Domain Health FAQ
Why is my domain health score lower than expected?
The score is a weighted average across 5 categories. Even if your authentication is perfect (SPF/DKIM/DMARC), issues in other areas — like missing MTA-STS, no TLS-RPT, or a high bounce rate — will bring the score down. Check the detail view to see which specific checks are failing.
Why do some checks show "info" instead of pass/fail?
Checks that require optional configuration show "info" when that configuration isn't set up:
- Reverse DNS and IP Blacklists need dedicated IPs configured
- Sending Metrics (bounce rate, complaint rate, etc.) need at least 7 days of sending data
- BIMI shows info when not configured (it's optional and doesn't penalize your score)
Info-status checks are excluded from scoring — they don't lower your grade.
My DKIM check is failing but I have DKIM configured. What's wrong?
The check might be looking at the wrong DKIM selector. Go to SMTP Connections > Edit > Domain Health Monitoring and set your DKIM Selector explicitly. Common selectors:
| Provider | Selectors |
|---|---|
| SendGrid | s1, s2 |
| Mailgun | selector1, selector2 |
| SparkPost | sparkpostmail |
| AWS SES | Unique per identity (check SES console) |
| Google Workspace | google |
What is "Bulk Sender Compliance" and why does it matter?
It's a composite check that evaluates all five requirements enforced by Google, Yahoo, and Microsoft for bulk senders (5,000+ emails/day):
- SPF authentication
- DKIM authentication
- DMARC at quarantine or reject
- One-click unsubscribe headers
- Complaint rate below 0.3%
Failing any of these can result in your emails being rejected (Gmail returns 550; 5.7.515 errors) or placed in spam.
My complaint rate is above 0.3%. What do I do?
This is urgent — Gmail and Yahoo actively reject emails from senders above 0.3%. Immediate steps:
- Pause non-essential campaigns to stop the bleeding
- Review recent campaigns for content that might trigger complaints
- Make unsubscribe prominent — buried or hard-to-find unsubscribe links increase complaints
- Remove unengaged subscribers who haven't opened emails in 6+ months
- Implement a sunset policy for inactive contacts
My domain is on Spamhaus. Why is my grade capped at D?
Spamhaus is the most widely used blocklist, protecting over 3 billion mailboxes. A listing severely impacts deliverability across Gmail, Outlook, Yahoo, and most corporate email servers. The grade cap reflects this real-world impact. Visit Spamhaus to request delisting.
Do I need MTA-STS and TLS-RPT?
They're recommended but not mandatory. MTA-STS enforces TLS encryption for incoming email (preventing downgrade attacks). TLS-RPT lets you receive reports about TLS failures. Both improve your security posture and health score, but missing them won't critically impact deliverability.
What is BIMI and do I need it?
BIMI (Brand Indicators for Message Identification) displays your brand logo next to emails in Gmail, Apple Mail, and Yahoo. Requirements:
- DMARC at quarantine or reject
- SVG logo in Tiny 1.2 P/S format
- Optional: VMC certificate for a blue checkmark in Gmail
It's optional and won't lower your score if missing. But it improves brand trust and recognition.
How often do the automated checks run?
Once daily at 3 AM UTC. You can also run an on-demand check anytime (limited to once per minute per organization).
Will the domain expiration check work for all domain extensions?
Most common TLDs work (.com, .net, .org, .io, .co, etc.). Some country-code TLDs (ccTLDs) have WHOIS servers that don't return expiry dates or rate-limit aggressively. In those cases, the check shows "Could not determine expiration date."
Can I turn off notifications?
Notifications cannot be disabled per-org currently. You can mark them as read or they auto-delete after 30 days. A notification preference setting will be available in a future update.