Email deliverability, graded

mailgrade

One command scans a domain's mail posture, scores it 0 to 100, and prints the exact DNS records to publish for every gap. If your mail lands in spam, mg tells you why and how to fix it.

github.com/aloki-alok/mailgrade →

$ curl -fsSL https://raw.githubusercontent.com/aloki-alok/mailgrade/main/install.sh | sh

$ mg github.com

  github.com    B    87/100
  Solid. 3 quick wins to harden (start with MTA-STS).

  ✓  MX           1 MX host(s): github-com.mail.protection.outlook.com
  ✓  SPF          v=spf1 with ~all (soft fail)
  ✓  DKIM         selector "selector1" found
  ✓  DMARC        p=quarantine
  ✓  STARTTLS     github-com.mail.protection.outlook.com offers STARTTLS
  ⚠  MTA-STS      no MTA-STS policy
  ⚠  TLS-RPT      no TLS-RPT record
  ─  DANE         no TLSA records (DANE is optional)
  ✓  Blocklists   not listed

  Fixes
    ⚠ MTA-STS: publish: _mta-sts.github.com TXT "v=STSv1; id=…"
    ⚠ TLS-RPT: publish: _smtp._tls.github.com TXT "v=TLSRPTv1; rua=…"

A real scan, trimmed for width. The full report covers eleven checks and takes about three seconds.

What it checks

MXmail routing, null-MX aware
SPFqualifier and the 10-lookup limit
DKIMprobes ~50 selectors, provider-aware
DMARCpolicy, subdomains, reporting
PTR / rDNSforward-confirmed reverse DNS
STARTTLScertificate expiry and hostname
MTA-STSrecord and fetched policy mode
TLS-RPTdelivery failure reporting
DANETLSA records, optional
BIMIbrand indicator, optional
BlocklistsSpamhaus, SpamCop and friends

Fixes you can paste

Most checkers tell you something is wrong. mg writes the record for you, with your domain already filled in:

publish: _dmarc.yourdomain.com TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com"

Install

One line, checksum verified:

$ curl -fsSL https://raw.githubusercontent.com/aloki-alok/mailgrade/main/install.sh | sh

With Go:

$ go install github.com/aloki-alok/mailgrade/cmd/mg@latest

Or grab a prebuilt binary for Linux, macOS or Windows from the latest release. Single static binary, no dependencies. Works in CI too: mg --fail-on warn yourdomain.com.