Question 1

How does WillItInbox work?

Accepted Answer

Generate a unique test email address, send any email to it from the system you want to test, and WillItInbox runs 70+ deliverability checks against the message. You get a 0–100 score, a category breakdown, and a list of prioritized recommendations.

Question 2

Do I need an account?

Accepted Answer

Yes. WillItInbox uses accounts so test reports, validation jobs, quotas, CSV downloads, workspace membership, API keys, and branded exports stay private. You can sign up with email/password or Google, and invite links can create or join the invited account directly.

Question 3

How fast is the analysis?

Accepted Answer

Most reports finish in 5–15 seconds after the email arrives. The dashboard polls automatically and shows you the report as soon as it's ready. SpamAssassin is the slowest stage; everything else is sub-second.

Question 4

Is there a rate limit on the public instance?

Accepted Answer

Each plan has monthly quotas for deliverability tests, email validations, and bulk CSV rows. Those quotas are shared across the web app and API; API calls are API-key-only usage. Authenticated API validation is also capped at 120 email verifications per minute.

Question 5

Can I test from anywhere?

Accepted Answer

Yes. The test address accepts mail from any sender. SaaS apps, local dev environments, ESP campaigns, transactional flows, even your inbox client — all work.

Question 6

What's the SPF DNS lookup limit?

Accepted Answer

RFC 7208 caps total DNS lookups at 10 per SPF evaluation. Every `include:`, `a:`, `mx:`, `exists:`, `ptr:` and `redirect=` mechanism counts, and nested includes count too. Going over returns `permerror` and most receivers treat that as a fail.

Question 7

Should I use -all or ~all?

Accepted Answer

Once you're confident every legitimate sender is covered, use `-all` (hardfail). It tells receivers to reject mail from unauthorized IPs. `~all` (softfail) is fine while you're still discovering senders, but it's a weaker signal and reduces SPF's protective value.

Question 8

What size DKIM key should I use?

Accepted Answer

2048-bit RSA is the modern standard. 1024 is acceptable but increasingly considered weak — Google began flagging it years ago. Below 1024 fails outright on modern mailbox providers.

Question 9

How often should I rotate DKIM keys?

Accepted Answer

At least once per year. Use a fresh selector each time (e.g. `s2026q1`, `s2026q3`) so you can publish the new key alongside the old one and cut over without dropping signatures.

Question 10

What's the difference between SPF alignment and DKIM alignment?

Accepted Answer

DMARC requires that the From-header domain align with EITHER the SPF authenticated domain (Return-Path) OR the DKIM signing domain (`d=` tag). SPF alignment compares the envelope sender's domain; DKIM alignment compares the `d=` value. Either passing is enough for DMARC to pass.

Question 11

Relaxed vs strict alignment — which should I use?

Accepted Answer

Relaxed (`adkim=r aspf=r`, the default) lets subdomains align (`mail.example.com` aligns with `example.com`). Strict requires an exact match. Strict is appropriate for high-value brands; relaxed is right for almost everyone else.

Question 12

What does p=quarantine actually do?

Accepted Answer

When DMARC fails, the receiver SHOULD route the message to the spam/junk folder. `p=reject` says drop it entirely. `p=none` says do whatever you'd normally do — useful for monitoring without enforcement.

Question 13

Where do DMARC aggregate reports go?

Accepted Answer

Wherever your `rua=` tag points, typically a mailto mailbox. WillItInbox can parse uploaded aggregate reports and can ingest configured DMARC mailboxes for recurring RUA, RUF forensic, and TLS-RPT visibility.

Question 14

Do I need BIMI?

Accepted Answer

No, but it's a nice-to-have once your DMARC is at `p=quarantine` or stricter. BIMI shows your verified logo in supported clients (Gmail, Apple Mail, Yahoo) and requires a Verified Mark Certificate.

Question 15

Why does a brand-new sending domain land in spam?

Accepted Answer

It has no reputation. Mailbox providers default to suspicion until a domain demonstrates predictable, low-complaint, engaged-recipient sending. New IPs face the same problem — both need to be warmed.

Question 16

How long does domain warm-up take?

Accepted Answer

Plan on 4–6 weeks for a new domain to reach steady-state reputation. Send small volumes (a few hundred per day) to your most engaged recipients first, double daily, and watch open and bounce rates closely.

Question 17

What metrics actually move reputation?

Accepted Answer

Spam complaints (worst), hard bounces, low engagement, and high unsubscribe rates damage it; consistent volume, opens, replies, and additions to the recipient's address book improve it.

Question 18

Can I check my domain's reputation directly?

Accepted Answer

Google Postmaster Tools and Microsoft SNDS show what those two providers think of your sending domain and IPs. They're free and worth setting up the moment you start sending volume.

Question 19

Can WillItInbox connect to Google Postmaster?

Accepted Answer

Yes. WillItInbox connects to Google Postmaster as read-only provider reputation evidence for verified domains with enough Gmail traffic. Empty Postmaster stats can simply mean Google has not exposed enough data yet.

Question 20

Does WillItInbox warm up or repair sender reputation?

Accepted Answer

No. WillItInbox provides diagnostics, monitoring, ramp guidance, alerts, and provider evidence. It does not warm up domains, whitelist senders, simulate engagement, repair reputation, or guarantee inbox placement.

Question 21

Should I use a subdomain for marketing?

Accepted Answer

Yes. Send transactional from `transactional.example.com` and marketing from `mail.example.com`. That way a marketing reputation hit doesn't tank your password resets, and DMARC alignment stays clean for both.

Question 22

Is my email data stored?

Accepted Answer

Raw emails are kept long enough to render the report and are deleted within 24 hours. Report data is currently short-lived until tiered retention is implemented.

Question 23

Do you share data with third parties?

Accepted Answer

No. WillItInbox runs every check in-house — SpamAssassin, public DNS blacklists, DNS lookups, and our own validation engine. Your test emails and lists are never forwarded to third parties.

Question 24

Are my reports public?

Accepted Answer

Reports are tied to your account and workspace in the frontend. Backend report tokens are unguessable, report pages are blocked from indexing, completed reports are exposed only through the token or authenticated account flow, and workspace/project branding can be applied to exports.

Question 25

Do you use any cookies?

Accepted Answer

Only a single cookie for theme preference (light/dark). No analytics, no tracking, no third-party scripts on the public instance.

Question 26

What does each category mean?

Accepted Answer

Authentication (35 points) covers SPF, DKIM, DMARC and BIMI. DNS & infrastructure (20) checks reverse DNS, blacklists and TLS. Headers (15) validates required and optional headers. Content (20) runs SpamAssassin plus heuristics. Links (10) checks for shorteners, mismatched anchors and HTTPS.

Question 27

Why are my DNS checks warning on localhost?

Accepted Answer

When you send from localhost there's no public sender IP, so checks like reverse DNS and blacklist lookups can't run and return informational warnings. This is expected — the same email sent from a real server will score those checks normally.

Question 28

How are recommendations prioritized?

Accepted Answer

Recommendations are sorted by severity: critical first, then warning, then info. Critical items are usually authentication or reputation issues that materially affect inbox placement.

Question 29

Why does my DKIM show 'no signature' even though I set it up?

Accepted Answer

Three common causes: (1) you set up DKIM in your ESP but didn't enable signing for the specific stream/sender; (2) the message is being relayed through a hop that strips signatures; (3) the selector in the header doesn't match what's published in DNS. Compare the `s=` value in the DKIM-Signature header against your DNS.

Question 30

What does 'DMARC pass with SPF fail and DKIM pass' mean?

Accepted Answer

DMARC only needs ONE of SPF or DKIM to pass AND align. So a passing aligned DKIM is enough — but you should still investigate why SPF is failing, since it's usually a routing or include misconfiguration.

Question 31

Can I export or share a report?

Accepted Answer

Reports can be opened from their token URL, shared with private share links, exported as PDF/CSV/JSON, and branded by workspace or project. Bulk validation jobs also provide a downloadable enriched CSV.

Question 32

Is there a public API?

Accepted Answer

Yes - see the API docs page. WillItInbox exposes authenticated `/api/v1` workflows for validation, bulk jobs, test inboxes, reports, webhooks, domains, DMARC, placement diagnostics, workspaces, usage, and suppressions. API-key requests have tier-aware request limits, and validation endpoints are capped at 120 email verifications per minute.

Question 33

Can I send raw .eml files instead of SMTP?

Accepted Answer

Not yet — WillItInbox currently accepts test messages over SMTP only. Raw .eml upload is on the roadmap.

Question 34

How should I poll the check endpoint?

Accepted Answer

Every 3–5 seconds is fine. Stop polling on `complete` or `error`. The endpoint returns 200 with a status field; don't treat the JSON status as an HTTP error.

Question 35

Are there webhooks?

Accepted Answer

Yes. Persistent signed webhook endpoints support bulk completion events, delivery logs, test sends, and resend attempts. Optional ad-hoc bulk completion webhook URLs are also supported for integration jobs.

Question 36

How do I integrate WillItInbox into CI?

Accepted Answer

Generate a token, send a test message from your CI runner, poll the check endpoint, and assert on the score or specific check statuses. The full report JSON makes per-check assertions trivial.

Question 37

How does WillItInbox compare to Mail-Tester?

Accepted Answer

Mail-Tester is the original web-based deliverability tester. WillItInbox covers the same fundamentals (SpamAssassin, SPF/DKIM/DMARC, blacklists) and adds modern bulk-sender checks (List-Unsubscribe-Post, BIMI, dynamic IP detection) plus bundled email validation — so you don't need a second vendor for list hygiene.

Question 38

How does it compare to GlockApps or Litmus?

Accepted Answer

Those services emphasize large seedlist and rendering suites. WillItInbox focuses on validation, technical diagnostics, domain monitoring, DMARC visibility, workspaces, and API automation, with diagnostic placement tests, schedules, user-authorized send identities, and provider heatmaps available for controlled seed workflows.

Question 39

How does it compare to mxtoolbox?

Accepted Answer

mxtoolbox is excellent for one-off DNS lookups. WillItInbox analyzes a complete message — headers, body, attachments, links — in addition to the DNS layer, so you get content scoring and per-check recommendations that mxtoolbox doesn't.

Question 40

Why use WillItInbox over rolling my own with SpamAssassin?

Accepted Answer

WillItInbox packages deliverability testing, validation, scoring, reporting, quotas, exports, and account workflows into one maintained service. The value is speed, consistency, and not asking your team to own a fragile internal deliverability tool.

Frequently asked questions.

Getting started

Authentication deep-dive

Reputation & warm-up

Privacy & data

Reading the report

For developers

Comparisons