Question 1

What is the Email Health Suite audit?

Accepted Answer

The Email Health Suite is a comprehensive deliverability and anti-spoofing audit. It validates your domain across 4 foundational pillars: (1) Authentication (SPF, DKIM, DMARC, BIMI), (2) Transport Security (MTA-STS, TLS-RPT), (3) Sender Reputation (52+ DNSBL blocklists), and (4) Infrastructure Routing (MX records, FCrDNS).

Question 2

Why did my domain receive a low email deliverability score?

Accepted Answer

The most frequent culprits are: (1) DMARC policy not enforced (p=none or missing), (2) SPF record exceeding the 10-lookup limit or using +all, (3) Missing MTA-STS leaving SMTP vulnerable to cleartext downgrade, or (4) IP listings on major DNSBL blacklists like Spamhaus or Barracuda.

Question 3

How does DMARC p=reject protect my brand from phishing?

Accepted Answer

A DMARC policy of p=reject instructs mailbox providers (Gmail, Microsoft 365, Yahoo) to immediately drop and discard any email purporting to be from your domain that fails SPF and DKIM alignment, completely preventing spoofed executive phishing.

Question 4

What is the 10-lookup limit in SPF (RFC 7208)?

Accepted Answer

RFC 7208 mandates that evaluating an SPF record must not require more than 10 DNS queries across include, a, mx, ptr, and exists mechanisms. Exceeding 10 lookups produces a PermError, causing authentication to fail.