Deliverability health check: brightmail.test
Source: the records and stats you pasted (fictional test data). No live DNS lookup was run; every result reflects the pasted records as of 2026-10-29. MX records were not provided. ESP: Mailchimp. DKIM selector: k2, as shown in your Mailchimp domain settings.
1. Records found (quoted)
| Type | Name | Value (exactly as pasted) |
|---|---|---|
| TXT (SPF) | brightmail.test | v=spf1 include:servers.mcsv.net ~all |
| TXT (SPF) | brightmail.test | v=spf1 include:_spf.google.com ~all |
| TXT (DMARC) | _dmarc.brightmail.test | (none found) |
| CNAME (DKIM) | k2._domainkey.brightmail.test | dkim2.mcsv.net |
| MX | brightmail.test | Not provided |
2. Pass, warn or fail per check
| Check | Result | Why |
|---|---|---|
| SPF: one record only | Fail (hard error) | Two separate v=spf1 records exist. Receiving servers treat multiple SPF records as an error, so SPF can fail for all your mail. |
| SPF: includes ESP | Pass (in one record) | include:servers.mcsv.net (Mailchimp) is present, but only in one of the two records, which does not help while both exist. |
| SPF: ends in ~all or -all | Pass | Both end in ~all. |
| SPF: under 10 DNS lookups | Not verified | 2 includes at top level once merged. I could not resolve them recursively, so the full count is unknown. Run any SPF lookup counter on the merged record. |
| DKIM: record exists for selector | Pass (as pasted) | k2._domainkey.brightmail.test is a CNAME to dkim2.mcsv.net. I could not confirm that the target resolves to a key; Mailchimp's domain settings should show it as verified. |
| DMARC: record exists | Fail | No record at _dmarc.brightmail.test. Bulk senders to major mailbox providers are expected to have a DMARC record. |
| DMARC: policy, rua, alignment | Not applicable | No record yet. |
| MX | Not checked | Not provided. |
| One click unsubscribe | Warn (verify) | Your ESP is Mailchimp. Open the headers of a recent campaign you received and confirm List-Unsubscribe and List-Unsubscribe-Post are present. I did not inspect a message. |
3. Signals review
Last 30 days, from your stats:
| Signal | Calculation | Rate | Threshold (common industry guidance, not a guarantee) | Result |
|---|---|---|---|---|
| Hard bounce rate | 1,350 / 45,000 | 3.0% | above 2% is a list hygiene risk | Risk |
| Complaint rate | 90 / 45,000 | 0.20% | 0.1% warning, 0.3% critical | Warning |
Plain language: 3 in every 100 sends went to addresses that do not exist, which points to old or unverified addresses on the list. Complaints are 2 per 1,000 sends: past the warning line, below the critical line. Together with the broken SPF and missing DMARC, these are likely contributors to spam placement, but this data cannot prove which one matters most.
4. Ordered fix list with record text
- Merge the two SPF records into one (highest risk). Remove both TXT records and publish one:
v=spf1 include:servers.mcsv.net include:_spf.google.com ~allAssumption: you send from both Mailchimp and Google Workspace. If Google no longer sends for this domain, dropinclude:_spf.google.com. - Publish DMARC at p=none with reporting to your mailbox:
Name:
_dmarc.brightmail.testValue:v=DMARC1; p=none; rua=mailto:dmarc@brightmail.test - Keep DKIM k2 in place and confirm Mailchimp shows the domain as authenticated.
- Clean the list: make sure the 1,350 hard bounced addresses are suppressed, and review which signup sources added them.
- Reduce complaints: confirm one click unsubscribe works, confirm recipients opted in, and find which campaigns drove the 90 complaints.
- DMARC rollout (each stage needs your approval; dates left for you to set):
- Stage 1, date: ____ :
v=DMARC1; p=none; rua=mailto:dmarc@brightmail.test. Review reports for unknown senders for at least two weeks. - Stage 2, date: ____ :
v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc@brightmail.test - Stage 3, date: ____ :
v=DMARC1; p=quarantine; pct=100; rua=mailto:dmarc@brightmail.test - Stage 4, date: ____ :
v=DMARC1; p=reject; rua=mailto:dmarc@brightmail.test, only when all legitimate senders align.
I have not changed any DNS.
Needs your decision
- Approve the SPF merge and the DMARC record before whoever manages DNS makes the change.
- Approve each later move of DMARC policy to quarantine or reject.
- Confirm whether Google Workspace still sends mail for brightmail.test.