Email health check: a diagnostic order that finds the problem fast

Check in this order: authentication, then reputation and blocklists, then list quality and engagement, then content and recent changes. The order is not arbitrary — the first two are binary and take minutes, the third needs data you already have, and the fourth is where almost everyone starts and almost nobody finds the cause.

Step 1: Authentication (five minutes, binary)

Authentication either passes or it does not, and a failure explains everything else. Run these from any terminal:

dig txt example.com +short                      # SPF
dig txt selector1._domainkey.example.com +short # DKIM (selector varies)
dig txt _dmarc.example.com +short               # DMARC
dig mx example.com +short
dig -x 203.0.113.7 +short                       # PTR for your sending IP

What has to be true:

• Exactly one SPF record, under 10 DNS lookups and 2 void lookups, ending in ~all or -all.
• A DKIM key published at the selector your sender actually signs with, and a signature that verifies on the delivered message.
• A DMARC record, and — this is the part that gets missed — the domain in the visible From header must align with the SPF or DKIM domain. SPF passing for your ESP's bounce domain does not give you DMARC alignment.
• A PTR record for the sending IP that resolves forward to the same IP.

Do not take a DNS checker's word for it. Open a message you actually received and read the Authentication-Results header:

Authentication-Results: mx.google.com;
  dkim=pass header.i=@example.com;
  spf=pass (google.com: domain of bounce@mail.example.com designates 203.0.113.7) smtp.mailfrom=bounce@mail.example.com;
  dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=example.com

Three passes and alignment on header.from. Anything else, stop here and fix it.

Step 2: Reputation and blocklists (ten minutes)

• Google Postmaster Tools for spam rate, authentication rates and delivery errors on your domain. Note that the domain reputation chart was retired, so judge by spam rate and the user-reported spam graph instead — Google's published threshold is below 0.3%, and you want to be nearer 0.1%.
• Microsoft SNDS if you send from your own IPs; it covers IP-level data for Outlook.com and Hotmail.
• Blocklists: check your sending IP and your domain against the lists that actually influence delivery — Spamhaus (SBL/XBL/CSS/DBL), Barracuda, SpamCop, UCEPROTECT, Abusix, plus the URI lists for your link domains. Validity launched the Heatwave blocklist on 3 September 2026, so include it if your tooling supports it. Do not chase listings on defunct services; SORBS shut down in June 2024.

A listing on Spamhaus SBL or a Google spam rate above 0.3% is your answer. Stop and remediate rather than continuing down the list.

Step 3: List quality and engagement (twenty minutes)

Pull the last 30 days from your sending platform:

Then look at *where* the addresses came from. An import, a purchased list, a pattern-generated list, or a re-engagement send to addresses untouched for two years will produce all of the above at once. Also check whether anyone is sending to addresses that previously hard bounced — a suppression list that is not enforced is a common cause of a sudden relapse.

Step 4: Content and recent change (last, briefly)

Content matters far less than the internet implies, but *change* matters a lot. Ask what changed in the week before the problem started:

• New sending domain, new subdomain, new IP, new ESP, new MTA
• A volume increase of more than roughly 50% day over day
• A new link domain, a new tracking subdomain, a public shortener introduced into templates
• A template switch to image-heavy HTML, or a footer change that dropped the unsubscribe
• A new sending mailbox added with no warm-up

Then check the mechanical content items: live-text unsubscribe present, List-Unsubscribe and List-Unsubscribe-Post headers present for bulk streams, HTML under about 100KB so Gmail does not clip it, a plain-text alternative part, and no attachments in a marketing send.

Symptom to likely cause

Quick check versus full check

Run the quick version — authentication headers, Postmaster spam rate, bounce and complaint rate — weekly, and after any infrastructure change. Run the full version when reply rates drop by more than about a third, before a large seasonal send, when you add a domain or an ESP, and when you inherit someone else's setup.

What not to do while diagnosing

• Do not change three things at once. You will fix it and never know what it was.
• Do not request blocklist delisting before you have stopped the behaviour that caused it.
• Do not jump to p=reject on DMARC while you are still discovering legitimate sending sources.
• Do not raise volume to "test whether it is fixed".
• Do not trust the sent folder, or a test to your own mailbox on the same provider. Self-tests lie, because your own mailbox has engagement history with you.

MailPilot automates most of this loop: it checks SPF, DKIM and DMARC against delivered mail, tracks per-mailbox reputation daily, and uses a seed-inbox network to report real inbox placement per provider — so the health check runs continuously instead of after someone notices the replies stopped.