6 DNS mistakes that send cold email to spam, and a bulk checker I built to catch them

I'm a cloud/systems engineer and I keep seeing the same email setup problems, so here's the checklist I use before any domain sends a campaign:

1. No DMARC record. Since Google and Yahoo's 2024 bulk-sender rules, this alone can tank inbox placement. Start with v=DMARC1; p=none; rua=mailto:you@yourdomain.com, then tighten to quarantine.
2. Two SPF records. Very common after switching providers. Receivers treat it as an error and SPF fails completely. Merge them into one.
3. SPF over 10 DNS lookups. Every include: counts, including nested ones. Go past 10 and SPF breaks silently.
4. DKIM never turned on. Microsoft 365 especially doesn't sign with your domain until you enable it in Defender.
5. Old 1024-bit DKIM keys. They still work, but rotate them to 2048.
6. Secondary sending domains with no SPF/DMARC at all. Lookalike domains bought for outreach often get set up in a hurry.

Checking this by hand for a whole list is painful, so I built a bulk checker. You paste in domains (or URLs or emails) and get an A-F grade per domain, the mail provider (Google Workspace / M365 / etc.), SPF/DKIM/DMARC status, SSL expiry, and a plain-English fix for each problem. It also works on prospect lists if you want to see who uses Google vs Microsoft.

Disclosure: this is my own tool. It's on Apify: https://apify.com/sky_technologies/domain-health-checker. It's pay-per-domain, and a free Apify account's monthly credit covers well over a thousand checks.

Happy to answer DNS questions in the comments, and genuinely want feedback on what else it should check (blacklists are next on my list).