A Mail-Tester.com deliverability test is a fast way to inspect one real message before a configuration error, broken signature, suspicious link, or poorly aligned sender domain affects production delivery. It will not predict every recipient’s inbox placement, but it can expose the technical problems that commonly cause mail to be filtered, deferred, or rejected.

What Mail-Tester.com can—and cannot—tell you

Mail-Tester.com gives you a temporary recipient address. Send the exact message you want to test to that address, then retrieve the report after the service receives it. The report evaluates the message and its sending setup, including authentication signals such as SPF and DKIM, DMARC-related checks, server and IP characteristics, blocklist signals, and content or message-structure issues.

That makes it especially useful as a preflight diagnostic. Instead of guessing whether a newly added tracking domain, DNS record, template change, or sending route is causing a problem, you can send a controlled test and inspect the delivered message as a receiving system sees it.

It is important to set the right expectation: a score is not an inbox-placement guarantee. Large mailbox providers use their own private models, account-level history, recipient engagement, complaint rates, traffic patterns, IP and domain reputation, and policy enforcement. A message can receive a strong Mail-Tester.com result and still land in spam for Gmail, Outlook, Yahoo, or a corporate recipient if the sender has poor reputation or the recipient has no engagement history.

The reverse is also true. A modest content-related warning does not necessarily mean your transactional receipt or password-reset email will be rejected. Treat the test as evidence, not a universal verdict. Fix hard failures first, understand the context behind warnings, and validate changes against real mailbox-provider telemetry.

A useful mental model is to divide findings into four categories:

  1. Authentication failures: SPF, DKIM, or DMARC does not pass or does not align with the visible From domain.
  2. Infrastructure failures: reverse DNS, malformed DNS, a blocklisted sending IP, TLS problems, or an inconsistent sending identity.
  3. Message construction problems: broken MIME structure, missing plain-text content, problematic links, malformed headers, or HTML that resembles risky mail.
  4. Reputation and audience problems: complaint spikes, low engagement, stale recipients, sudden volume increases, or a sending domain that has not established trust.

Mail-Tester.com is strongest in the first three categories. Your delivery logs, bounce data, complaint data, and mailbox-provider tools are essential for the fourth.

Start with a controlled Mail-Tester.com deliverability test

The most common mistake is testing a message that is not representative of production. A plain “hello world” email may authenticate successfully while the actual production message contains a branded link domain, an attachment, dynamic headers, a marketing footer, or an HTML component that changes the outcome.

Create the test from the same route that sends real mail:

  • Use the production sending domain, not a personal mailbox or a staging-only subdomain.
  • Send through the same SMTP relay or REST API provider and the same regional endpoint where possible.
  • Use the same envelope sender, visible From address, Reply-To address, DKIM selector, tracking settings, and template engine.
  • Include the same links, images, and headers as the real message.
  • Test both HTML and plain-text parts if your application sends multipart email.
  • Remove live customer data, tokens, invoices, password-reset URLs, and other sensitive information before sending the test.

For a transactional application, test several message classes separately. A password reset, order receipt, account invitation, billing notice, and product announcement can have very different content, URLs, attachment behavior, and recipient expectations. Passing one does not prove that all of them are healthy.

Capture a baseline before changing anything

Save the report URL or export the relevant findings before making DNS or template changes. Record the date, sending domain, envelope-from domain, DKIM selector, provider route, message type, and the full SMTP or API request identifier from your application logs.

This baseline lets you distinguish a real improvement from normal variation. It also helps when a provider’s support team asks for message IDs, timestamps, recipient domains, or examples of a rejected message.

Test one variable at a time

Avoid changing SPF, DKIM, DMARC, link tracking, template content, and infrastructure simultaneously. If the next test improves, you will not know which change solved the problem. A more reliable sequence is:

  1. Fix authentication and DNS failures.
  2. Re-test after DNS propagation.
  3. Fix malformed headers or MIME structure.
  4. Review links, images, copy, and templates.
  5. Compare test outcomes with real delivery and engagement data.

This order matters because a perfect-looking template cannot compensate for an invalid DKIM signature or a DMARC alignment failure.

Read the report as a triage queue, not a score chase

Begin with the detailed checks rather than the total score. A single high-impact finding—such as DKIM failing, no valid SPF authorization, or a blocklisted IP—usually deserves more attention than several low-impact formatting suggestions.

Prioritize findings in this order:

1. Delivery-blocking problems

These can lead to immediate rejection, filtering, or consistently poor placement:

  • SPF fail, permerror, or too many DNS lookups.
  • DKIM signature failure, missing public key, or a signing domain unrelated to the visible From domain.
  • DMARC failure because neither SPF nor DKIM is aligned.
  • A listed sending IP or a reputation-related rejection from an important recipient network.
  • A sending IP with invalid or missing reverse DNS where the receiving provider requires it.
  • A message rejected by the remote server with a 5xx SMTP response.

2. High-value warnings

These may not block every message but deserve remediation:

  • No plain-text alternative for HTML mail.
  • A visible From domain that differs materially from the envelope sender or DKIM domain.
  • Tracking or image domains that look unrelated to the brand.
  • Broken HTML, hidden content, link mismatches, or unusually image-heavy emails.
  • Large attachments or an unexpectedly large total message size.

3. Contextual recommendations

These are worth reviewing but should not cause reckless changes:

  • A generic wording warning in a required receipt, security alert, or account notification.
  • A complaint about a short message that is intentionally concise.
  • A scoring rule based on newsletter patterns when the message is an expected, one-to-one transaction.

Do not add meaningless paragraphs, random text, or decorative content simply to improve a test score. That can make transactional email less usable and may introduce accessibility or security problems. The correct goal is a valid, recognizable, expected message—not an artificially optimized score.

Verify SPF, DKIM, and DMARC before tuning content

Email authentication is the foundation of modern deliverability. SPF identifies servers that may send for an envelope domain. DKIM attaches a cryptographic signature to a message. DMARC evaluates whether SPF or DKIM passes and aligns with the visible From domain, then publishes a policy and reporting instructions for receiving systems.

Google’s current sender guidelines require all senders to personal Gmail accounts to use SPF or DKIM, while bulk senders must use SPF, DKIM, and DMARC. For organizations sending application mail at scale, the practical standard is to configure all three correctly from the beginning.

SPF: authorize every legitimate sender

SPF is published as a DNS TXT record at the envelope sender’s domain. A simple example for a dedicated outbound server is:

example.com. IN TXT "v=spf1 ip4:192.0.2.10 -all"

This says that 192.0.2.10 is authorized to send mail using example.com in the SMTP envelope identity, and other sources should fail. The address above is a documentation-only example; substitute your real sending infrastructure.

If multiple services send mail for the same domain, SPF must be consolidated into one record. Do not publish multiple TXT records beginning with v=spf1; receivers can return an SPF permanent error when they find more than one applicable record.

A typical provider-based record uses an include mechanism supplied by the provider, for example:

example.com. IN TXT "v=spf1 include:provider-authorized-domain.example -all"

Use the exact include domain documented by your sending provider. Do not guess it, copy one from an unrelated vendor, or add broad mechanisms such as +all. +all effectively authorizes any sender and defeats SPF’s purpose.

SPF has a DNS-lookup limit. A complicated chain of includes, redirects, and nested records can exceed the limit and produce permerror, even though every individual provider entry appears reasonable. Check the evaluated record with Mail-Tester.com and a DNS diagnostic tool such as MXToolbox, then remove obsolete services and flatten only when you can maintain the record safely.

Also remember that SPF often breaks during ordinary forwarding because the forwarder’s IP address is not listed in the original sender’s SPF policy. That is one reason DKIM and DMARC are necessary rather than optional additions.

DKIM: ensure the message is signed and the key resolves

A DKIM signature appears in the message headers as DKIM-Signature. It includes a signing domain (d=) and a selector (s=). Receiving systems use those values to look up a TXT record at:

selector._domainkey.example.com

A simplified public-key record looks like this:

s1._domainkey.example.com. IN TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A..."

The p= value must be the complete public key generated by your email provider or signing service. Do not type a shortened placeholder into production DNS. DKIM failures commonly occur because the selector in DNS differs from the selector used by the sender, the TXT value is truncated by a DNS interface, the key is published at the wrong hostname, or a proxy/gateway changes the signed content after signing.

Inspect the delivered test message’s authentication results as well as the Mail-Tester.com summary. A healthy result typically shows a DKIM pass for the intended domain. If the signature exists but fails, compare the d= and s= tags in the actual header with the DNS hostname you published.

For DMARC alignment, signing with your own organizational domain is usually more useful than signing solely with a provider-owned domain. A message may have a technically valid DKIM signature but still fail DMARC if the d= domain is not aligned with the visible From domain.

DMARC: confirm alignment, not merely record existence

DMARC is published at _dmarc.example.com as a TXT record. A cautious starting policy is:

_dmarc.example.com. IN TXT "v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com; adkim=s; aspf=s; pct=100"

This example asks receivers to take no enforcement action (p=none) while sending aggregate reports to the specified mailbox. It requests strict alignment for DKIM (adkim=s) and SPF (aspf=s). Strict alignment means the authenticated domain must exactly match the visible From domain; relaxed alignment allows aligned subdomains.

A more gradual starting point may omit adkim and aspf, which uses relaxed alignment by default:

_dmarc.example.com. IN TXT "v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com; pct=100"

Once reports show that all legitimate sources are authenticating and aligning correctly, a domain owner can move toward enforcement, such as p=quarantine and ultimately p=reject. Do not jump to enforcement before understanding every system that sends mail for the domain: application providers, help desks, CRMs, billing tools, recruiting systems, monitoring services, and employee mail platforms can all be affected.

The key Mail-Tester.com question is not only “Does DMARC exist?” It is “Does this exact test message produce an aligned SPF or DKIM pass for the domain shown in From?” If the answer is no, fix the identities used by your message rather than weakening the policy to hide the failure.

Check DNS records and identity alignment carefully

DNS is a frequent source of avoidable trouble because email authentication spans several domain names. A single message can involve:

  • The visible From: address customers see.
  • The SMTP envelope sender, also called MAIL FROM or return-path domain.
  • The DKIM d= signing domain.
  • The domain used in click-tracking URLs.
  • The image-hosting domain.
  • The hostname associated with the outbound server’s reverse DNS.

These do not always need to be identical, but they should form a coherent identity. A customer who receives a receipt from billing@example.com should not see links to an unrelated, opaque domain unless there is a clear and trusted reason.

Use command-line DNS checks

Use tools such as dig or nslookup to confirm what public resolvers see. For example:

dig +short TXT example.com
dig +short TXT s1._domainkey.example.com
dig +short TXT _dmarc.example.com
dig +short MX example.com

Look for these issues:

  • More than one SPF record.
  • A DKIM record at example.com instead of selector._domainkey.example.com.
  • TXT records with accidental smart quotes, missing semicolons, or copied line breaks.
  • A DMARC record at the root domain rather than _dmarc.
  • A DNS control panel that has appended the root domain twice, creating a hostname such as _dmarc.example.com.example.com.
  • DNS propagation delays after a record change.

Do not assume that a DNS dashboard’s “saved” status means the public record is correct. Query the authoritative result externally and re-run the Mail-Tester.com test after propagation.

Align the envelope sender where possible

For application email, configure a custom envelope-sender or return-path subdomain when your provider supports it. For example, a message visible as From: Acme <notifications@example.com> could use an envelope sender such as bounce@mail.example.com. With relaxed alignment, mail.example.com can align with example.com for SPF under DMARC.

This approach keeps bounces and delivery notifications separate while preserving a coherent domain relationship. It also helps avoid sending production mail from generic provider domains that do not align with your brand’s visible From address.

Investigate sending infrastructure, IP reputation, and TLS

Authentication is necessary but not sufficient. A perfectly authenticated message can still be deferred or placed in spam when the sending server or traffic pattern appears risky.

Mail-Tester.com can flag infrastructure signals, but you should corroborate them with your provider’s event logs, blocklist lookups, and recipient-specific errors. If you use a managed transactional email service, the provider may control the shared IP, reverse DNS, TLS configuration, and outbound server hostname. If you operate your own SMTP infrastructure, those details are directly your responsibility.

Reverse DNS and HELO/EHLO identity

Many receiving systems expect outbound SMTP servers to have valid forward and reverse DNS. In simplified terms, the sending IP should map through a PTR record to a hostname, and that hostname should resolve forward to the same IP or a compatible address.

For example:

198.51.100.25 -> mailout.example.net
mailout.example.net -> 198.51.100.25

The SMTP server’s EHLO or HELO identity should also be a valid, sensible hostname. This does not replace SPF or DKIM, but inconsistent naming can reduce trust and trigger provider checks.

If you send through a hosted SMTP relay or email API, do not try to set PTR records for the provider’s shared IP yourself. Instead, check the provider documentation and contact support with the affected message IDs, recipient domains, timestamps, and bounce responses when infrastructure-level failures appear.

Shared versus dedicated IPs

A shared IP can be appropriate for low or variable transactional volume because the provider manages a broader pool of traffic. A dedicated IP can provide more direct control, but it also means your own volume and list hygiene determine reputation more completely.

Neither option automatically fixes deliverability. Moving to a dedicated IP without sufficient, consistent, wanted traffic can make performance worse. Before changing IP strategy, verify the basics: authenticated domain alignment, predictable sending patterns, clean recipient data, low complaints, and meaningful transactional content.

TLS and message transport

Modern receivers increasingly expect encrypted SMTP transport. When reviewing test results and logs, ensure the sender can negotiate TLS with destination systems and that your client is using the correct SMTP submission settings when applicable.

For API-based sending, the analogous concern is not SMTP command syntax but whether the provider accepted the request and generated a valid outbound message. A successful HTTPS response only proves the API accepted the payload; it does not prove the message was delivered, accepted by the recipient server, or placed in the inbox.

Diagnose content, links, and message structure

Once authentication and infrastructure are healthy, examine the content-related findings. These findings require judgment because legitimate transactional email often includes URLs, buttons, receipts, product names, and security language that superficial spam rules may notice.

Send multipart email correctly

Most production email should include both an HTML part and a plain-text alternative. The HTML version supports branding and layout; the text version improves accessibility, gives recipients a simpler rendering option, and helps avoid the appearance of an HTML-only message with little readable content.

A standard structure is multipart/alternative, where the text part and HTML part contain equivalent meaning. If you also attach files, the overall message may use multipart/mixed with an inner multipart/alternative section.

Avoid these common issues:

  • Sending HTML with no text alternative.
  • Putting important information only inside an image.
  • Using a visible URL that differs from the actual link destination without a clear reason.
  • Embedding enormous base64 images directly in the email body.
  • Including malformed HTML copied from a web page.
  • Adding a footer or gateway modification after DKIM signing that changes signed fields or body content.

Make links recognizable and safe

Links are one of the most important content signals because phishing campaigns frequently use deceptive destinations. Use HTTPS, avoid unnecessary redirect chains, and keep link domains clearly associated with your brand.

If you enable click tracking, configure a branded tracking subdomain when your provider supports it, such as click.example.com. Validate its DNS records exactly as documented by the provider. A broken CNAME, mixed-domain redirect, or abrupt move to an unfamiliar tracking domain can create both technical and trust problems.

For password-reset links, use high-entropy, single-use tokens and avoid exposing sensitive data in URL parameters. The deliverability benefit is secondary to security, but secure and recognizable URLs also give recipients fewer reasons to report a valid email as suspicious.

Keep transactional messages purposeful

A receipt should look and behave like a receipt. A password-reset message should explain why it was sent, identify the product, provide the requested action, and offer a safe instruction for recipients who did not initiate it.

Good transactional messages usually include:

  • A clear, stable sender name and From address.
  • A subject that accurately describes the event.
  • The reason the recipient is receiving the message.
  • A concise primary action where needed.
  • A support path or security guidance for unexpected messages.
  • A text alternative and accessible button labels.

Do not disguise promotional campaigns as transactional mail to avoid unsubscribe requirements or user expectations. Mixing broad marketing copy into receipts and security messages can increase complaints, undermine engagement, and complicate compliance obligations.

Correlate the test with SMTP replies and email API events

A Mail-Tester.com report tells you about a message that arrived at its test address. It cannot explain every failure occurring at real recipient domains. For those, correlate the test with your sending platform’s events and raw SMTP replies.

Understand SMTP status families

SMTP replies beginning with 2 indicate success at that stage. A common example is:

250 2.0.0 Message accepted for delivery

Acceptance by the receiving server is not the same as inbox placement; the receiver can still apply filtering after acceptance.

Replies beginning with 4 are generally temporary failures. Examples include:

421 4.7.0 Try again later
450 4.2.0 Mailbox unavailable
451 4.7.1 Temporary server error
452 4.2.2 Insufficient system storage

Your sending system should retry eligible 4xx responses with backoff. Do not repeatedly submit a message in a tight loop, as that can worsen throttling or reputation issues.

Replies beginning with 5 are generally permanent for that recipient and message. Examples include:

550 5.1.1 User unknown
550 5.7.1 Message rejected due to policy or security rules
552 5.2.2 Mailbox full
554 5.7.1 Message rejected

The enhanced status code and accompanying text matter. 550 5.7.1 is broad: it may point to authentication, content, an organizational policy, a blocklist, or a recipient-side rule. Preserve the complete remote response rather than reducing every failure to “550.”

Interpret email API responses correctly

REST email APIs often return an HTTP 2xx response, commonly 202 Accepted, after they validate and queue a message. That means the platform accepted the request for processing, not that the destination mailbox accepted it.

Typical HTTP classes are:

  • 400 Bad Request: malformed JSON, invalid fields, or an unsupported payload.
  • 401 Unauthorized or 403 Forbidden: invalid credentials or an account/permission issue.
  • 404 Not Found: an invalid endpoint or missing resource, depending on the API.
  • 409 Conflict or 422 Unprocessable Content: validation or state errors, depending on provider conventions.
  • 429 Too Many Requests: rate limiting; retry according to the provider’s documented backoff guidance.
  • 500, 502, 503, or 504: service-side or network failures that may be retryable.

Exact response bodies and retry semantics vary by provider. Log the response code, provider request ID, recipient, message class, and timestamp. Then follow delivery events through queued, sent, deferred, bounced, delivered, complained, or suppressed states where your provider exposes them.

If you are implementing or debugging an SMTP relay or REST integration, consult the platform’s email API reference and setup guides for its exact authentication, message, webhook, and retry behavior rather than relying on generic examples.

Use complementary tools for recipient-specific evidence

Mail-Tester.com is one diagnostic instrument, not an entire deliverability program. Pair it with tools that answer different questions.

DNS and blocklist checks

MXToolbox and command-line lookups are useful for validating DNS publication, MX records, reverse DNS, and many common blocklists. Use them after every authentication change, especially when migrating DNS hosts or adding a new sending service.

A blocklist result should trigger investigation, not panic. Confirm that the listed IP is actually the one carrying your mail, identify whether it is dedicated or shared, and check whether the listing affects your recipient population. If the IP is provider-managed, submit the evidence to the provider rather than making unsupported DNS changes.

Gmail Postmaster Tools and mailbox-provider data

For meaningful Gmail volume, Google Postmaster Tools can provide domain-level information about spam rate, reputation, authentication, delivery errors, and compliance-related signals. It is more relevant to Gmail outcomes than a single third-party test mailbox.

Microsoft 365 and other enterprise recipients may provide an NDR, security-gateway log, or administrator-side trace that is more precise than a generic score. Ask affected recipients’ administrators for the exact rejection text when a business-critical domain is refusing mail.

Seed inboxes and real-user signals

Maintain a small set of test inboxes across the providers most important to your audience. Send the same production-like message to Gmail, Outlook.com, Yahoo, iCloud, and relevant business mailbox systems where permitted. Check whether the message arrived, which folder received it, whether links render correctly, and whether the authentication details match expectations.

Do not make important delivery decisions from seed tests alone. Real engagement—opens where measurable, clicks, replies, complaints, bounces, unsubscribes, and support tickets—shows whether recipients actually recognize and value the mail.

Build a repeatable remediation workflow

When a Mail-Tester.com test reveals a problem, use a documented process instead of making ad hoc changes in production.

A practical fix-and-verify sequence

  1. Save evidence. Keep the report, raw message headers, DNS query output, API request ID or SMTP transaction ID, and relevant bounce text.
  2. Classify the finding. Decide whether it is authentication, DNS, infrastructure, content, or reputation.
  3. Identify the owner. Your domain administrator may own DNS, your engineering team may own headers and templates, and your email provider may own shared-IP routing or rDNS.
  4. Make the smallest correct change. For example, correct a DKIM selector record rather than changing the entire sending domain.
  5. Wait for DNS propagation when applicable. Verify the public record with dig, not only in the DNS control panel.
  6. Repeat the identical test. Use the same message type and sending route to isolate the outcome.
  7. Validate at a real recipient provider. Check at least one mailbox where the issue was observed.
  8. Monitor production metrics. Watch bounces, deferrals, complaints, suppression rates, and delivery events after rollout.

This workflow prevents a common failure mode: fixing a report warning by adding a new service or record that breaks an already working sender.

Treat DNS changes as production changes

Authentication records are security controls as well as deliverability controls. Use change review, maintain an inventory of all authorized senders, document ownership, and remove records for retired providers. A forgotten SPF include or active DKIM key can authorize systems long after a migration is complete.

For domains that send both employee mail and application mail, maintain a clear architecture. Many teams use separate subdomains for transactional streams, such as mail.example.com, while retaining the organizational domain in the visible From address where alignment and branding require it. The right design depends on your provider, domain structure, and DMARC policy.

Common misleading conclusions to avoid

Several shortcuts create more problems than they solve.

“My SPF record exists, so SPF is working.” An SPF record can exist yet omit the active sender, exceed lookup limits, be published more than once, or be evaluated against a different envelope domain than expected.

“DKIM passed, so DMARC must pass.” DKIM must also align with the visible From domain for DMARC to pass through DKIM. A provider-owned signing domain may pass DKIM but not align.

“A 202 API response means the email was delivered.” It usually means the provider accepted the submission. Examine downstream events and recipient-server responses.

“Changing the From address fixes reputation.” Abruptly changing domains can reset recognition and create new authentication problems. Fix the technical and operational cause before rotating identities.

“A higher test score means I should add more text.” Transactional mail should remain clear and concise. Add useful context for recipients, not filler designed to influence heuristics.

“One successful test proves all providers will accept my mail.” Different providers use different filters, policies, and reputation data. Test broadly and monitor real traffic.

Establish ongoing deliverability checks

The best time to discover an authentication regression is before a product launch, password-reset incident, billing cycle, or large customer import. Add deliverability checks to your release process.

For example, when you change a transactional template, sender domain, tracking domain, SMTP provider, or REST API integration, run a Mail-Tester.com test from a non-production recipient flow. Verify the message’s visible From domain, Return-Path, DKIM d= and s= values, SPF result, DMARC result, links, text alternative, and message rendering.

For high-volume systems, consider automated checks around the components you control: DNS lookups for SPF/DKIM/DMARC, API health checks, webhook processing, bounce-rate alerts, complaint alerts, and template-rendering tests. Do not automate a third-party scoring service beyond its documented terms and API capabilities.

Email infrastructure also deserves periodic review. Re-check records after provider migrations, DNS changes, acquisitions, domain rebrands, new marketing tools, new support platforms, or changes to the outbound gateway. Deliverability failures often emerge from these operational changes rather than from the application code that sends the email.

Conclusion

A Mail-Tester.com deliverability test is most valuable when you use it as part of a disciplined diagnostic process. Send a production-like message, inspect authentication and infrastructure findings first, verify DNS independently, correlate the result with SMTP or API events, and confirm outcomes with the mailbox providers that matter to your recipients.

Start with SPF, DKIM, DMARC alignment, valid DNS, and a coherent sending identity. Then address message structure, links, content, and reputation through consistent sending practices. This sequence gives transactional email the best chance of being accepted, recognized, and trusted.

FAQ

Is Mail-Tester.com accurate for Gmail inbox placement?

It is useful for finding message-level and infrastructure issues, but it cannot guarantee Gmail inbox placement. Gmail also evaluates domain and IP reputation, recipient engagement, complaint rates, traffic patterns, and its own filtering systems. Use Mail-Tester.com alongside Gmail Postmaster Tools and real Gmail seed or recipient outcomes.

What Mail-Tester.com score is good enough?

There is no universal safe score. A lower score caused by failed SPF, DKIM, DMARC, or blocklist findings needs immediate attention. Content-oriented warnings require context: an expected transactional message may be perfectly appropriate even if a generic heuristic flags a stylistic characteristic.

Why does SPF pass but DMARC fail?

DMARC requires an aligned SPF or DKIM pass. SPF may pass for the envelope sender domain while the visible From address uses a different, unaligned domain. Configure a custom envelope-sender domain or ensure DKIM signs with an aligned domain.

Why did my email API return 202 but the recipient never received the message?

An HTTP 202 Accepted usually means the API accepted the message for processing. The message may later be deferred, bounced, suppressed, rejected by the recipient server, or filtered. Review provider delivery events, webhooks, bounce details, and the recipient server’s SMTP response.

How often should I run a Mail-Tester.com deliverability test?

Run one whenever you change sending domains, DNS authentication, templates, tracking domains, outbound providers, SMTP settings, or API integrations. For stable transactional streams, repeat tests periodically and monitor delivery, bounce, and complaint metrics continuously.