B
example.com
Score 86/100 · 0 failing, 24 warnings
Check another domain Re-scan

Scanned 14 days ago. Re-scan for a fresh result after a fix.

Issues to fix

Results

01Mail exchangers (MX)A
pass
1 MX record(s) found.
records
preferenceexchangettl
0.300
info
Null MX (0 .): the domain explicitly does not accept mail.
RFC 7505
02SPFA
pass
SPF record present.
record v=spf1 -all
pass
SPF uses 0 of the 10 permitted DNS lookups.
RFC 7208 §4.6.4
lookups 0
pass
-all default policy.
RFC 7208
03DKIMF
warn
Selector default has an empty p= tag: the key is revoked.
RFC 6376
selector default
record v=DKIM1; p=
warn
Selector google has an empty p= tag: the key is revoked.
RFC 6376
selector google
record v=DKIM1; p=
warn
Selector selector2 has an empty p= tag: the key is revoked.
RFC 6376
selector selector2
record v=DKIM1; p=
warn
Selector s1 has an empty p= tag: the key is revoked.
RFC 6376
selector s1
record v=DKIM1; p=
warn
Selector s2 has an empty p= tag: the key is revoked.
RFC 6376
selector s2
record v=DKIM1; p=
warn
Selector selector1 has an empty p= tag: the key is revoked.
RFC 6376
selector selector1
record v=DKIM1; p=
warn
Selector k1 has an empty p= tag: the key is revoked.
RFC 6376
selector k1
record v=DKIM1; p=
warn
Selector k2 has an empty p= tag: the key is revoked.
RFC 6376
selector k2
record v=DKIM1; p=
warn
Selector mail has an empty p= tag: the key is revoked.
RFC 6376
selector mail
record v=DKIM1; p=
warn
Selector dkim has an empty p= tag: the key is revoked.
RFC 6376
selector dkim
record v=DKIM1; p=
warn
Selector smtp has an empty p= tag: the key is revoked.
RFC 6376
selector smtp
record v=DKIM1; p=
warn
Selector mandrill has an empty p= tag: the key is revoked.
RFC 6376
selector mandrill
record v=DKIM1; p=
warn
Selector pm has an empty p= tag: the key is revoked.
RFC 6376
selector pm
record v=DKIM1; p=
warn
Selector mxvault has an empty p= tag: the key is revoked.
RFC 6376
selector mxvault
record v=DKIM1; p=
warn
Selector protonmail has an empty p= tag: the key is revoked.
RFC 6376
selector protonmail
record v=DKIM1; p=
warn
Selector protonmail2 has an empty p= tag: the key is revoked.
RFC 6376
selector protonmail2
record v=DKIM1; p=
warn
Selector fm1 has an empty p= tag: the key is revoked.
RFC 6376
selector fm1
record v=DKIM1; p=
warn
Selector fm2 has an empty p= tag: the key is revoked.
RFC 6376
selector fm2
record v=DKIM1; p=
warn
Selector fm3 has an empty p= tag: the key is revoked.
RFC 6376
selector fm3
record v=DKIM1; p=
warn
Selector zoho has an empty p= tag: the key is revoked.
RFC 6376
selector zoho
record v=DKIM1; p=
warn
Selector sig1 has an empty p= tag: the key is revoked.
RFC 6376
selector sig1
record v=DKIM1; p=
warn
Selector amazonses has an empty p= tag: the key is revoked.
RFC 6376
selector amazonses
record v=DKIM1; p=
warn
Selector cm has an empty p= tag: the key is revoked.
RFC 6376
selector cm
record v=DKIM1; p=
04DMARCA
pass
DMARC record present.
record v=DMARC1;p=reject;sp=reject;adkim=s;aspf=s
pass
Enforcing policy p=reject.
info
Strict alignment (adkim/aspf = s) is enforced.
05DNS healthA
pass
2 nameservers published.
RFC 2182
count 2
pass
SOA timers are sane.
RFC 1912
mname elliott.ns.cloudflare.com.
rname dns.cloudflare.com.
refresh 10000
retry 2400
expire 604800
minimum 1800
pass
Zone is DNSSEC-signed and validating.
RFC 9364
06BlacklistsA
pass
example.com is not listed on Spamhaus ZRD.
target example.com
list Spamhaus ZRD
pass
example.com is not listed on Spamhaus DBL.
target example.com
list Spamhaus DBL
07Bulk sending readinessA
pass
SPF, DKIM and DMARC are all present: the domain meets the Gmail/Yahoo and Microsoft bulk-sender authentication requirements (5,000+ messages/day).
spf true
dkim true
dmarc true
threshold 5,000 messages/day
info
One-click List-Unsubscribe is a message-level header. Verify by sending a test message.
08MTA-STSA
info
No MTA-STS policy. Inbound mail is delivered without enforced TLS.
RFC 8461
warn
No TLS-RPT reporting address. TLS delivery failures go unreported.
RFC 8460
09BIMIA
info
No BIMI record. No brand logo is published for inboxes with BIMI support.
BIMI draft

About this report

This report grades the email and DNS setup of example.com against the relevant RFCs. Each check links to the standard behind the rule. A high grade means the common causes of spoofing and poor deliverability are covered. A grade is not a guarantee that every message reaches the inbox.

Frequently asked questions

What does the grade mean?
The grade summarizes how completely the domain implements the core email authentication and DNS standards. A and B mean the main protections (SPF, DKIM, DMARC, valid MX) are in place. Lower grades flag gaps that make spoofing easier or hurt deliverability. A missing MX record caps the grade at F, a weak SPF all-qualifier caps at D, and no DMARC caps at C.
How fresh is this report?
A report is a snapshot from when it was last scanned, kept as a shareable link. If you are fixing your setup, use the Re-scan button to run every check live again.
Why is the SMTP section still loading?
The live SMTP probe connects to the mail servers from a dedicated prober, which takes a few seconds and runs separately from the DNS checks. The results stream in when ready. If SMTP was not requested for this report, that section stays empty.
I own this domain and want to stop scan.mx checking it.
Domain owners can block scanning by publishing a DNS TXT record; see the opt-out page.

More free tools

portscan.com
Open-port and service scanner for any host.
robotstxt.com
Test and validate a site’s robots.txt rules.
ip.app
Look up an IP address, ASN, and geolocation.
← Back to scan.mx