Reading your results

Once an audit completes, you land on a results page broken into sections — Authentication, Blocklist status, Inbox placement, Hard bounce, and Engagement — each contributing to an overall score. Sections you didn't grant access to check (for example, inbox placement on a DNS-only audit) show as not configured instead of a failing score.

How findings are presented

Each issue found follows the same format:

• Impact — High, Medium, or Low, indicating how much it's likely hurting your deliverability.
• Issue — a plain-language explanation of what's wrong.
• Suggestion — a specific, actionable fix.

Authentication

This section checks the DNS records that prove your emails are legitimately coming from you, plus a live check that they actually pass in practice.

SPF

SPF lists which servers are allowed to send email for your domain. Aimly checks whether a record exists, and — just as importantly — how it ends:

Ending	What it means	Impact if flagged
-all	Reject anything not explicitly authorized	None — this is correct
~all	Flag unauthorized senders as suspicious, but still deliver them	Medium
?all	Treat unauthorized senders the same as authorized ones	Medium
+all	Explicitly allow any server to send as your domain	Medium
missing	No terminal rule at all — defaults to neutral	Medium
no SPF record	Nothing published	High

Example finding:

Medium — SPF record has no explicit 'all' mechanism — unmatched senders default to neutral, offering no protection against spoofing. Fix: Edit your SPF record so it ends in -all — this tells receivers to reject mail from senders you haven't authorized.

DKIM

DKIM cryptographically signs your emails so receivers can verify they weren't altered in transit. Aimly checks whether your DKIM record exists and how strong the signing key is:

• RSA keys under 1024 bits, or a malformed/missing key, are flagged as weak.
• RSA 1024-bit keys are flagged as worth upgrading.
• RSA 2048-bit or higher, or Ed25519, are considered strong.

Example finding:

Medium — DKIM key strength: RSA 1024-bit (upgrade recommended). Fix: Ask your email provider to reissue your DKIM key at 2048 bits or higher (or switch to Ed25519).

DMARC

DMARC tells receivers what to do when SPF or DKIM fail, and reports back to you when they do. Aimly checks several parts of your DMARC record individually:

• Policy (p) — whether unauthenticated mail is rejected, quarantined, or let through. p=none is a High-impact finding; p=quarantine is Medium.
• Subdomain policy (sp) and non-existent subdomain policy (np) — whether subdomains get the same protection as your main domain.
• Percentage (pct) — what portion of your mail the policy actually applies to; anything under 100% while enforcing is flagged.
• Alignment (adkim/aspf) — strict vs. relaxed matching between the signing domain and your visible sending domain.

Example finding:

High — DMARC organizational policy (p) is 'none'. Fix: Log in to your DNS provider and change your DMARC record's p= value to reject.

MX and BIMI

• MX records confirm your domain can actually receive mail, and that its mail servers resolve correctly. A missing or broken MX record is a High-impact finding.
• BIMI lets your logo appear next to your emails in supporting inboxes, but only works once DMARC is actively enforcing (p=quarantine or p=reject). If your DMARC isn't enforcing yet, BIMI shows as not applicable rather than a failing check — there's no point flagging it until DMARC is fixed first.

Blocklist status

Checks whether your sending IP or domain appears on any DNS-based blocklists. A clean result across every list checked contributes positively to your score; an appearance on any list is flagged with which one and, where available, its own removal or delisting suggestion.

Inbox placement

For a full audit, Aimly sends real test messages through multiple providers and checks where each one actually lands — inbox, spam, or not delivered at all. This is the most direct evidence of real-world deliverability, since it reflects what an actual recipient would see rather than just what your DNS records claim.

Hard bounce and engagement

These look at your mailbox's own sending history — how many past sends bounced permanently, and how recipients have engaged with your mail. Poor history in either area can hurt your reputation with mail providers even when your authentication is set up correctly.

Downloading your report

Every completed audit can be downloaded as a PDF from the results page — useful for sharing with a developer or DNS administrator who needs to make the actual record changes.