Sample Spam Report
What the Email Spam Checker returns for one email: the spam score, the three buckets, the fixes in order of impact, and the message's headers.
The report
Sample spam report for acme.example
Generated with Palisade's free tools: create an account at app.palisade.email for white-label PDF reports.
Sample report for acme.example
A worked example: a Mailchimp campaign sent for a domain that was never authenticated in Mailchimp. Run your own test
Spam score
49 of 100 · Grade F
Higher is better.
Scored on the 94 pts we could evaluate.
High risk. Failed DMARC and IP blocklist checks set the verdict, whatever the number. 7 problems to fix, starting with DMARC result.
Band and grade set by the DMARC and IP blocklist failures, not the number.
Fix these in order
Biggest impact first. Each one says what we saw, why receivers care, and what to change.
DMARC passes when SPF or DKIM passes and aligns with the From domain. A DMARC fail tells every receiver that the From address could not be tied to an authorized sender, and under an enforcing policy the message is quarantined or rejected.
- Fail: DMARC result: Neither SPF nor DKIM passed and aligned with the From domain.
Fix
Neither SPF nor DKIM passed and aligned with acme.example. Fix alignment first: an aligned DKIM signature is the durable route because it survives forwarding.
Sources: RFC 9989 (DMARC)
Receivers look the connecting IP up on public blocklists before reading a word of the message. A listing on a major list (Spamhaus, SpamCop, Barracuda) gets mail rejected or junked on its own; minor lists carry less weight but still count.
- Spamhaus ZENNot listed
- SpamCop (SCBL)Request removalListed
- Barracuda (BRBL)Not checked: the list did not answer our resolver.Not evaluated
- UCEPROTECT Level 1Not listed
- PSBLNot listed
- MailspikeNot listed
- DroneBLNot listed
Fix
198.51.100.24 is listed on SpamCop (SCBL). Find out why (a compromised account, an open relay, a bad list), fix the cause, then request removal from the list's own page. Retest after delisting.
The DMARC record, published at _dmarc under the From domain, tells receivers what to do with mail that fails authentication and where to send reports. Without a record, nothing stops spoofing; with p=none, spoofing is only observed; with p=quarantine or p=reject, it is stopped.
- Pass: Record exists: A v=DMARC1 record is published.
- Warn: Policy: p=none: receivers report failures but deliver the mail.
_dmarc.acme.example TXT
v=DMARC1; p=none; rua=mailto:dmarc@acme.exampleFix
acme.example is at p=none: receivers report failures but deliver spoofed mail anyway. Once every legitimate sender passes, move to p=quarantine, then p=reject.
Also lets BIMI be evaluated: up to 3 pts more if it passes.
Sources: RFC 9989 (DMARC), Google email sender guidelines, Yahoo sender best practices
SPF lets a domain publish which servers may send mail for it. Receivers look up the Return-Path domain's SPF record and check the connecting IP against it. A pass that is aligned with the From domain is what DMARC needs; a pass on an unrelated bounce domain proves nothing about the From address.
- Pass: SPF result: mail.mcsv.net authorizes 198.51.100.24.
- Fail: Alignment: Return-Path bounce@mail.mcsv.net is not acme.example.
Fix
SPF passed for the bounce domain, not for acme.example, so it does not help DMARC. Use a custom Return-Path on acme.example (most platforms call this a custom bounce or MAIL FROM domain), or rely on an aligned DKIM signature.
Sources: RFC 7208 (SPF), Google email sender guidelines
DKIM signs the message with a private key; the public key lives in DNS under the signing domain and selector. A signature that verifies and whose domain aligns with the From domain is the strongest authentication signal a receiver gets, and the one that survives forwarding.
- Pass: Signature verifies: k1._domainkey.mailchimpapp.net matched.
- Fail: Alignment: Signed by mailchimpapp.net, not the From domain.
Fix
DKIM verifies, but it was signed by a different domain than acme.example, so it does not help DMARC. Set up the platform's custom signing domain so the signature uses acme.example.
Filters parse the HTML the way an old mail client would. Unclosed tags, hidden text, iframes and scripts, a wall of links, or an image with almost no text all read as spam structure, whatever the words say.
- Pass: Plain-text part: Message includes both HTML and a plain-text alternative.
- Pass: Link count: Healthy balance of text and links.
- Fail: Text to image ratio: Mostly images with little text: a classic spam-filter trigger.
Fix
Fix the flagged rows: add a plain-text part, balance images with real text, cut the number of links, and remove hidden text, scripts, forms and iframes.
Alt text, heading order, meaningful link text, a language attribute and readable contrast make the message usable with a screen reader and in dark mode, and the same structure reads as legitimate to filters.
- Fail: Alt text: 2 of 5 images have no alt text.
- Fail: Language attribute: The html element has no lang attribute.
- Pass: Heading order: No skipped heading levels.
- Pass: Link text: No bare "click here" links.
Fix
Fix the flagged rows: alt text on every image, headings in order, link text that says where it goes, lang on the html element, and contrast of at least 4.5:1 on buttons.
Everything else we checked (14)
Checks that could not be evaluated, observations that carry no points, and the checks that passed.
- BIMI3 pts, counted as 0 until DMARC record is fixed
BIMI is only evaluated once the domain enforces DMARC (p=quarantine or p=reject).
- Spam filter score4 pts not counted
Spam filter scan was not available for this message.
- Body link blocklists2 pts not counted
Spam filter scan was not available for this message.
- Not evaluated: ARC: No ARC seal on this message, which is normal for direct sends.
- Pass: HTML to text ratio: 1.8, with a plain-text part.
- Pass: Domain blocklists: acme.example, mail.mcsv.net and mailchimpapp.net are not on any domain blocklist.
- Pass: Reverse DNS: Sending IP 198.51.100.24 resolves to mail198.atl51.mcsv.net, which resolves back and matches HELO.
- Pass: Domain age: acme.example was registered in 2014.
- Pass: Domain suffix: The .example suffix carries no special spam reputation.
- Pass: Subject line: The subject line follows anti-spam best practices.
- Pass: One-click unsubscribe: is set up: List-Unsubscribe with an https URL and List-Unsubscribe-Post are both present.
- Pass: Broken links: All 6 links answered.
- Pass: URL shorteners: No URL shorteners in the message.
- Pass: Attachments and size: No risky attachments, and the message is under Gmail's clipping threshold.
- Pass: full points
- Warn: half points, rounded down
- Fail: no points
- Not evaluated: not counted, or counted as 0 while it waits on another fix
Headers
Delivery path (Received chain)
2 hops from origin to our receiving server, total delivery time 3s
| Hop | From | By | Protocol | Time (UTC) | Delay |
|---|---|---|---|---|---|
| 1 | localhost[127.0.0.1] | mail198.atl51.mcsv.net | ESMTP | Tue, 18 Aug 2026 14:02:11 UTC | — |
| 2 | mail198.atl51.mcsv.net[198.51.100.24] | inbound-smtp.us-east-1.amazonaws.com | ESMTPS | Tue, 18 Aug 2026 14:02:14 UTC | 3s |
Hop 1 is the origin server (the bottom Received header). Delay is the time elapsed since the previous hop; * marks negative values caused by clock skew.
Authentication results
As recorded by the receiving server (amazonses.com).
mail.mcsv.net
smtp.mailfrom=mail.mcsv.net
mailchimpapp.net
selector k1
acme.example
Key headers
The identity, client, and routing fields worth reading first.
| Subject | Summer product update |
| From | Acme <hello@acme.example> |
| To | sample@test.palisade.email |
| Return-Path | <bounce@mail.mcsv.net> |
| Date | Tue, 18 Aug 2026 14:02:11 +0000 |
| Message-ID | <sample-20260818@mail.mcsv.net> |
| List-Unsubscribe | <https://acme.example/unsubscribe?u=sample>, <mailto:unsubscribe-sample@mail.mcsv.net> |
| MIME-Version | 1.0 |
| Content-Type | multipart/alternative; boundary="sample" |
All headers
14 header lines, unfolded.
Return-Path: <bounce@mail.mcsv.net>
Received: from mail198.atl51.mcsv.net (mail198.atl51.mcsv.net [198.51.100.24]) by inbound-smtp.us-east-1.amazonaws.com with ESMTPS id 4s7k2p9q1x for <sample@test.palisade.email>; Tue, 18 Aug 2026 14:02:14 +0000 (UTC)
Received: from localhost (localhost [127.0.0.1]) by mail198.atl51.mcsv.net (Mailchimp) with ESMTP id 9GZ0kP3Sw; Tue, 18 Aug 2026 14:02:11 +0000
Authentication-Results: amazonses.com; spf=pass smtp.mailfrom=mail.mcsv.net; dkim=pass header.i=@mailchimpapp.net header.s=k1; dmarc=fail header.from=acme.example
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mailchimpapp.net; s=k1; h=From:To:Subject:Date:Message-ID:List-Unsubscribe; bh=sample; b=sample
From: Acme <hello@acme.example>
To: sample@test.palisade.email
Subject: Summer product update
Date: Tue, 18 Aug 2026 14:02:11 +0000
Message-ID: <sample-20260818@mail.mcsv.net>
List-Unsubscribe: <https://acme.example/unsubscribe?u=sample>, <mailto:unsubscribe-sample@mail.mcsv.net>
List-Unsubscribe-Post: List-Unsubscribe=One-Click
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="sample"DMARC is failing for your domain
Palisade reads your DMARC reports, finds every sender failing alignment, and drafts the fix for each. You approve before anything ships.
Fix DMARCWhat each section means
- Band, grade and verdict
- The band (High risk, At risk, Solid, Excellent) is the short answer, and the verdict sentence says what drives it. A failed DMARC check, a failed SPF or DKIM check while DMARC does not pass, or a listing on a major IP blocklist sets the band to High risk and the grade to F whatever the number, because receivers act on those alone. Otherwise the grade is the letter for the score, A to F.
- Spam score and the three buckets
- The score is out of 100, higher is better. Authentication is worth 50 points, sender reputation 30 and content quality 20. A pass earns a check's full points, a warn earns half (rounded down), a fail earns none. The score is the share of the points we could evaluate, so a check we could not run is left out and never lowers it.
- Fix these in order
- Every failed or warned check, biggest gain first. Open one to see the sub-checks, the DNS records or headers it read, the fix with the message's own values filled in, and the requirement it comes from. The points chip counts what the fix itself earns; a line under the fix says when it also lets other checks be evaluated.
- Not evaluated and passed
- A check waiting on another fix (BIMI needs an enforcing DMARC policy) is counted as 0 until that fix lands, and scores only if it then passes. A check that could not run (no spam filter available) is left out of the score with the reason. Passed checks are listed so you can see what already works.
- Headers
- The headers our receiving server stored, run through the same browser-side parser as the email header analyzer: the delivery path hop by hop, the recorded authentication results, and the identity headers.
The report above is a worked example, not a live test. To see your own, create a test address and send it one real email.