Free Email Spam Checker & Deliverability Tester

What is an email spam score and how is it calculated?

An email spam score is a summary of how many known risk signals a message carries before it is sent. Filters themselves don't publish scores — Gmail, Microsoft and Yahoo each run statistical classifiers trained on billions of messages — but the input signals are well documented, and most of them are things you control: the wording of the subject line, the balance of text to images, how many links point where, whether the message includes a working unsubscribe route, and whether your domain is authenticated.

This tool applies a fixed set of documented rules and weights each finding by severity. A critical finding — no unsubscribe link, hidden white-on-white text, a bare-IP link, a spoofed Re: prefix — carries far more weight than a stylistic one. The result is deterministic: the same email always produces the same score, and every point is traceable to a specific rule you can read and argue with.

What no tool can score is your reputation. Two identical emails from two different domains can land in different places, because sending history, complaint rate and recipient engagement dominate everything else. Treat a clean report as removing the obstacles you control, not as a guarantee.

What is SPF, DKIM and DMARC?

SPF — who is allowed to send

SPF (Sender Policy Framework) is a single TXT record in your DNS listing the servers permitted to send email using your domain. A receiving server compares the sending IP against that list. Two rules trip people up: you may publish only one SPF record — two is a permanent error that fails SPF outright — and the record may trigger at most ten DNS lookups, which portals with several email tools exceed easily.

DKIM — proof the message wasn't altered

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every message header. The receiver fetches the matching public key from a selector record in your DNS and verifies the signature. If it matches, the message genuinely came from a system holding your private key and hasn't been modified in transit. In HubSpot, DKIM is what gets published when you connect a sending domain under Settings → Domains → Email sending; until you do, your emails are signed by HubSpot's domain rather than yours.

DMARC — the policy that ties them together

DMARC tells receivers what to do when a message claiming to be from your domain fails both SPF and DKIM alignment: nothing (p=none), send it to junk (p=quarantine), or reject it outright (p=reject). It also gives you an aggregate reporting address so you can see who is sending as your domain. Since February 2024, Gmail and Yahoo require a DMARC record for bulk senders — p=none satisfies the minimum, but enforcement is what actually stops spoofing.

Why do HubSpot marketing emails land in spam?

In our audits the causes cluster into five, in rough order of frequency. First, the sending domain was never connected in HubSpot, so DKIM doesn't align to the brand domain. Second, the list contains purchased, scraped or long-stale contacts, producing hard bounces and complaints that poison the sending reputation. Third, templates are almost entirely images with a handful of words, so filters have nothing legitimate to weigh. Fourth, the domain has no DMARC record, which since 2024 is a bulk-sender requirement rather than a nice-to-have. Fifth, cold prospecting is being run through Marketing Email instead of one-to-one sales sequences on a separate subdomain — a policy violation as well as a deliverability problem.

Spam trigger words: what's real and what isn't

The "200 spam words" lists that circulate online are mostly folklore inherited from rule-based filters of the early 2000s. Modern classifiers are statistical: the word "free" appears in an enormous volume of legitimate mail every day, so it carries almost no signal on its own. What does carry signal is density and combination — several urgency phrases plus a financial promise plus an unauthenticated domain plus a cold list. That combination is what spam looks like statistically.

This checker therefore groups phrases into categories — financial lures, false urgency, over-promises, regulated-product terms and tired sales filler — and only escalates when a cluster appears. It shows you exactly which phrases it matched so you can judge them in context rather than deleting harmless words.

Cold outreach, newsletters and transactional email follow different rules

How to warm up a new sending domain

A brand-new domain has no reputation, and a first send of fifty thousand messages reads as an attack. Warm up over four to eight weeks. Publish SPF, DKIM and DMARC before the first send. Start with a few hundred messages a day to the contacts most likely to open and reply, since positive engagement is what builds reputation. Roughly double volume every two to three days as long as hard bounces stay under 2% and complaints under 0.1%, and pause the ramp — don't push through — if either climbs. Keep the send cadence regular; long gaps followed by a large burst reset much of the progress.

Text-to-image ratio, link count and unsubscribe compliance

Many clients block images by default, so an image-only email arrives as a blank rectangle for a meaningful share of your list, and filters see no text to classify. Aim for roughly 60% real text or more, and give every image descriptive alt text. Keep links purposeful: one primary call to action plus supporting links, all on HTTPS, none behind public URL shorteners, and at least one pointing at your own sending domain so the From domain and link domains agree.

Compliance is not optional and is enforced technically as well as legally. CAN-SPAM requires an accurate From line, a non-deceptive subject, a valid physical postal address and a working opt-out honoured within ten business days. Gmail and Yahoo's 2024 bulk-sender rules require one-click unsubscribe via the List-Unsubscribe header — which HubSpot adds automatically when you use its unsubscribe token. Under GDPR/PECR, marketing to EU and UK individuals needs a lawful basis and an easy withdrawal route in every message.

How to read your deliverability scorecard

Work top down by severity. Critical findings are send-blockers: fix them before the campaign goes out. High findings meaningfully raise the chance of Promotions-tab placement or throttling. Medium and low findings are polish — worth doing, rarely urgent. Then check the authentication panel: SPF, DKIM and DMARC should all read Pass, and DMARC should progress from p=none to quarantine or reject once your reports show only legitimate sources.

Common mistakes that tank inbox placement

• Sending bulk campaigns from a gmail.com or yahoo.com From address, which their own DMARC policies reject.
• Publishing two SPF records, which fails SPF permanently rather than merging the two.
• Mailing an entire list after months of silence instead of re-warming with the most engaged segment.
• Leaving unrendered personalisation tokens, or a greeting with no fallback value, in the live send.
• Hiding text with white-on-white styling or 1px fonts to influence filters — heavily penalised when found.
• Using a public URL shortener for the main call to action.
• Treating a promotional email as transactional to avoid adding an unsubscribe link.