What it does

Inboxward audits every sending domain in your portfolio for the five factors that actually determine deliverability: SPF validity, DKIM rotation age, DMARC policy strictness, blacklist status, and inbox placement test results — SPF / DKIM / DMARC are inspected live; blacklist and placement signals are demonstrated on the labeled synthetic fleet.

The default queue still shows 12 synthetic domains across three risk tiers so the remediation logic stays legible. The new live backend lets a recruiter type any public domain and get a real SPF / DMARC / common-DKIM inspection through a Cloudflare Pages function.

What it proves

• Real backend + real data — live mode calls a deployed server endpoint that performs real DNS lookups instead of shipping hardcoded JSON only.
• Deliverability systems fluency — understands SPF flattening, DKIM selector discovery, DMARC alignment, and where paid blacklist or placement feeds would slot in.
• Risk scoring — composite score (0-100) weighted by the actual business impact of each failure mode.
• Honest boundaries — synthetic scenarios remain explicit where live blacklist feeds and inbox placement telemetry are not yet wired.

Risk scoring formula

• Base: 100
• SPF fail: −30 · SPF warn (too many includes): −10
• DKIM fail: −25 · DKIM warn (key >90 days): −8
• DMARC none: −15 · DMARC quarantine with pct<100: −5
• Each blacklist: −20
• Inbox placement <50%: −15 · <80%: −5
• Domain <30 days old: −10

Honest limits

• Blacklist monitoring is still synthetic — Spamhaus, Barracuda, and SURBL data are demo records, not live commercial feeds.
• No inbox placement API — live mode does not fetch seed-test results or ESP telemetry.
• Common-selector DKIM probe — the backend checks standard selectors (`google`, `selector1`, `sg`, `mg`, etc.), but nonstandard selectors may need platform-specific confirmation.
• Single-tenant — no org switching, auth, or persisted history.

Live demo

https://dallascrilley.com/demos/inboxward