Your domain can score 76and still be bouncing.

Because a score averages every control into one number, and that average hides the one fault receivers actually reject on. A bulk sender (over 5,000 messages a day to Gmail, Yahoo, or Outlook) with strong SPF, DKIM, a clean unsubscribe, and good spam numbers — but no DMARC record — can score in the 70s and still be rejected at the SMTP level on every send. This gate refuses to let that pass: a structural gate forces FAILING for any bulk sender with a hard authentication blocker (no DMARC, or From-alignment to neither SPF nor DKIM), no matter how high the score. The verdict is ENFORCING, AT RISK, or FAILING per domain, and it names the one fix to make first.

It clears the floor, but it scores AT RISK, not ENFORCING. The rules require a published DMARC record, and p=none (monitoring only) satisfies the letter of 'has a DMARC record' — so a bulk sender at p=none is not gate-failed. But p=none gives you reporting without enforcement: it doesn't actually stop spoofed mail from your domain. The gate weights DMARC policy strength heaviest of the six controls and treats p=none as partial credit, so a p=none domain lands in AT RISK and the fix-first points you toward p=quarantine or p=reject. Monitoring is the on-ramp; enforcement is the destination.

No, and any tool that claims to is lying. Authentication is the floor, not the ceiling. SPF, DKIM, DMARC, and alignment get your mail accepted instead of rejected at the server — but whether it then lands in the inbox versus the spam folder depends on sender reputation, engagement, content, and list hygiene, which no static check can promise. This gate grades the floor honestly: it tells you whether your domains are configured to be accepted, and names what's blocking them if they're not. It is the readiness gate, not your DNS, your ESP, or a guarantee of placement.

One verdict per sending domain — ENFORCING, AT RISK, or FAILING — plus a single fix-first that names the highest-leverage control to change. You enter each domain's facts across six weighted controls (SPF, DKIM, DMARC policy, From-alignment, one-click unsubscribe, spam-complaint headroom) and its daily volume. A structural gate fails any bulk sender with a hard authentication blocker. An account rollup grades all your domains together as ALL ENFORCING, SOME AT RISK, or DELIVERY EXPOSED. It ships a workbook, a runnable Python engine that produces the identical verdict offline, two playbooks, and a seven-domain worked sample.

No connection, no scanning, nothing uploaded. You read each domain's settings with whatever you already use — your DNS provider, a DMARC checker, your ESP's authentication panel — and mark what you find. The gate then grades those marks deterministically, the same way every time, fully offline. That's deliberate: it makes the review repeatable and defensible, something you can run every quarter or before every campaign launch, without granting a tool access to your mail infrastructure.

Different layers of the same send. This gate owns the domain layer — whether your sending domains are authenticated and configured to be accepted at all. The Brand-Voice Email & Newsletter Engine owns the message layer — writing mail that sounds like you and earns the click once delivery is cleared. Order matters: a perfectly written newsletter from a FAILING domain never arrives. Clear the domain here first, then write with the Brand-Voice engine. They're siblings, not substitutes.