received. A high score means the observable acceptance signals are strong; it is not a guarantee of Gmail, Outlook, Yahoo or iCloud inbox placement. A lower score points to a specific weakness — a failing or unaligned auth method, a blacklisted IP, missing reverse DNS, or spam-triggering content — which the per-signal explainers tell you how to fix.
Why does SPF or DKIM pass but DMARC still fail?
DMARC requires alignment, not just a pass. SPF can pass on the envelope sender (the Return-Path) while that domain does not match your visible From domain, and DKIM can verify with a signing domain (d=) that is not your From domain — in both cases DMARC fails because the authenticated identity is not aligned with what the recipient sees. The report shows the SPF and DKIM domains alongside the From domain so you can see exactly which alignment is missing.
Does it check blacklists, spam and malware too?
Yes. It looks up the sending IP against DNS blacklists and checks AS-level reputation (Spamhaus ASN-DROP, UCEPROTECT, StopForumSpam), runs a spam engine and lists the individual rules that fired with their score, and inspects the content: HTML/plain structure, links (including URL shorteners and mismatched or listed link domains), images, attachments and risky attachment types, with a ClamAV scan of the message parts for malware.