Deliverability Tester

Send a real message from your mail system to a one-time address, and MailShield checks its authentication, sender reputation and content, and estimates how receiving mail servers will treat it.

Open it from Deliverability Tester in the sidebar, under Tools.

How It Works

1. Click Generate Test Address. You get a one-time address such as a1b2c3d4@tester.mailshield.app, valid for 48 hours.
2. Send an email to that address from the system you want to test: your mail server, your application or your email service. The address can be in To, Cc or Bcc: MailShield matches the test by the envelope recipient, the address the message is actually delivered to.
3. Keep the page open. It updates when the message arrives and shows the results.

TIP

Send from the same server and domain that send your production mail, with typical content. A message sent from a webmail client doesn't test your real infrastructure.

To send a quick test from a server's command line:

echo "This is a test" | mail -s "Test Email" a1b2c3d4@tester.mailshield.app

The Score

Each test gets a score from 0 to 100, where higher is better. The score starts at 100 and each issue found deducts points.

Score	Verdict	Meaning
90-100	Excellent	Should reach the inbox
70-89	Good	Likely to reach the inbox
50-69	Fair	May be filtered
25-49	Poor	Likely to land in the spam folder
0-24	Critical	Very likely to be blocked

A DMARC failure under an enforcing policy decides delivery on its own, so it caps the score however well the message does otherwise: at p=reject the result is at most 24 (Critical), and at p=quarantine at most 49 (Poor).

The Score Breakdown in the results lists every deduction, including the DMARC cap when it applies. The score is an estimate: each mailbox provider runs its own filters and uses reputation data MailShield can't see.

What It Checks

Area	Checks
SPF	Whether the sending IP is authorized: pass, fail, softfail, neutral, none, permerror or temperror
DKIM	Each signature on the message, and whether the signing keys are at least 2048 bits. A signature that can't be verified, for example because the message changed in transit, shows as Inconclusive and costs no points
DMARC	Whether SPF or DKIM passed and aligned with the From domain, and the domain's DMARC policy
Reverse DNS	Whether the sending IP has a PTR record that points back to the sending host
Sender domain MX	Whether the From domain has valid MX records
Blocklists	Whether the sending IP is listed on DNS blocklists such as Spamhaus ZEN, Barracuda and SpamCop
Headers	A missing Message-ID or Date header, a date in the future, an unusually long chain of servers
Content	A missing plain-text part, oversized HTML, image-heavy messages, images without alt text, JavaScript or iframes, an all-caps or over-punctuated subject, suspicious phrases
Links	Link text showing a different domain than the actual URL, links over plain http://
Bulk mail	A List-Unsubscribe header without List-Unsubscribe-Post (needed for one-click unsubscribe)

Common Issues and Fixes

SPF Failures

Your sending IP isn't in your SPF record. Add the IP, or the service's include, to the record:

v=spf1 ip4:192.0.2.1 include:_spf.google.com -all

DKIM Signature Invalid

The signature didn't verify. Common causes: the message was modified after signing, the public key isn't published, or the published key doesn't match the signing key. Check that your mail server signs outgoing mail and that the key is published at selector._domainkey.yourdomain.com.

DMARC Alignment Failure

SPF or DKIM passed, but for a different domain than the one in the From header. Sign with your own domain (DKIM d=), or use a bounce address on your own domain. See Third-Party Senders.

Missing PTR Record

Your sending IP has no reverse DNS. Ask your hosting provider or ISP to set a PTR record for the IP that points to your mail server's host name, and make sure that host name resolves back to the IP.

Blocklisted IP

1. Find out why the IP was listed, and stop the cause (for example a compromised account or an unsecured form).
2. Follow the blocklist's delisting instructions.
3. On a shared IP, ask your provider, or consider a dedicated IP.

Test History

Your recent tests are listed on the tester page, so you can compare results after making changes. Test addresses stop accepting mail after 48 hours, and MailShield deletes old tests and their results automatically.