Free Domain Reputation Check
Check a domain against public reputation sources, understand each result, and connect it to the sending IP and message evidence that determine deliverability.
What is a domain reputation?
Domain reputation is how mailbox providers and spam filters rate the trustworthiness of a sending domain, and it decides whether your mail reaches the inbox, the spam folder, or nothing at all. It is shaped by complaint rates, bounce rates, recipient engagement, and whether SPF, DKIM and DMARC authenticate your mail. Unlike IP reputation it follows the domain itself, so changing sending provider does not reset it.
How to read your domain reputation result
| Result | What it means | What to do |
|---|---|---|
| Listed | The domain, or the web or mail server IP behind it, is recorded on at least one blocklist that answered. | Open the evidence for each listing, fix the underlying sending or compromise issue, then follow that operator's own review process. |
| Clean | Every blocklist that answered returned no listing, for both the domain and its server IPs. | Nothing here, but a clean blocklist result is only one layer of deliverability evidence. |
| Clean, with domain lists unavailable | The domain blocklists did not answer, but the domain's web and mail server IPs were checked and came back clean. | Treat it as partial evidence. Re-run later if the answer matters for an active incident. |
| Unknown | No blocklist answered the query at all, so the check has no evidence either way. | Treat it as unknown rather than clean, and try again in a moment. |
| Engine shows 'Not checked' | That specific blocklist refused, timed out, rate-limited the query, or does not support the address type. | Read it as unknown for that source. The verdict above already excludes unavailable engines from the totals. |
| No MX records reported | The domain publishes no mail host, so there is no declared inbound mail path to check. Senders fall back to its address record under RFC 5321's implicit MX rule. | Confirm with the MX checker, and publish a null MX if the domain is deliberately send-only. |
What this check actually queries
Two layers run on every check. The domain itself goes to the major domain blocklists that mail filters consult, and the infrastructure behind it: the domain's web server IP, and the IP behind its first mail host: goes to a wider set of IP blocklists. The second layer matters because on many networks the domain lists alone return nothing usable, and because a compromised server is a common reason a clean-looking domain starts getting filtered.
Each blocklist is queried twice: once for your domain and once for a known test entry that the list is guaranteed to answer. That second query is what separates “not listed” from “this source refused to talk to us”: several major lists silently return nothing to unregistered or public resolvers, which is indistinguishable from a clean answer unless you check. Sources that fail that verification are reported as not checked and excluded from the totals rather than counted as clean.
Run the check with the incident context
Submit the visible From domain, then preserve the campaign or message path, send time, provider, and reported symptom. A domain check is most useful when it is tied to a specific delivery event. If the problem is a rejection or spam placement, inspect the original message headers or bounce to identify the actual outbound IP and authentication identities.
A clean domain result is not an inbox guarantee
Public domain sources are one evidence layer. Mailbox providers also maintain private reputation, complaint, engagement, and recipient-specific signals that this checker cannot access. A website host's IP may also be unrelated to the system sending email. Check the confirmed outbound address with the IP reputation tool and send a representative message through the email deliverability test.
Related reputation checks
DMARC software that does the work
Palisade organizes DMARC report evidence into prioritized sender and alignment work, helping operators review changes and move domains toward enforcement from one console.
1 domain free up to 1,000 emails/month
Email authentication knowledge base
What does this check tell me, and what does it not?
It tells you whether public blocklists currently record your domain or the servers behind it. It cannot tell you what a mailbox provider privately thinks of you. Gmail, Microsoft, and Yahoo each maintain their own reputation signals (complaint rates, engagement, recipient-level history) that no external tool can read. A clean blocklist result with mail still landing in spam is a normal and informative combination: it means the problem is in those private signals or in your authentication, not in a public listing.
Why does an engine say 'Not checked' instead of 'Not listed'?
Because they mean different things and conflating them is misleading. Several major blocklists refuse queries from public or unregistered resolvers, returning nothing at all, which looks exactly like a clean answer. Every list is therefore queried twice, once for your domain and once for a test entry it is guaranteed to answer. If the test query fails, the source is reported as not checked and left out of the totals rather than being counted as clean.
What's the difference between domain reputation and IP reputation?
Domain reputation follows your domain wherever it sends from, so changing providers does not reset it. IP reputation belongs to the specific address a message left from, which for most businesses is their provider's shared infrastructure rather than anything they control. Both influence delivery. The practical rule: fix the domain-level causes, because those are yours, and identify the real outbound IP from a message header before assuming an IP problem is yours to fix.
Why does it check my web server's IP as well as my domain?
Because a compromised website is one of the most common reasons a previously clean domain starts getting filtered. If your web host's IP is listed for distributing malware or spam, that reflects on the domain even when your mail flows through an entirely separate provider. The infrastructure layer also gives a usable answer on networks where the domain lists themselves refuse to respond.
My domain is listed. How do I get it removed?
Delisting is granted by the operator of each list, not by any checker. Open the evidence for each listing, fix the underlying cause: a compromised account, an open form being abused, a purchased list, a hijacked subdomain, and then follow that operator's own review process. Requesting removal before fixing the cause usually results in a relisting, sometimes with a longer minimum period.
Can a brand-new domain already have problems?
Yes, in two ways. It may have been registered and abused by someone else before you bought it, so check its history rather than assuming a clean slate. And a new domain with no sending history is treated cautiously by default, which is why sending a large volume on day one tends to go badly. Neither is a listing, but both affect delivery.
How does email authentication relate to reputation?
Authentication is what makes reputation attributable to you. SPF and DKIM let a receiver confirm a message genuinely came from an authorized sender for your domain, and DMARC tells it what to do when neither aligns. Without them, anyone spoofing your domain contributes to how it is perceived, and you have no way to prove which mail was actually yours.
How often should I check?
Regularly enough to catch a listing before it costs you a sending cycle: weekly for high-volume senders, monthly for occasional ones, and immediately after any report of mail going missing. A one-off check only tells you about the moment you ran it, so anything you need to know quickly has to be watched continuously.
Every tag and mechanism across DMARC, SPF, and DKIM, explained in one place.
DMARC
- vVersion
- The Version tag is essential in a DMARC record and must strictly be set to ‘DMARC1’. If this value is not correctly specified or if the tag is absent, the DMARC record will not be considered valid and will be disregarded.
- pDMARC policy
- The DMARC policy setting is crucial and accepts three possible values: ‘none’, ‘quarantine’, or ‘reject’. By default, it is set to ‘none’, which means it doesn’t actively intervene with emails that fail authentication. This setting primarily serves to gather DMARC reports, aiding in understanding the existing email traffic and its authentication status. On the other hand, the ‘quarantine’ option flags unauthenticated emails as dubious, and ‘reject’ outright prevents their delivery.
- ruaAggregate report destination
- The destination for sending aggregate reports is specified using a ‘mailto:’ URI, which Email Service Providers (ESPs) utilize to dispatch failure reports. While this tag is not mandatory, omitting it means you will not receive any reports.
- rufForensic report destination
- The destination for Forensic (Failure) report transmission is designated by a ‘mailto:’ URI, which is employed by Email Service Providers (ESPs) for the delivery of failure reports. Although this tag is not obligatory, failing to include it will result in not receiving any reports.
- spSubdomain policy
- The policy for subdomains defaults to inheriting the main domain’s policy tag (p=), as previously described, unless explicitly stated otherwise. Similar to the domain policy, the permissible values for subdomains are ‘none’, ‘quarantine’, or ‘reject’. However, this option is not commonly employed in current practices.
- adkimDKIM alignment
- The alignment of the DKIM signature, indicated by this tag, refers to the congruence between the DKIM domain and the originating domain in the ‘Header From’. The acceptable values for this tag are ‘r’ for relaxed and ‘s’ for strict. The default setting, ‘r’, permits a partial match between these domains, whereas the ‘s’ setting demands an exact match of the domains.
- aspfSPF alignment
- This tag pertains to the SPF alignment, which concerns the compatibility between the SPF domain (the sender) and the domain in the ‘Header From’. It allows two settings: ‘r’ for relaxed and ‘s’ for strict. By default, it is set to ‘r’, which tolerates a partial match between the domains. In contrast, the ‘s’ setting necessitates an exact correspondence of the domains.
- foForensic reporting options
- The options for forensic reporting include ‘0’, ‘1’, ‘d’, and ‘s’. The default setting is ‘0’, which triggers a forensic report only when both SPF and DKIM alignments do not pass. Use ‘1’ if the outcome of either SPF or DKIM is anything other than a pass. The option ‘d’ is selected to generate a report specifically for DKIM validation failures, and ‘s’ is used for SPF-related issues. To actually receive these forensic reports, it’s necessary to specify the ‘ruf’ tag.
- rfFailure report format
- The format for failure report generation can be set to either ‘afrf’ or ‘iodef’, as these are the two permissible options.
- pctPercentage (historic)
- The legacy Percentage tag asked receivers to apply a quarantine or reject policy to only part of the mail that failed DMARC. RFC 9989 removed pct because receivers implemented partial enforcement inconsistently. New records should omit it and stage rollout with aggregate reports, whole-policy changes, and low-volume subdomains.
- riReporting interval
- The Reporting interval specifies how often XML reports are received, measured in seconds. The standard setting is 86400 seconds, which equates to daily reporting. However, it’s important to note that despite the specified interval, Internet Service Providers (ISPs) typically send these reports on their own schedules, which in most cases, is also once a day.
SPF
- v
- The version tag must exclusively be “spf1”. Incorrect or missing versions result in the SPF record being disregarded.
- ip4
- This tag lists IPv4 addresses authorized to send emails for the domain.
- ip6
- This tag specifies IPv6 addresses permitted to email on the domain’s behalf.
- a
- The A record tag permits sender validation via the domain’s IP address, defaulting to the current domain if unspecified.
- mx
- The MX record tag validates the mail server’s MX record, defaulting to the current domain if not specified.
- ptr
- The PTR tag initiates a PTR check for client IP hostnames, advised against in RFC 7208 due to excessive DNS lookups.
- exists
- The exists tag verifies the presence of an A record on the specified domain.
- include
- The include tag is crucial for accurate SPF records, confirming all listed domains/subdomains as legitimate sending sources to recipients.
- all
- The all tag is mandatory, positioned at the SPF record’s end, guiding recipients on handling emails from unauthorized sources based on its qualifiers (~, +, -, ?).
DKIM
- v
- The version tag specifies DKIM’s version, consistently required to be 1.
- p
- The public key tag, a character string created in DKIM setup, must not be left empty to remain valid.
- t
- This tag enumerates flags as a colon-separated sequence, with “y” and “s” as defined flags; any undefined flags should be disregarded.
- s
- This tag details service types relevant to the record. Absent or unrecognized service types must be overlooked by receiving servers.
- h
- This tag specifies permitted hash algorithms, defaulting to allow all. Receivers should ignore unknown algorithms, with the sender determining the list’s entries.
- n
- This tag serves as an optional note field for administrators, recommended for use only when needed.