Email authentication
The basics are in place but can be hardened.
Authorizes which servers may send mail for the domain
SPF is published and within limits.
v=spf1 include:mail.zendesk.com ip4:195.64.164.0/23 ip4:85.31.215.0/24 ip4:45.158.83.0/24 ip4:5.181.200.0/24 ip4:34.193.89.247 ip4:35.171.128.124 ip4:54.80.69.95 ip4:54.243.84.126 ip4:52.206.72.16 ip6:2a03:1780:1:12::/64 include:spf.protection.outlook.com a mx ~allCryptographically signs outgoing mail (best-effort selector probe)
DKIM key published for 1 known selector.
Tells receivers what to do with mail that fails SPF and DKIM
DMARC is enforced.
v=DMARC1; p=quarantine; sp=none; rua=mailto:[email protected];Enforces TLS for inbound mail and prevents downgrade attacks
MTA-STS is published but not enforcing.
v=STSv1; id=1681282130;Receives reports about TLS delivery failures
TLS reporting is configured.
v=TLSRPTv1; rua=mailto:[email protected];Displays your verified brand logo in supporting inboxes
No BIMI record. No brand logo is published for inboxes.
Checks query live DNS over Cloudflare and the public MTA-STS policy endpoint. DKIM selectors cannot be listed from DNS, so DKIM detection probes common provider selectors only.