Search Psychevus

12 results available.
↑ ↓ to navigate ↵ to open · esc to close

Free tool / Inbox check

Will your emails reach the inbox?

Enter your business email or website. In about ten seconds you’ll see whether Gmail and Outlook trust your mail, whether someone could send email pretending to be you — and exactly what to change.

Free, no sign-up. We read only your domain’s public DNS settings — nothing is sent to your inbox and no mail is read.

etsy.com

etsy.com is close — one step remains.

D Email security grade · 42/100 · open the report card
  • Email handled byGoogle Workspace
  • DNS managed atAmazon Route 53
  • Allowed to send as youMailchimp, Zendesk, Amazon SES, Google Workspace
  1. Needs work

    Will Gmail and Outlook trust your everyday email?

    Partly. One of the two proofs is missing or weak.

    Gmail requires every sender to pass SPF or DKIM, and recommends both. Messages that can’t prove their origin are the first to land in spam or be refused.

  2. Good

    Can someone send email pretending to be you?

    Not easily — inboxes are told to reject or quarantine forgeries.

    Fake invoices and payment requests sent “from” a real business are a common scam. A DMARC policy of quarantine or reject is what stops them.

  3. Fix this

    Ready to send newsletters, receipts or invoices to many people?

    Not yet. High-volume mail needs SPF, DKIM and DMARC together.

    Google, Yahoo and Microsoft require SPF, DKIM and a DMARC record from anyone sending around 5,000 messages a day to their users; Microsoft rejects failing mail with error 550 5.7.515.

Impersonation test

If someone forged an invoice from etsy.com

Your DMARC policy tells inboxes to reject it: the message never arrives.

A simulation from your DMARC policy. Nothing was sent; inboxes also apply their own filters.

Accounts <billing@etsy.com>to you · 09:41

Updated bank details for invoice INV-2048

Hi, our bank account has changed. Please send this and future payments to the new account below so there is no delay…

Refused
Simulation — nothing was sent.

Your fix plan 1 step

  1. Correct your SPF record

    The SPF record needs 11 lookups; the limit is 10, so checks fail. SPF is the list of servers allowed to send email for your domain.

    Type
    TXT
    Name / Host
    @
    Value
    v=spf1 include:_spf.google.com ip4:66.3.159.0/24 ip4:192.147.0.0/24 ip4:173.46.67.72/29 ip4:192.147.1.0/24 ip4:38.106.64.0/24 ip4:38.76.1.0/24 ip4:38.76.2.0/24 ip4:162.220.28.32/27 ip4:162.220.28.64/28 ip4:208.74.204.0/22 ip4:46.19.168.0/23 include:servers.mcsv.net include:mail.zendesk.com include:amazonses.com include:_netblocks.google.com include:_netblocks2.google.com include:_netblocks3.google.com a:web.q4press.com include:cvent-planner.com include:mail.clinchtalent.com include:spf.redpoints.com -all
    Published it? Watch it go live
    • AWS console → Route 53 → Hosted zones → your domain → Create record.
    • Edit the existing TXT record that starts with v=spf1 (delete any second one) so it reads exactly as shown.
    • If other services send email as you — a newsletter tool, a shop, invoicing — add their include too. Keep it to one record.

Need to add several services or tune DMARC? Open the record builder for etsy.com. DNS changes usually apply within an hour and can take up to 48. Then run the check again.

Newer protections not scored · no inbox requires them yet

  • Off

    Brand logo in the inbox (BIMI)

    Shows your logo next to your messages in Gmail, Apple Mail and Yahoo.

    Your DMARC already qualifies. Publish an SVG logo at default._bimi.etsy.com; Gmail and Apple also need a mark certificate.

  • Off

    Encrypted delivery to you (MTA-STS)

    Makes other mail servers use an encrypted, verified connection when they deliver to you.

    Without it, an attacker on the network path can downgrade delivery to unencrypted.

  • Off

    Delivery security reports (TLS-RPT)

    Daily reports from Google, Microsoft and others when mail to you couldn’t be delivered securely.

    Add a TXT record at _smtp._tls.etsy.com: v=TLSRPTv1; rua=mailto:tls-reports@etsy.com

Domain hardening not scored · protects the DNS your email relies on

  • Off

    Signed DNS (DNSSEC)

    Stops forged DNS answers, so nobody can fake your mail servers or SPF and DMARC records to a resolver.

    Not signed. Turn on DNSSEC at Amazon Route 53; if the domain is registered elsewhere, add the DS record it gives you at your registrar.

  • Off

    Certificate authority lock (CAA)

    Names the certificate authorities allowed to issue TLS certificates for your domain.

    Any certificate authority may issue certificates for your domain. A CAA record such as 0 issue "letsencrypt.org" limits it to the ones you use.

DMARC can’t stop lookalikes. Has someone registered a domain like etsy.com? Run the lookalike radarRecords change quietly. Get an email the day SPF, DKIM or DMARC on etsy.com changes — free daily monitoring

How does etsy.com compare?

Put it side by side with a competitor, a supplier or your bank.

Get this plan by email

Every record ready to paste, in one email you can forward to whoever manages your website or IT.

One email with this plan, sent because you asked. You won’t be added to any list unless you tick the box above. How we handle it.

Send it to the person who can fix it

The link opens the same live check — it contains only your domain, never your email.

LinkedIn (opens in a new tab)X (opens in a new tab)

For a manager or a client: the one-page report card (A–F grade).

What we found in DNS
SPF
v=spf1 ip4:66.3.159.0/24 ip4:192.147.0.0/24 ip4:173.46.67.72/29 ip4:192.147.1.0/24 ip4:38.106.64.0/24 ip4:38.76.1.0/24 ip4:38.76.2.0/24 ip4:162.220.28.32/27 ip4:162.220.28.64/28 ip4:208.74.204.0/22 ip4:46.19.168.0/23 include:servers.mcsv.net include:mail.zendesk.com include:amazonses.com include:_netblocks.google.com include:_netblocks2.google.com include:_netblocks3.google.com a:web.q4press.com include:cvent-planner.com include:mail.clinchtalent.com include:spf.redpoints.com -allThe SPF record needs 11 lookups; the limit is 10, so checks fail. 11 of 10 DNS lookups used.
DKIM
google._domainkey (RSA 1024-bit), k1._domainkey (RSA 1024-bit), s1._domainkey (RSA 2048-bit), s2._domainkey (RSA 1024-bit), mailjet._domainkey (RSA 1024-bit)Your mail carries a signature inboxes can verify (1024-bit, 1024-bit, 2048-bit, 1024-bit, 1024-bit). Checked: google, selector1, selector2, default, k1, s1, s2, resend, cf2024-1, s1-ionos, s2-ionos, mail, dkim, 20230601, 20221208, 20210112, 20161025, s1024, s2048, k2, k3, key1, key2, smtpapi, mandrill, mxvault, everlytickey1, mailjet, zmail, fm1, protonmail, sig1.
DMARC
v=DMARC1; p=reject; fo=1; rua=mailto:dmarc@etsy.com; ruf=mailto:dmarc@etsy.comMail that fails your checks is refused.Reports go to: dmarc@etsy.com (your domain).

This check reads public DNS only. It can’t see your sending reputation, spam complaints or what your messages contain, which also affect where mail lands.

Why business emails go to spam — in plain words

Inboxes now check who you are

Gmail requires every sender to pass SPF or DKIM, and anyone sending around 5,000 messages a day to Gmail must also publish DMARC. Yahoo applies the same rules, and since May 2025 Outlook.com rejects failing high-volume mail with error 550 5.7.515. Mail that can’t prove where it comes from is the first to land in spam.

The three records, without jargon

SPF is a guest list: the servers allowed to send email for your domain. DKIM is a wax seal: a signature showing the message wasn’t forged or changed. DMARC is the instruction to inboxes: what to do with mail that fails both — deliver, send to spam, or refuse.

Why it matters beyond spam

Without a DMARC policy that quarantines or rejects, anyone can send an email that appears to come from your business — a fake invoice to your customers, a payment request to your bookkeeper. Getting this right protects the people who trust your name.

What this check can’t see

Authentication is necessary, not sufficient. Your sending reputation, complaint rate, list quality and message content also matter, and only the mailbox providers see those. The check looks for DKIM under the names providers commonly use; a key published under an unusual name may not be found.

Sources

Questions people ask

Why are my emails going to spam?

The most common technical reason is missing or broken authentication: Gmail requires every sender to pass SPF or DKIM, and bulk senders also need DMARC. Mail that can’t prove where it comes from is the first to be filtered. Reputation, complaints and content matter too, but authentication comes first.

What are SPF, DKIM and DMARC, in plain words?

SPF is a guest list of servers allowed to send email for your domain. DKIM is a tamper-proof seal on every message. DMARC is your instruction to inboxes about mail that fails both: deliver it, send it to spam, or refuse it.

Do small businesses need DMARC?

Yes, if you want to stop others sending email in your name. Without a DMARC policy of quarantine or reject, anyone can send a fake invoice or payment request that appears to come from your domain.

Is DMARC p=none enough?

It satisfies the Gmail, Yahoo and Outlook sender requirements, but it doesn’t protect you: p=none only asks for reports, so forged mail is still delivered. Move to p=quarantine once your own services pass SPF and DKIM.

What does error 550 5.7.515 mean?

Outlook.com rejected your message because your sending domain didn’t meet its authentication level — SPF, DKIM and an aligned DMARC record of at least p=none. Fix whichever of the three fails.

How long do DNS changes take?

Usually minutes to an hour, occasionally up to 48 hours, depending on your DNS host and the record’s time-to-live. Run the check again after you change a record.

Why can’t the check find my DKIM key?

DKIM keys live under a name chosen by your email provider (a “selector”). The check tries the names providers commonly use. If your provider uses an unusual one, the key may exist but not be found; if you never turned DKIM on, it isn’t there.

Does this tool read my email or store my domain?

No. It reads only your domain’s public DNS records — the same records every mail server reads. No mailbox is accessed, and checks are counted only as daily totals without the domain.

Use it from code or your AI assistant

JSON API

Free, read-only, no key. The same result as this page: verdicts, detected provider and DNS host, and the fix plan with exact records. OpenAPI description.

curl 'https://psychevus.com/api/v1/inbox-check?domain=example.com'

MCP server for AI assistants

Add the remote MCP server to Claude, Cursor or any MCP client and the whole suite becomes five tools: check_email_domain, find_lookalike_domains, analyze_email_headers, count_spf_lookups and check_dns_propagation. Ask “why did this email go to spam?” and paste the headers, or “fix my SPF for Google and Mailchimp”, and the assistant checks, proposes and confirms the fix went live.

{
  "mcpServers": {
    "psychevus-inbox-check": { "url": "https://psychevus.com/api/mcp" }
  }
}

Put the check on your own site

Plain HTML, no script and no tracking: visitors type their address and the full check opens here in a new tab. Paste it into any page, newsletter platform or help centre.

<form action="https://psychevus.com/tools/inbox-check" method="get" target="_blank" rel="noopener" style="display:flex;flex-wrap:wrap;gap:8px;max-width:520px;font:16px system-ui,sans-serif">
  <label for="inbox-check-d" style="position:absolute;left:-9999px">Your email or domain</label>
  <input id="inbox-check-d" name="d" required placeholder="you@yourbusiness.com" style="flex:1;min-width:200px;padding:11px 13px;border:1px solid #111;border-radius:10px">
  <button style="padding:11px 18px;border:0;border-radius:10px;background:#111;color:#fff;cursor:pointer">Will my email reach the inbox?</button>
</form>
<p style="margin:6px 0 0;font:12px system-ui,sans-serif">Free <a href="https://psychevus.com/tools/inbox-check">inbox check</a> by Psychevus</p>

Let’s make a connection.

Working on something in systems security? The contact form will start with that topic selected.

Discuss this challenge
YOUR VISIT, YOUR CHOICE

Privacy, by intention.

You decide what stays on your device. You can change your choice at any time.

Essential

Saves your privacy choice. Administrator sign-in uses a secure session cookie.

Always on
Full privacy notice ↗