What affects your email domain health score
How SPF, DKIM, DMARC, MX, DNS hygiene, and configuration safety shape the Inbox Vital score.
A domain health score should not be mysterious. If the number changes, you should be able to trace it back to something concrete in DNS or authentication.
Inbox Vital scores the parts of email setup that affect whether a domain can prove its mail is legitimate and whether receivers can route it cleanly. The score is not a reputation score. It does not know whether people love your newsletter. It looks at the configuration signals you control.
Authentication coverage
Authentication coverage carries the most weight because a domain without SPF, DKIM, and DMARC has weak proof.
The score looks for:
- a present and valid SPF record
- at least one valid DKIM selector
- a DMARC record with a real policy
SPF tells receivers which servers can send for a domain. DKIM lets receivers verify that a message was signed with a private key tied to DNS. DMARC ties those checks to the visible From domain and tells receivers what to do when alignment fails.
You want all three. One missing piece can make the setup look finished while leaving a gap.
DMARC policy strength
A domain with p=none is watching. A domain with p=quarantine or p=reject is asking receivers to take action.
That difference matters in the score. p=none is still useful during rollout, especially when reports are flowing to a working rua address. But it is not the same as enforcement.
Inbox Vital gives credit for a DMARC policy and extra credit when aggregate reporting is configured. Reports are how you find legitimate senders before moving to stronger enforcement. Without them, you are mostly guessing.
DNS hygiene
DNS hygiene catches the setup mistakes that make authentication brittle.
Multiple SPF records are a common one. SPF expects a single record. Publishing two does not mean receivers combine them. It usually means SPF is invalid.
Lookup count is another. SPF has a DNS lookup limit, and nested vendor includes can push a record past it. The record may look reasonable in your DNS host while failing at evaluation time.
MX records matter too. A domain that sends mail often needs to receive mail, especially replies, bounces, and verification messages. Missing MX records can point to a domain that is not ready for normal email use.
Configuration safety
Some records pass syntax checks and still create risk.
An SPF record ending in +all tells receivers that any server is allowed to send mail for the domain. That defeats the point of SPF.
Weak DKIM keys are another problem. A short key may still be present in DNS, but it is not a setup you want to keep.
Partial DMARC enforcement can be fine during rollout, but it should not be forgotten. If pct is below 100 forever, the domain is not fully enforcing the policy.
What about BIMI?
BIMI is useful if you care about brand display in inboxes that support it. It can also reveal whether DMARC enforcement is strong enough for logo display.
It does not change the Inbox Vital health score.
That is intentional. BIMI is diagnostic. SPF, DKIM, DMARC, MX, DNS hygiene, and safety checks are the core of the score because they decide whether the domain can authenticate and route mail reliably.
How to use the number
Use the score as a triage tool, not a trophy.
If the score drops, open the failing checks and fix the concrete issue. If the score is good but DMARC reports show a sender failing alignment, fix the sender before tightening policy. If the score is good and reports are quiet, make sure “quiet” means no problems, not a broken report pipeline.
The number is useful because it makes drift visible. The work is still in the details.