deliverly.ai
Check your own domain at deliverly.ai
Deliverability Insights
Optimizing your inbox reach with domain health analysis.
Blocklists, SPF / DKIM / DMARC health, risk score, recommendations
Build on the checker
Every check is one plain HTTP request. Create a key, give it only the scopes the job needs, and call from any language below.
- API key (optional):
POST /api/keyswith{ "name", "scopes" }returns a key; send it as theX-API-Keyheader for a higher rate limit. The server can require keys withDBC_REQUIRE_KEY=true. - Scopes: each key is limited to the scopes it was created with (shown next to each endpoint above). Calling outside them returns 403 naming the missing scope.
all:allgrants everything. Scopes cannot be changed after creation, so make a new key instead.GET /api/scopeslists them all. - The key is shown once. Only a hash of it is stored, so it cannot be displayed again. Lose it and you create a new one.
GET /api/keyslists your keys by prefix,DELETE /api/keys/:idrevokes one. - Expiry: pass
expiresInDays(1 to 3650) at creation and the key refuses to work after that date, answering 401 with the expiry date. Omit it for a key that never expires. Usage is tracked per key (count, last use, last IP) and shown in the list above. At mostDBC_MAX_KEYSkeys (default 50) can be active at once. verdict:clean·listed·blacklisted(a critical/Spamhaus hit) ·unknown(only timeouts).- A row's
stateislisted/ok/timeout. A timeout is never treated as clean. - Rate limit:
DBC_RATE_MAXrequests/min per IP (default 30). Bulk costs more, in proportion to the domain count. A 429 means slow down. - Bulk is capped at
DBC_BULK_MAXdomains (default 500); add?format=csvto get a CSV download. - Share links:
POST /api/sharewith{ "kind": "single"|"bulk", "data": {...} }freezes a result and returns/r/<id>, viewable by anyone with the link. Links expire afterDBC_SHARE_TTL_DAYS(default 90); withoutDATABASE_URLthey live in memory and die on restart.
- Every browser that opens this site (the login screen and shared /r/ links included) reports itself here and keeps a heartbeat every 30 seconds while the tab is open.
- Active means a heartbeat arrived recently; Offline means the tab closed or went quiet.
- A browser never reveals its owner's personal email address to a website. The account column is filled in only when the visitor signs in.
- Presence lives in memory: restarting the server clears the list.
Every analysis blends three components into one 0 to 100 deliverability score: blocklists carry most of the weight, receiver-side reputation the next share, and DNS authentication (SPF, DKIM, DMARC, MX, PTR) the smallest. A component that could not be measured drops out of the calculation instead of being scored as perfect or as zero.
Three honesty rules hold everywhere: a timeout is never treated as clean, a failed lookup is shown as "not checked", never as "missing", and when nothing could be measured the page says no score instead of inventing one.
Analyze checks one domain end to end: score, blocklists, DNS tiles (click a tile for its records), inbox providers and recommendations. Bulk list checks up to 500 domains against the blocklists, with CSV export. Bulk DNS reads SPF, DKIM, DMARC, MX and NS for up to 500 domains without touching any blocklist, so it is much faster. API (admin) manages scoped keys and shows code samples. Visitors (admin) shows every browser that opened this site and whether it is online now.
Share links freeze a result behind a private /r/ link anyone can open but nobody can use to run new checks. Links follow the domain the app is used on and expire after 90 days.
Open the blocklist table row and press Start removal: it walks the list's own delisting process with a prefilled link. Fix the cause first (authentication, compromised forms, purchased lists), or the listing comes back. New domains often appear on fresh-domain datasets and age out on their own once the domain builds history.