Question 1

How does WillItInbox work?

Accepted Answer

Generate a unique test email address, send any email to it from the system you want to test, and WillItInbox runs 56+ deliverability checks against the message. You get a 0–100 score, a category breakdown, and a list of prioritized recommendations.

Question 2

Do I need an account?

Accepted Answer

Yes. WillItInbox now uses accounts so your test reports, validation jobs, quotas, and CSV downloads stay private. You can sign up with email/password or Google, and the free trial does not require a card.

Question 3

How fast is the analysis?

Accepted Answer

Most reports finish in 5–15 seconds after the email arrives. The dashboard polls automatically and shows you the report as soon as it's ready. SpamAssassin is the slowest stage; everything else is sub-second.

Question 4

Is there a rate limit on the public instance?

Accepted Answer

Each plan has a monthly test quota: Starter 100, Pro 1,000, and Agency 5,000. Trial accounts get 1 test to try things out. Need more? Upgrade or contact us about Enterprise.

Question 5

Can I test from anywhere?

Accepted Answer

Yes. The test address accepts mail from any sender. SaaS apps, local dev environments, ESP campaigns, transactional flows, even your inbox client — all work.

Question 6

What's the SPF DNS lookup limit?

Accepted Answer

RFC 7208 caps total DNS lookups at 10 per SPF evaluation. Every `include:`, `a:`, `mx:`, `exists:`, `ptr:` and `redirect=` mechanism counts, and nested includes count too. Going over returns `permerror` and most receivers treat that as a fail.

Question 7

Should I use -all or ~all?

Accepted Answer

Once you're confident every legitimate sender is covered, use `-all` (hardfail). It tells receivers to reject mail from unauthorized IPs. `~all` (softfail) is fine while you're still discovering senders, but it's a weaker signal and reduces SPF's protective value.

Question 8

What size DKIM key should I use?

Accepted Answer

2048-bit RSA is the modern standard. 1024 is acceptable but increasingly considered weak — Google began flagging it years ago. Below 1024 fails outright on modern mailbox providers.

Question 9

How often should I rotate DKIM keys?

Accepted Answer

At least once per year. Use a fresh selector each time (e.g. `s2026q1`, `s2026q3`) so you can publish the new key alongside the old one and cut over without dropping signatures.

Question 10

What's the difference between SPF alignment and DKIM alignment?

Accepted Answer

DMARC requires that the From-header domain align with EITHER the SPF authenticated domain (Return-Path) OR the DKIM signing domain (`d=` tag). SPF alignment compares the envelope sender's domain; DKIM alignment compares the `d=` value. Either passing is enough for DMARC to pass.

Question 11

Relaxed vs strict alignment — which should I use?

Accepted Answer

Relaxed (`adkim=r aspf=r`, the default) lets subdomains align (`mail.example.com` aligns with `example.com`). Strict requires an exact match. Strict is appropriate for high-value brands; relaxed is right for almost everyone else.

Question 12

What does p=quarantine actually do?

Accepted Answer

When DMARC fails, the receiver SHOULD route the message to the spam/junk folder. `p=reject` says drop it entirely. `p=none` says do whatever you'd normally do — useful for monitoring without enforcement.

Question 13

Where do DMARC aggregate reports go?

Accepted Answer

Wherever your `rua=` tag points (typically a mailto:). Dedicated services like Postmark DMARC, dmarcian, or Valimail parse them. Without aggregate reporting you're flying blind on who's sending as you.

Question 14

Do I need BIMI?

Accepted Answer

No, but it's a nice-to-have once your DMARC is at `p=quarantine` or stricter. BIMI shows your verified logo in supported clients (Gmail, Apple Mail, Yahoo) and requires a Verified Mark Certificate.

Question 15

Why does a brand-new sending domain land in spam?

Accepted Answer

It has no reputation. Mailbox providers default to suspicion until a domain demonstrates predictable, low-complaint, engaged-recipient sending. New IPs face the same problem — both need to be warmed.

Question 16

How long does domain warm-up take?

Accepted Answer

Plan on 4–6 weeks for a new domain to reach steady-state reputation. Send small volumes (a few hundred per day) to your most engaged recipients first, double daily, and watch open and bounce rates closely.

Question 17

What metrics actually move reputation?

Accepted Answer

Spam complaints (worst), hard bounces, low engagement, and high unsubscribe rates damage it; consistent volume, opens, replies, and additions to the recipient's address book improve it.

Question 18

Can I check my domain's reputation directly?

Accepted Answer

Google Postmaster Tools and Microsoft SNDS show what those two providers think of your sending domain and IPs. They're free and worth setting up the moment you start sending volume.

Question 19

Should I use a subdomain for marketing?

Accepted Answer

Yes. Send transactional from `transactional.example.com` and marketing from `mail.example.com`. That way a marketing reputation hit doesn't tank your password resets, and DMARC alignment stays clean for both.

Question 20

Is my email data stored?

Accepted Answer

Raw emails are kept long enough to render the report and are deleted within 24 hours. Reports are retained per your plan: Starter 30 days, Pro 90 days, Agency 1 year.

Question 21

Do you share data with third parties?

Accepted Answer

No. WillItInbox runs every check in-house — SpamAssassin, public DNS blacklists, DNS lookups, and our own validation engine. Your test emails and lists are never forwarded to third parties.

Question 22

Are my reports public?

Accepted Answer

Reports are tied to your account in the frontend. Backend report tokens are unguessable, report pages are blocked from indexing, and completed reports are only exposed through the token or your authenticated account flow.

Question 23

Do you use any cookies?

Accepted Answer

Only a single cookie for theme preference (light/dark). No analytics, no tracking, no third-party scripts on the public instance.

Question 24

What does each category mean?

Accepted Answer

Authentication (35 points) covers SPF, DKIM, DMARC and BIMI. DNS & infrastructure (20) checks reverse DNS, blacklists and TLS. Headers (15) validates required and optional headers. Content (20) runs SpamAssassin plus heuristics. Links (10) checks for shorteners, mismatched anchors and HTTPS.

Question 25

Why are my DNS checks warning on localhost?

Accepted Answer

When you send from localhost there's no public sender IP, so checks like reverse DNS and blacklist lookups can't run and return informational warnings. This is expected — the same email sent from a real server will score those checks normally.

Question 26

How are recommendations prioritized?

Accepted Answer

Recommendations are sorted by severity: critical first, then warning, then info. Critical items are usually authentication or reputation issues that materially affect inbox placement.

Question 27

Why does my DKIM show 'no signature' even though I set it up?

Accepted Answer

Three common causes: (1) you set up DKIM in your ESP but didn't enable signing for the specific stream/sender; (2) the message is being relayed through a hop that strips signatures; (3) the selector in the header doesn't match what's published in DNS. Compare the `s=` value in the DKIM-Signature header against your DNS.

Question 28

What does 'DMARC pass with SPF fail and DKIM pass' mean?

Accepted Answer

DMARC only needs ONE of SPF or DKIM to pass AND align. So a passing aligned DKIM is enough — but you should still investigate why SPF is failing, since it's usually a routing or include misconfiguration.

Question 29

Can I export or share a report?

Accepted Answer

Reports can be opened from their token URL, and the backend exposes JSON and CSV export endpoints for completed reports. Bulk validation jobs also provide a downloadable enriched CSV.

Question 30

Is there a public API?

Accepted Answer

Yes - see the API docs page. WillItInbox exposes deliverability endpoints (`POST /api/generate`, `GET /api/check/{token}`, exports, health) plus validation endpoints (`POST /api/validate`, batch validation, and bulk upload/status/download).

Question 31

Can I send raw .eml files instead of SMTP?

Accepted Answer

Not yet — WillItInbox currently accepts test messages over SMTP only. Raw .eml upload is on the roadmap.

Question 32

How should I poll the check endpoint?

Accepted Answer

Every 3–5 seconds is fine. Stop polling on `complete` or `error`. The endpoint returns 200 with a status field; don't treat the JSON status as an HTTP error.

Question 33

Are there webhooks?

Accepted Answer

Bulk validation supports optional completion webhooks on Pro and Agency plans. Per-report deliverability webhooks are still a future integration target.

Question 34

How do I integrate WillItInbox into CI?

Accepted Answer

Generate a token, send a test message from your CI runner, poll the check endpoint, and assert on the score or specific check statuses. The full report JSON makes per-check assertions trivial.

Question 35

How does WillItInbox compare to Mail-Tester?

Accepted Answer

Mail-Tester is the original web-based deliverability tester. WillItInbox covers the same fundamentals (SpamAssassin, SPF/DKIM/DMARC, blacklists) and adds modern bulk-sender checks (List-Unsubscribe-Post, BIMI, dynamic IP detection) plus bundled email validation — so you don't need a second vendor for list hygiene.

Question 36

How does it compare to GlockApps or Litmus?

Accepted Answer

Those services do real seedlist inbox-placement testing across dozens of mailboxes. WillItInbox focuses first on validation, technical diagnostics, domain monitoring, and DMARC visibility; diagnostic placement is beta-only until a managed seed network is ready.

Question 37

How does it compare to mxtoolbox?

Accepted Answer

mxtoolbox is excellent for one-off DNS lookups. WillItInbox analyzes a complete message — headers, body, attachments, links — in addition to the DNS layer, so you get content scoring and per-check recommendations that mxtoolbox doesn't.

Question 38

Why use WillItInbox over rolling my own with SpamAssassin?

Accepted Answer

WillItInbox packages deliverability testing, validation, scoring, reporting, quotas, exports, and account workflows into one maintained service. The value is speed, consistency, and not asking your team to own a fragile internal deliverability tool.

Frequently asked questions.

Getting started

Authentication deep-dive

Reputation & warm-up

Privacy & data

Reading the report

For developers

Comparisons