Health Checks Explained
The Domain Health Monitor runs 19 individual checks grouped into 5 categories. Here's what each check does, why it matters, and what to do when it fails.
Authentication
These are the foundation of email deliverability. Google, Yahoo, and Microsoft all require them for bulk senders.
SPF (Sender Policy Framework)
What it checks: Looks for a valid SPF TXT record on your domain that authorizes your sending servers.
Why it matters: Without SPF, receiving servers can't verify that your emails come from authorized servers. This leads to spam folder placement or outright rejection.
Scoring:
| Condition | Score |
|---|---|
Valid SPF with -all (hardfail), under 10 DNS lookups | 100 |
Valid SPF with ~all (softfail) | 85 |
Valid SPF with ?all (neutral) | 50 |
| SPF with more than 10 DNS lookups | 40 |
Missing SPF, multiple records, or +all | 0 |
DKIM (DomainKeys Identified Mail)
What it checks: Looks for a DKIM public key in DNS for your configured selector (or tries common selectors for your ESP).
Why it matters: DKIM cryptographically signs your emails, proving they haven't been tampered with in transit. Together with SPF, it enables DMARC alignment.
Scoring:
| Condition | Score |
|---|---|
| Valid 2048-bit key found | 100 |
| Valid key but unknown size | 80 |
| Valid 1024-bit key (weak) | 70 |
| No key found or revoked key | 0 |
If DKIM fails with "No record found", set your DKIM selector in SMTP Connections > Edit > Domain Health Monitoring. Common selectors: s1/s2 (SendGrid), selector1/selector2 (Mailgun/SparkPost), google (Google Workspace).
DMARC (Domain-based Message Authentication)
What it checks: Looks for a DMARC TXT record at _dmarc.yourdomain.com and evaluates the policy level and reporting configuration.
Why it matters: DMARC ties SPF and DKIM together and tells receivers what to do with unauthenticated emails. Without DMARC, anyone can spoof your domain.
Scoring:
| Policy | Score |
|---|---|
p=reject with reporting | 100 |
p=quarantine (pct=100) | 85 |
p=quarantine (pct < 100) | 70 |
p=none with reporting (monitoring) | 50 |
p=none without reporting | 30 |
| Missing entirely | 0 |
DMARC Alignment
What it checks: Whether both SPF and DKIM are configured (enabling full DMARC alignment).
Scoring: Both pass = 100, only one passes = 70, neither passes = 0.
Reputation
Domain Blacklists
What it checks: Queries your domain against 6 major DNS-based blocklists: Spamhaus DBL, URIBL, SURBL, Invaluement, SEM-FRESH, and SEM-FRESH30.
Why it matters: If your domain is blacklisted, emails will be blocked or spam-filtered by the majority of receiving servers worldwide.
Scoring: Clean on all lists = 100, listed on Tier 2/3 only = 50, listed on Tier 1 (Spamhaus) = 0.
A Spamhaus listing caps your overall grade at D. Visit Spamhaus to request delisting.
IP Blacklists
What it checks: If you've configured dedicated sending IPs, queries each IP against 6 IP blocklists: Spamhaus ZEN, Barracuda, SpamCop, SORBS, SpamRATS, and CBL.
When it runs: Only when dedicated IPs are configured. Shows "info" status otherwise (doesn't affect score).
DNS & Infrastructure
MX Records
What it checks: Verifies your domain has valid MX records that resolve to reachable mail servers.
Why it matters: Without MX records, your domain can't receive email — including bounce notifications, reply emails, and DMARC aggregate reports.
Reverse DNS (PTR)
What it checks: For each dedicated IP, verifies a PTR record exists, the hostname is non-generic, and forward-confirmed reverse DNS (FCrDNS) passes.
When it runs: Only when dedicated IPs are configured.
Why it matters: Gmail and Outlook require valid rDNS since 2024. Messages from IPs without PTR records are often rejected outright.
STARTTLS
What it checks: Connects to your primary MX server and verifies it supports STARTTLS for encrypted email transport.
Why it matters: Google requires TLS encryption for bulk senders. Unencrypted email transit is a reputation signal.
MTA-STS
What it checks: Looks for an MTA-STS DNS record and policy file that enforces TLS connections (preventing downgrade attacks).
Scoring: Enforce mode = 100, testing mode = 70, missing = 0.
TLS-RPT
What it checks: Looks for a TLS Reporting DNS record so you can receive daily reports about TLS connection failures.
BIMI
What it checks: Looks for a BIMI DNS record with your brand logo and optional VMC certificate.
Why it matters: BIMI displays your brand logo next to emails in Gmail, Apple Mail, and Yahoo. It requires DMARC at quarantine or reject level.
Scoring: Logo + VMC = 100, logo only = 80, missing = 0 (informational — doesn't penalize your score).
Sending Metrics
These checks use your actual email sending data from the last 7-30 days. They show "info" status if you haven't sent any campaigns yet.
Bounce Rate
What it checks: Percentage of emails that bounced (hard + soft) over the last 7 days.
| Rating | Threshold |
|---|---|
| Healthy | < 2% |
| Warning | 2% - 5% |
| Critical | > 5% |
How to improve: Remove invalid addresses, use email verification on imports, implement double opt-in for signups.
Complaint Rate
What it checks: Percentage of delivered emails marked as spam by recipients over the last 7 days.
| Rating | Threshold |
|---|---|
| Healthy | < 0.1% |
| Warning | 0.1% - 0.3% |
| Critical | > 0.3% (grade capped at C) |
How to improve: Only send to opted-in contacts, make unsubscribe prominent, match content to expectations, send at a consistent frequency.
Complaint rates above 0.3% cause Gmail and Yahoo to reject your emails. This is the single most impactful metric for deliverability.
Volume Trend
What it checks: Consistency of your daily sending volume over the last 30 days.
| Rating | Threshold |
|---|---|
| Healthy | < 20% day-over-day variance |
| Warning | 20% - 50% variance |
| Critical | > 50% spike or > 80% drop |
How to improve: Maintain a consistent sending schedule. When increasing volume, ramp up gradually (no more than 20% per day).
Engagement Rate
What it checks: Unique open rate and click rate over the last 7 days.
| Rating | Threshold (Open Rate) |
|---|---|
| Healthy | > 20% |
| Warning | 10% - 20% |
| Critical | < 10% |
How to improve: Write compelling subject lines, segment your audience, optimize send times, and remove subscribers who haven't engaged in 6+ months.
Compliance
Unsubscribe Headers
What it checks: Verifies that List-Unsubscribe and List-Unsubscribe-Post headers (RFC 8058 one-click unsubscribe) are included in your outgoing emails.
Score CRM automatically adds these headers to every email — this check passes for all active connections.
Bulk Sender Compliance
What it checks: A composite evaluation of all Google/Yahoo/Microsoft 2024-2025 bulk sender requirements:
- SPF authentication configured
- DKIM authentication configured
- DMARC policy at quarantine or reject
- One-click unsubscribe headers present
- Complaint rate below 0.3%
All five must pass for full compliance. The fix instructions list exactly which requirements are failing.
Domain Expiration
What it checks: Your domain's WHOIS registration expiry date.
| Rating | Days Until Expiry |
|---|---|
| Healthy | > 90 days |
| Caution | 30 - 90 days |
| Warning | 7 - 30 days |
| Critical | < 7 days or expired (grade F) |
If your domain expires, all DNS records (SPF, DKIM, DMARC, MX) are instantly lost. Email delivery stops completely. Enable auto-renewal at your registrar.