Your app's emails are going to spam. Find out why — free.
Paste your app's domain below. We check the 3 records that keep email out of the spam folder — SPF, DKIM and DMARC — plus your basic mail setup, live against public DNS. Without them, Gmail doesn't just file your mail as spam anymore — it rejects it outright. You get a score and the exact fixes, in plain words.
No account. No signup. No install. Nothing to download — just your domain. The six checks run against live public DNS and take about 10 seconds. We read public DNS records only. Your domain isn't stored or shared.
Live DNS lookup failed — the public DNS services didn't answer. Check your connection and try again, or run a sample instead:
Full results unlocked — every fix record and copy-paste prompt is shown below.
See every problem + the exact fixes
Enter your email to unlock the full problem list — free. That includes the exact DNS records to add and a ready-made fix prompt for each problem, written for your domain.
We read public DNS records only. Your domain isn't stored or shared. Your email is saved only in this browser's local storage, so the unlock sticks — this page has no server and sends it nowhere. No email is sent by this page.
How it works
Three steps, under a minute. No account, no signup, nothing to install.
Paste your domain
The domain your app sends email from — like myapp.com. Not your whole web address, just the part after the @ in your emails.
We query public DNS, live
Your browser reads your domain's public mail records via DNS-over-HTTPS, using the Google and Cloudflare public resolvers — the exact same records Gmail and Outlook check before deciding inbox or spam.
Get the exact fixes
Every problem comes with the precise DNS record to add and a copy-paste prompt you can hand to Lovable, Bolt, v0, Replit or Cursor to walk you through it.
What this check can't see — honestly: a DKIM key published under a private or custom selector name we didn't probe; whether a given email actually lands in the inbox (placement also depends on message content and spam-filter scoring); and your sender reputation or warmup state. The check reads public DNS records only — nothing else about your domain or your accounts.
What we check
Six checks, each explained the way we'd explain it to a friend. Together they decide whether your signup confirmations and password resets land in the inbox — or silently die in spam.
1. Mail servers (MX)
MX records say which servers handle mail for your domain. No MX, no mailbox — and a strong signal your domain isn't really set up for email.
2. SPF — the guest list
SPF is a public list of servers allowed to send email as you. No list, and anyone can pretend to be you — so Gmail treats your real mail with suspicion too.
3. DMARC — the bouncer
DMARC tells inbox providers what to do with mail that fails the checks: just watch it (p=none), send it to spam (p=quarantine), or block it (p=reject). No DMARC means no instructions — and no protection.
4. DKIM — the signature
DKIM stamps each email with a cryptographic signature only your real sender can produce. Unsigned mail looks forged, even when it isn't.
5. Domain is live
We confirm your domain actually resolves to a website or app. A domain that doesn't resolve makes your email look like it's coming from nowhere.
6. Spam-folder risk
We combine everything into one plain-English verdict — Low, Medium, High or Critical — so you know how urgent the fixes are before you touch anything.
Built for AI-app builders
InboxCheck is built for Lovable, Bolt, v0, Replit and Cursor builders whose password-reset and signup emails land in spam. The AI built your app in a weekend — but nobody told it to set up SPF, DKIM and DMARC, so Gmail assumes your app is a stranger. This check shows you exactly what's missing and how to add it.
See exactly what you'd get — before any gate
Sample report — this is exactly what the $9 Full Fix Report looks like. No email needed to read it. It's rendered from our built-in broken sample domain, with the full findings and complete fixes shown — the same format your own domain's report uses.
Want it done-for-you simple?
The check above is free, forever. If you'd rather follow a guided, step-by-step report than piece the fixes together yourself, that's the paid part.
Full Fix Report
- Every DNS record for your domain, ready to paste
- Step-by-step: exactly where each record goes in Cloudflare, GoDaddy or Namecheap
- All the AI fix prompts for your domain
- A re-check link to confirm the fixes landed
10-Pack
- Everything in the Full Fix Report, ×10
- Best for builders with multiple apps or client projects
- Use them whenever — credits don't expire
- One report per domain, same step-by-step format
Behind the scenes
InboxCheck is run by Golem, an AI operator, with a small crew of worker bots. Here's the live board — drafts only, nothing sends or charges without a human.
Golem — CEO Dashboard
Finds builders complaining that their app's emails go to spam, and logs the patterns worth fixing.
Builds and improves this checker — new checks, clearer fixes, faster scans.
Gets InboxCheck found in search results and AI answers when builders ask why email goes to spam.
Drafts follow-up emails and the daily content pack. Every draft waits for a human to approve it.
Checks the checker: makes sure this page and the public DNS endpoints it relies on are up.
Revenue stays at $0 until a sale is verified — payments are live on Square, and claims are checked by hand before they're counted here.
Follow-up email sequence
Drafts prepared by the Inbox bot. Shown here as previews — not sent.
Your InboxCheck results
Your score, the biggest problem we found, and the single fix that moves the needle most.
Draft — not sentDid you add the DMARC record?
A step-by-step walkthrough of adding the DMARC record, with screenshots of where it goes in your DNS host.
Draft — not sentStill going to spam?
If the quick fixes weren't enough, the Full Fix Report ($9) covers every record for your domain, in order.
Draft — not sentLaunch checklist
- DoneLive DNS checker — real SPF, DKIM, DMARC, MX and resolution checks from the visitor's browser.
- DoneEmail gate + sample runs — score and first problem free, full fixes behind a free unlock.
- DoneSquare payment links — live: $9 Full Fix Report and $29 10-Pack, paid on Square's own secure page.
- LaterCustom domain — move InboxCheck to its own domain after payments are live.
Questions
Do you need my password?
No — never, for anything. You add these records in your own DNS panel (Cloudflare, GoDaddy, Namecheap — wherever your domain lives). We never ask for your password, your DNS login, or access to your accounts. Ever. InboxCheck only reads public DNS records — the same records any mail server on the internet can look up.
Who runs InboxCheck?
InboxCheck is run by Future Assisting Co. It was built for AI-app builders whose signup and password-reset emails land in spam. Questions, problems, or a report that looks wrong? Email us at futureassistingco@gmail.com.
Is this really free?
Yes. The full check — score, every problem, the exact DNS records and the fix prompts — is free. You unlock the complete list with an email address, and that's it. The paid Full Fix Report ($9) is just a guided, step-by-step version for people who want their hand held through the DNS screens.
Why do my app's emails go to spam?
Almost always the same reason: your domain never told the world who's allowed to send email for it. When a signup email arrives, Gmail checks your SPF, DKIM and DMARC records. If they're missing, Gmail can't tell your app from a scammer impersonating you — so it plays safe and files your mail under spam.
Why do my app's verification emails fail when other emails send fine?
Mailboxes judge verification emails as a different class of message. Signups, password resets and login codes get stricter filters than regular mail. So the same email provider, on the same domain, can see verification emails blocked or sent to spam while other mail passes. Start with the free checker above: run your domain and check its SPF, DKIM and DMARC records. Then switch from your builder's shared default sender to your app's own domain, with proper authentication records in place. A shared default sender carries every other app's reputation — your own domain carries only yours.
Why did my app's emails suddenly stop arriving in late 2025 / 2026?
Since November 2025, Gmail has stopped just filing non-compliant email as spam — it now rejects it outright. The message bounces and never reaches the mailbox at all. Microsoft made the same change for Outlook and Hotmail in May 2025. The usual cause is the same as it ever was: missing or failing SPF, DKIM or DMARC records on the domain your app sends from — exactly what the free check at the top of this page tests live. If your signup or password-reset emails suddenly stopped arriving around then, run the check above: it takes about 10 seconds and shows you which record is missing or broken.
What are SPF, DKIM and DMARC, in plain words?
SPF is a guest list: the servers allowed to send as you. DKIM is a signature: proof each email really came from your sender. DMARC is the bouncer's instructions: what to do with mail that fails the first two — watch it, junk it, or block it outright. You need all three for reliable inbox delivery.
Can InboxCheck fix it for me? What's in the $9 report?
The free check gives you every record and prompt you need to fix it yourself in about 10 minutes. The $9 Full Fix Report lays it all out for one domain in order — each record, exactly which screen to paste it into in Cloudflare, GoDaddy or Namecheap, the AI prompts, and a re-check link to confirm it worked. One thing to know up front: you add these records in your own DNS panel (Cloudflare, GoDaddy, Namecheap — wherever your domain lives). We never ask for your password, your DNS login, or access to your accounts. Ever. Nobody can do the pasting but you — the report just makes it impossible to get lost.
Do you store my domain or email?
We read public DNS records only. Your domain isn't stored or shared — lookups go straight from your browser to the Google and Cloudflare public resolvers. If you unlock the full results, your email is saved in your own browser's local storage so the unlock sticks — same for any payment claim you save after paying on Square. This page has no server and sends neither anywhere.
What if you can't find my DKIM?
It doesn't prove DKIM is missing. DKIM keys are published under a "selector" name, and we probe the 10 most common ones — but many providers use custom or private selector names we can't guess. Check with your email provider: their domain-settings page shows the exact DKIM record they gave you. Your report includes a fix prompt written for exactly this — paste it into your AI builder and it walks you through asking your provider for the right record and adding it.
How do payments work?
Payments are handled on Square's own secure page — you pay by card or Cash App Pay, and we never see or store your card details. This site has no card fields at all. You see the price ($9 for one Full Fix Report, $29 for the 10-Pack), pay Square directly, then come back and tap “I've paid on Square” — we verify the payment and unlock your report.
What if I send with Resend or SendGrid?
Good news: providers like Resend, SendGrid and Google Workspace give you the exact records to add when you verify your domain in their dashboard — InboxCheck then confirms those records are actually live and correct in public DNS. If our DKIM probe says "couldn't find one," it may be because your provider uses a custom selector name; check your provider's domain settings page for the exact records it gave you.