Email & Deliverability Checker

What this Deliverability Audit Actually Checks

The tool above queries live public DNS records using Cloudflare’s anycast DoH resolver, which has points-of-presence in Johannesburg, Cape Town and Durban as well as global locations. It does not guess and does not fake results. Every check below corresponds to a real DNS lookup.

SPF Record (Sender Policy Framework)

SPF tells receiving mail servers which IP addresses and services are allowed to send email on behalf of your domain. A missing SPF record or one with syntax errors often causes your messages to be rejected or filed in the spam folder. The checker looks for a TXT record at the root of your domain starting with v=spf1.

MX Records (Mail Exchange)

MX records tell the internet where email for your domain should be delivered. Even for domains that only send (and do not receive), having MX records pointing to a valid host is a strong deliverability signal. The tool reports every MX hostname and priority that is publicly visible.

DMARC Policy (Domain-based Message Authentication)

DMARC tells receivers what to do when SPF or DKIM fail — quarantine, reject, or do nothing (monitor-only). The tool checks the special host _dmarc.yourdomain.co.za for a record starting with v=DMARC1. If no record is published, DMARC effectively defaults to monitor-only for most receivers, so nothing enforces your policy.

DKIM Signatures (DomainKeys Identified Mail)

DKIM signs every outgoing message with a private key held by your mail host, and the matching public key is published in DNS so any receiver can verify the signature. DKIM records live at selector._domainkey.yourdomain.co.za where the “selector” is chosen by your provider. The checker tests common selectors — default, google, mail, mandrill, s1, s2, selector1, selector2 — and you can add your own provider-specific ones as well.

Why Cape Portal’s Audit is different from generic tests

Many online tools either: only check from one region (usually the US or EU), fake “spam score” numbers that are not grounded in real data, or assume the DKIM selector without letting you enter the one your provider actually uses.

Cape Portal is built by South Africans for South Africans. The checker resolves against anycast DNS with a local South African edge. It shows exactly what Telkom, Vodacom, MTN, Rain, and local hosting providers like Hetzner, xneelo and Afrihost will actually see in DNS. If a record is missing here, it is almost certainly missing for your customers too.

Step-by-step: using the Deliverability Checker

1. Type your sending domain (e.g. mybusiness.co.za) into the audit box.
2. Optional: adjust the DKIM selectors field to match the ones your email provider documented. Common ones are already included.
3. Click Run Deliverability Audit. The tool queries each record in parallel and updates the results live.
4. Review the four results: SPF, MX, DMARC, DKIM. Any result with a yellow warning icon should be corrected at your DNS host.
5. Use the Clear button to reset and check another domain.

South African context: ISPs and deliverability quirks

Deliverability in South Africa has a few wrinkles worth knowing. Local ISPs such as Telkom, MTN, Vodacom, Cell C, Rain and Vox run their own recursive resolvers and cache DNS records aggressively. This means a DMARC change you publish at your registrar may be picked up by Gmail within minutes, but could take 6 to 24 hours to propagate fully to every ISP subscriber in the country.

Another common issue: many small businesses start sending email directly from a web server’s hostname (e.g. server42.myhost.co.za) without an SPF include line for that server’s IP range, no matching rDNS, and no DKIM signing. Gmail and Outlook.com usually accept these for low volumes, but as soon as a campaign is sent they are heavily filtered. The audit above catches exactly this scenario by flagging a missing SPF or DKIM.

Frequently Asked Questions

Why would I use this instead of Gmail’s “Show original”?

Gmail’s original view shows authentication results for a message that was already received. Cape Portal’s audit shows what any receiver will see before you send anything — so you can catch a missing DMARC or SPF record before customers complain about missing mail.

Can the tool check my actual message content for spam?

The audit above checks the public DNS authentication layer (SPF/DKIM/DMARC/MX). Message content, list hygiene, sender reputation and IP-based blocklists are separate concerns. Your Secure Temporary Test Inbox at the top of the tool gives you a destination to send a real message to; forward that received message to a mailbox you control and inspect headers for a full end-to-end check.

Which DKIM selector should I enter?

It depends on the provider. Google Workspace commonly uses google. Office 365 uses selector1 and selector2. Mailchimp / Mandrill uses mandrill. Self-hosted and cPanel setups often use default, mail, s1 or s2. When in doubt, ask whoever set up your outgoing mail. The tool already tries the most common ones for convenience.

All four checks pass but mail still goes to spam — what else?

Next steps to check: (1) does your sending IP have a valid reverse DNS (PTR) that matches the EHLO name, (2) is your sending domain or IP on any RBL blocklists, (3) does the message body and subject line trigger content filters, (4) do you have a low sender reputation because of past complaints, and (5) have you warmed up a new sending domain / IP gradually.

How long after I publish the records will they work?

“Working” depends on the TTL (time to live) set on each DNS record. Typical TTLs are 5 minutes to 1 hour for modern hosts, but ISP-level caches sometimes ignore low TTLs and keep values for up to 24 hours. In South Africa a safe assumption is that the major public resolvers see the change within 15 minutes, while the last ISP-level caches settle within 48 hours.

Can I check more than one domain?

Yes. Use the Clear button to reset the form, paste the next domain into the input, and run the audit again. There is no per-user limit and no sign-in required.

Is my data stored when I run a check?

No. Every audit runs directly in your browser against Cloudflare’s public DoH endpoint. Cape Portal does not log the domains you check and does not store the results.