CLEARED Every critical check passes and nothing needs fixing — safe to send.
HOLD Any failure, or two or more actionable warnings, on the email itself. Fix, then re-audit.
GROUNDED At least one critical failure (missing unsubscribe, broken link, phishing-pattern link, over Gmail's clip limit…). Do not send until fixed.
UNVERIFIED We could not check this item (e.g. a WAF-protected link) and we say so — it is never counted as a pass or a fail, and never puts an email on hold.
Sending domain (SPF, DKIM, DMARC, reputation) is judged as its own band — HEALTHY / NEEDS ATTENTION / AT RISK — because it belongs to the domain, not to this draft. It never moves the email verdict.