All 11 Checks Explained
Every check we run, what it means, and how to fix it when it's not passing. No jargon — or at least, every bit of jargon explained.
1. SPF
What it is: a DNS record listing which servers are allowed to send email for your domain. Receivers check the connecting server against that list.
When it fails: your sending server isn't in the list — often because you started sending through a new SMTP provider and never added its include: to your SPF record.
Fix: add your provider's include (e.g. include:spf.brevo.com) to the v=spf1 TXT record on the sending domain. One record only — multiple SPF records are themselves an error.
2. Sending-Domain Alignment (SPF root)
What it is: a WordPress-specific check most generic tools miss. Your From address says one domain, but the email may technically be sent via a subdomain or your email provider's own domain.
Important: sending through a provider domain (Brevo, Mailgun's mg. subdomain, etc.) is normal and healthy — as long as DKIM aligns with your From domain, DMARC passes and we show this as a pass. We only warn when neither SPF coverage nor DKIM alignment exists, which genuinely breaks DMARC.
3. SPF Lookup Limit
What it is: SPF allows at most 10 DNS lookups per check (RFC 7208). Every include:, a, mx, ptr and exists costs one — and includes count recursively through the whole chain. Go over the limit and SPF returns permerror: your record silently stops working even though every entry in it is correct.
Why it sneaks up on you: each email service you add ("just one include") can pull in two or three nested lookups of its own. Most senders have no idea how close they are — we walk the full chain and show you every lookup, numbered.
Fix: remove includes for services you no longer use, or flatten the record — replace an include: with the ip4:/ip6: address blocks it resolves to. Provider IPs change over time, so re-check flattened records periodically.
4. DKIM
What it is: a cryptographic signature on every email, verified against a public key in your DNS. Proves the email wasn't forged or altered.
Special case — "DKIM Record Problem": if your email IS signed but receivers can't read the key record (a permerror), the usual cause is a duplicated or truncated DKIM TXT record in DNS. Your provider's dashboard can say "verified" while strict receivers still fail it. Our report diagnoses the exact record when this happens.
Fix: add the DKIM record from your email provider exactly as given; delete duplicates; re-copy if truncated.
5. DMARC
What it is: the policy that tells receivers what to do with email that fails SPF/DKIM — nothing (p=none), spam-folder it (p=quarantine), or reject it (p=reject).
Why p=none is a warning: it means "monitor only" — you get no protection against spoofing, and Gmail/Yahoo increasingly expect enforcement. It's the right starting point, but move to p=quarantine once SPF and DKIM pass consistently.
6. Spam Filter Check (SpamAssassin)
What it is: we run your actual email through SpamAssassin — the real spam filter used by mail servers worldwide — and show you every rule it triggered, with points. Lower is better; 5.0 or above means spam filters will likely catch you.
Reading the rule table: green negative points help you (good reputation, valid DKIM); red positive points hurt (HTML-only email, missing headers, image-heavy content). Fix the biggest red items first.
7. Blacklists (manual)
What it is: your sending IP and domain checked against 23 major blacklists (Spamhaus, SpamCop, Barracuda, SURBL and more). Run it with the button on your report.
If you're listed: each blacklist has its own delisting process — search "[blacklist name] delist". Note that some listings (like Spamhaus PBL) are normal for shared hosting and don't count against you.
8. Reverse DNS (PTR)
What it is: your sending IP should resolve back to a hostname, and that hostname should resolve forward to the same IP. Gmail and Outlook penalise or reject servers without this.
Fix: if you send through a provider (Resend, Brevo, etc.) this is handled for you. If self-hosting, ask your host to set the PTR record.
9. MX Records
What it is: the DNS records that let your domain receive email. Not directly about sending — but domains that can't receive mail look suspicious to filters, and your customers can't reply to you.
10. Email Headers
What it checks: structural problems in the email itself — most commonly an HTML email with no plain-text alternative, which some filters penalise. Fixed in your email template or sending plugin settings.
11. List-Unsubscribe & Content Quality
List-Unsubscribe: required by Gmail and Yahoo for bulk senders since 2024. Transactional email (receipts, password resets) doesn't need it — so a missing header there is informational, not a problem.
Content quality: we scan the email body for images missing alt text, dangerous HTML (scripts, iframes), URL shorteners (a spam signal), image-heavy/low-text composition, and oversized HTML (Gmail clips messages over ~102 KB).
Bonus: Sending Environment (unscored)
What it is: we read the email's headers to identify how your WordPress site actually sent it — which SMTP plugin (WP Mail SMTP identifies itself, its version, and its configured mailer), which mail service carried it (Mailgun, Brevo, SendGrid, SES and others leave unmistakable fingerprints), and whether it went out via WordPress's default PHP mail().
The one thing to act on: if this card shows PHP mail(), your emails are sent by the web server itself — the envelope sender is often the server's account, not your domain, and that's the single most common reason WordPress email lands in spam. Install an SMTP plugin and connect a real mail service (or let our Mailer Setup service do it for you).
Why it's unscored: this is detection, not judgment — we only report what the headers prove, and it never moves your score.