Does this tool send email, or keep what I paste?

No, and no. Everything comes from public DNS, looked up over DNS-over-HTTPS with a hard budget of 12 queries per check — no message is sent and no mailbox is touched. Headers you paste are parsed in memory to answer the run that asked for them, and are never written to a database or a log. A domain-only result is cached for ten minutes so a shared link does not re-query DNS; a check that carries headers or your own selector is never cached at all.

Why does DKIM come back as “not checked”?

Because DKIM selectors are arbitrary names, and there is no DNS record that lists them. We try the selector you enter, any selector found in headers you paste, and about twenty selectors the common sending platforms use — but a domain signing with a name nobody else uses will look empty. That is why the row says “not checked” rather than “fail”: absence of a key at the names we tried is not proof of absence. Enter your selector (the s= value in a DKIM-Signature header) and it becomes a definite answer.

I send fewer than 5,000 messages a day. Do these rules apply to me?

Partly. Every sender, at any volume, needs SPF or DKIM, forward-confirmed reverse DNS on the sending IP, TLS on the connection and a spam-complaint rate under 0.3%. The extra bulk requirements — both SPF and DKIM, a DMARC record, From-domain alignment and RFC 8058 one-click unsubscribe — start at 5,000 messages a day to a single provider, counted per provider. In practice a single large campaign crosses it, so the safe assumption is that the bulk rules apply to you.

What counts as a good grade?

A means every check we could run passes. B means nothing fails and at most two rows carry a warning. C means three or more warnings. D means a required check outside authentication fails — one-click unsubscribe headers, reverse DNS or MX. F means SPF, DKIM or DMARC fails, which is the one that gets bulk mail rejected. Rows marked “not checked” never move the grade, so a domain-only check tops out at what DNS alone can prove; paste headers to make the alignment, unsubscribe and reverse-DNS rows real.

Tools · Sender check

Will Gmail, Yahoo and Outlook accept your bulk mail?

Enter a sending domain. We read its public DNS and grade it against the bulk-sender rules the three providers actually enforce — SPF, DKIM key size, DMARC and alignment, MX, reverse DNS — and, if you paste the headers of a real message, the one-click unsubscribe headers that almost nothing else checks. No account, nothing stored.

Sending domain

The domain in your From address. An email address or a full URL is fine too — we take the domain out of it.

DKIM selector · optional

The s= value from a DKIM-Signature header. Without it we try about twenty common selectors.

Paste raw message headers (optional, and the only way to check unsubscribe headers)

Headers from a message you actually sent turn four “not checked” rows into real answers: From-domain alignment, the RFC 8058 one-click unsubscribe headers, the reverse DNS of the IP you really send from, and whether the receiver recorded a pass. They are parsed in memory for this one check and never stored.

Gmail (web): Open the message, click the three dots at the top right of it, then “Show original”. Copy everything in the box that appears — the block above the first blank line is what we read.
Outlook.com and new Outlook: Open the message, click the three dots, then View → View message source. In classic Outlook for Windows: open the message in its own window, File → Properties, and copy the “Internet headers” box.
Apple Mail: Select the message, then View → Message → Raw Source (⌥⌘U), or View → Message → All Headers (⇧⌘H). Copy the header block.

Raw headers

Up to 32 KB. Paste the whole “Show original” output if that is easier — we stop reading at the first blank line.

The form above runs the check in your browser, so it needs JavaScript. With JavaScript off you can still get a full result: go to sendbeam.io/tools/sender-check/yourdomain.com — that page runs the same check on the server. Pasting headers needs the form.

The rules being checked

What Gmail, Yahoo and Microsoft require.

Three separate policies that have converged on nearly the same list. The volume thresholds are counted per provider, per day, so a single campaign to a mixed list can cross all three at once.

Gmail

Every sender

SPF or DKIM on the sending domain.
Forward-confirmed reverse DNS: the sending IP has a PTR, and that name resolves back to the same IP.
A TLS connection for delivery.
Spam-complaint rate under 0.3%, measured in Postmaster Tools.
Valid RFC 5322 formatting and a From domain that resolves.

From 5,000 a day to Gmail

SPF and DKIM, both.
A DMARC record on the From domain (p=none is enough to comply).
The From domain aligned with the SPF domain or the DKIM d=.
RFC 8058 one-click unsubscribe on marketing mail, honoured within two days, plus a visible unsubscribe link.

Google: Email sender guidelines

Yahoo

Since February 2024

The same shape as Gmail, published jointly with it: SPF and DKIM, DMARC with alignment, one-click unsubscribe.
The complaint-rate ceiling is the same 0.3%, watched across Yahoo, AOL and their other domains.
Unsubscribes must take effect within two days, whichever route the reader used.
No mixing streams: transactional receipts and marketing on the same domain make one bad campaign poison the other.

Yahoo: Sender best practices

Microsoft

From 5 May 2025

Domains sending more than 5,000 a day to Outlook.com, Hotmail or Live addresses need SPF, DKIM and DMARC together.
DMARC at p=none minimum, with SPF or DKIM aligned to the From domain.
A working unsubscribe, and a From domain that accepts mail — valid MX, so replies and reports reach somebody.
Failing mail goes to the junk folder first; rejection follows.

Microsoft: Outlook’s requirements for high-volume senders

The one everybody gets wrong

One-click unsubscribe is two headers and a POST.

A List-Unsubscribe header on its own is not one-click, and has not been enough since February 2024. RFC 8058 asks for two headers working together:

List-Unsubscribe: <https://example.com/u?c=abc&t=sig>, <mailto:unsub@example.com>
List-Unsubscribe-Post: List-Unsubscribe=One-Click

The second header is a promise: it tells the mailbox provider that the HTTPS URL will accept an unauthenticated POST with the body List-Unsubscribe=One-Click and act on it, with no landing page, no login and no confirmation step. That is what lets Gmail and Yahoo put their own “Unsubscribe” button next to your sender name.

Three failure modes account for nearly every fail on this row. A mailto: URI only — old, still common, no longer sufficient. An HTTPS URL with no List-Unsubscribe-Post, which providers will not press because nothing promised the POST is safe. And a URL that unsubscribes on GET, which link scanners and preview fetchers will trip on your readers’ behalf.

The header does not replace the link in the footer. Both are required, and both must take effect within two days.

RFC 8058

What SendBeam sets for you

Not a sales pitch, a list of what the code emits — so you know which rows of the scorecard stop being your problem.

Both unsubscribe headers, on every send. List-Unsubscribe carries an HTTPS URL and List-Unsubscribe-Post: List-Unsubscribe=One-Click goes with it. The URL is HMAC-signed per contact and per campaign, and the POST unsubscribes immediately.
A visible unsubscribe link. If a campaign’s HTML does not already contain one, a footer link is appended before the message goes out, so the body requirement is met whatever you designed.
DKIM signing and a return path on your own domain. Add a sending domain and SendBeam’s managed delivery issues the DKIM and return-path records for it; you add one CNAME per label, which keeps the records pointing at sendbeam.io rather than pasting a key into your zone.
TLS and reverse DNS on the sending infrastructure. Both belong to the delivery layer, not to your DNS, and both are already in place on SendBeam’s managed delivery.

What stays yours: the DMARC record on your From domain — nobody else can publish it for you, and p=none is enough to comply — plus the spam-complaint rate, which is a function of who you write to and how often. SendBeam does not currently set a Feedback-ID header; the scorecard flags that as advisory, and it never moves the grade.

Questions

Questions.

Does this tool send email, or keep what I paste?: No, and no. Everything comes from public DNS, looked up over DNS-over-HTTPS with a hard budget of 12 queries per check — no message is sent and no mailbox is touched. Headers you paste are parsed in memory to answer the run that asked for them, and are never written to a database or a log. A domain-only result is cached for ten minutes so a shared link does not re-query DNS; a check that carries headers or your own selector is never cached at all.
Why does DKIM come back as “not checked”?: Because DKIM selectors are arbitrary names, and there is no DNS record that lists them. We try the selector you enter, any selector found in headers you paste, and about twenty selectors the common sending platforms use — but a domain signing with a name nobody else uses will look empty. That is why the row says “not checked” rather than “fail”: absence of a key at the names we tried is not proof of absence. Enter your selector (the s= value in a DKIM-Signature header) and it becomes a definite answer.
I send fewer than 5,000 messages a day. Do these rules apply to me?: Partly. Every sender, at any volume, needs SPF or DKIM, forward-confirmed reverse DNS on the sending IP, TLS on the connection and a spam-complaint rate under 0.3%. The extra bulk requirements — both SPF and DKIM, a DMARC record, From-domain alignment and RFC 8058 one-click unsubscribe — start at 5,000 messages a day to a single provider, counted per provider. In practice a single large campaign crosses it, so the safe assumption is that the bulk rules apply to you.
What counts as a good grade?: A means every check we could run passes. B means nothing fails and at most two rows carry a warning. C means three or more warnings. D means a required check outside authentication fails — one-click unsubscribe headers, reverse DNS or MX. F means SPF, DKIM or DMARC fails, which is the one that gets bulk mail rejected. Rows marked “not checked” never move the grade, so a domain-only check tops out at what DNS alone can prove; paste headers to make the alignment, unsubscribe and reverse-DNS rows real.

Built by SendBeam, which sets the unsubscribe headers above on every message it sends. The tool is free either way, and works on any domain.

Start

Start with the site you run today.

Free to start, no card, no trial clock. Each site keeps its own domain, list and rules; you add the next one as a workspace whenever you launch it.

Start free Talk to us

Checking system status