NERDTOOLS / DOMAIN DIAGNOSTICS

WORKFLOW / EMAIL DELIVERY DIAGNOSTICS

Trace why email is not landing.

Email deliverability is a chain, not a single record. Check whether mail can reach the right servers, whether senders are authorized, whether signatures can be verified, and whether DMARC aligns those results with the visible From domain.

Run a full domain diagnostic ↘ Start with DMARC →

01 /

Prove the message can authenticate.

Start with the records a receiving system can verify. A record being present does not mean it is valid, complete, or aligned with the domain recipients see.

  • Confirm MX records route inbound mail to the intended provider.
  • Check that one SPF record authorizes every legitimate sending service without exceeding the DNS lookup limit.
  • Verify the DKIM selector used by each sender publishes a readable public key.
  • Inspect DMARC policy, SPF and DKIM alignment, subdomain policy, and aggregate reporting destinations.

02 /

Separate configuration from reputation.

Passing SPF, DKIM, and DMARC is necessary, but it cannot guarantee inbox placement. Use authentication findings to eliminate configuration faults before investigating message quality, complaint rates, sending patterns, and provider-specific reputation.

  • Check the sending IP and domain against DNS-based blocklists for supporting evidence.
  • Review recent DNS changes, record duplication, forwarding, and third-party sender additions.
  • Treat blacklist status as one signal rather than a complete deliverability verdict.
  • Use your mail provider logs and DMARC aggregate reports to confirm which messages actually pass alignment.

03 /

Choose the signal you need.

MX CheckerConfirm inbound routing, priority, and redundancy.↗SPF CheckerParse sender policy and count DNS lookups.↗DKIM CheckerFind common selectors and published public keys.↗DMARC CheckerReview policy, alignment, and reporting configuration.↗Blacklist CheckerAdd DNSBL evidence to the investigation.↗DNS LookupInspect the underlying TXT and mail-related records.↗

FAQ /

Operational detail.

Why does email go to spam when SPF, DKIM, and DMARC pass?

Authentication proves domain authorization and alignment, not message quality or sender reputation. Providers also evaluate complaint rates, engagement, list quality, content, sending consistency, IP reputation, and their own filtering signals.

Which email deliverability check should I run first?

Start with MX and raw DNS, then check SPF and DKIM before interpreting DMARC. If authentication is healthy, continue with sending logs, DMARC reports, blacklist context, and provider-specific reputation tools.

Can NerdTools tell me whether a particular email reached an inbox?

No. NerdTools checks public domain and IP configuration. Delivery of a specific message requires the sending platform logs, message headers, or a controlled inbox-placement test.