I checked seventeen domains for deliverability. Only two were broken.

I spent a Tuesday afternoon pointing our own deliverability checker at seventeen domains I use every day, mostly because I expected a mess and wanted the material.

There was no mess.

Eleven of the twelve larger products scored a hundred. Stripe, Zapier, Linear, Airtable and Loom all publish DMARC at reject, the strict setting, the one instructing receiving servers to bin anything that fails authentication in their name. GitHub, Figma, Vercel, Asana, Miro and Calendly sit at quarantine. Not one of them was missing SPF.

So the story everybody tells, where the whole internet is broken, is not what the DNS says. Sell to companies this size and you should assume their authentication is fine.

The two that were not clean are the interesting part, and neither is what you would guess.

Notion scored 61. No MX records on notion.so at all, which reads like a failure and probably is not one: they take mail somewhere else, on a subdomain or another domain, and the apex only runs the product. There is still a real consequence. A filter looking at that domain sees something that sends and never receives, and send-only domains carry a little less trust than domains doing both. Our checker cannot distinguish a deliberate architecture from a mistake. I would rather it said so than guessed.

Figma has the whole set except a reporting address inside the DMARC record.

One missing field. That is why most companies never discover which of their own tools is failing authentication — the reports arrive as XML, nobody reads XML, so the field gets skipped at setup. Add it and inside a week you learn your invoicing tool has been failing DKIM for a year.

Then the smaller group, and the pattern flipped.

Nomad List scored 40. Two stops, no DMARC record whatsoever. Since February 2024 Gmail treats bulk mail from a domain with no DMARC as unverified, and unverified mail lands in spam without a bounce, which is the part that catches people. Nothing errors. Your open rate just sags and everyone blames the subject lines.

Indie Hackers and Product Hunt both publish DMARC at none. The watching setting. It generates reports and blocks nothing, so anybody spoofing you is delivered precisely as you are. None is the right place to start and a poor place to stay, and both have clearly been sitting there since somebody set it up and moved on.

Here is the mechanic worth taking away.

The three records do different jobs and only function together. SPF names the servers allowed to send as you. DKIM signs each message so it survives being forwarded. DMARC decides what happens when the first two fail, and where the report goes. Two out of three counts as none. That is also why the commonest real failure is alignment rather than a missing record: your sending tool passes SPF for its own domain, your From address says yours, the two do not match, and every individual check reads green while the mail quietly fails.

Check yours before writing another sequence. One second, and it is the same answer Gmail gets.

The Figma result is the one that stayed with me. A company with that much engineering has DMARC deployed and nowhere for the reports to go, meaning the deployment happened and the follow-up never did. I suspect that is the most common state in the industry. It is also invisible unless somebody goes looking for the one field nobody thinks to check.

Questions people ask about this