{
  "domain": "example.com",
  "mx": null,
  "null_mx": true,
  "mx_source": "MX",
  "spf": {
    "domain": "example.com",
    "record": "v=spf1 -all",
    "terms": [
      {
        "text": "-all",
        "kind": "all",
        "qualifier": "-",
        "counts_as_lookup": false,
        "note": "hard fail: anything else is rejected"
      }
    ],
    "lookups": 0,
    "void_lookups": 0
  },
  "spf_record_count": 1,
  "spf_all": "-all",
  "dmarc": {
    "record": "v=DMARC1;p=reject;sp=reject;adkim=s;aspf=s",
    "tags": {
      "adkim": "s",
      "aspf": "s",
      "p": "reject",
      "sp": "reject",
      "v": "DMARC1"
    },
    "policy": "reject",
    "subdomain_policy": "reject",
    "pct": 100,
    "adkim": "s",
    "aspf": "s"
  },
  "dmarc_record_count": 1,
  "dkim": [
    {
      "selector": "amazonses",
      "record": "v=DKIM1; p=",
      "key_type": "rsa",
      "testing": false,
      "revoked": true
    },
    {
      "selector": "cm",
      "record": "v=DKIM1; p=",
      "key_type": "rsa",
      "testing": false,
      "revoked": true
    },
    {
      "selector": "default",
      "record": "v=DKIM1; p=",
      "key_type": "rsa",
      "testing": false,
      "revoked": true
    },
    {
      "selector": "dkim",
      "record": "v=DKIM1; p=",
      "key_type": "rsa",
      "testing": false,
      "revoked": true
    },
    {
      "selector": "everlytickey1",
      "record": "v=DKIM1; p=",
      "key_type": "rsa",
      "testing": false,
      "revoked": true
    },
    {
      "selector": "everlytickey2",
      "record": "v=DKIM1; p=",
      "key_type": "rsa",
      "testing": false,
      "revoked": true
    },
    {
      "selector": "fm1",
      "record": "v=DKIM1; p=",
      "key_type": "rsa",
      "testing": false,
      "revoked": true
    },
    {
      "selector": "fm2",
      "record": "v=DKIM1; p=",
      "key_type": "rsa",
      "testing": false,
      "revoked": true
    },
    {
      "selector": "fm3",
      "record": "v=DKIM1; p=",
      "key_type": "rsa",
      "testing": false,
      "revoked": true
    },
    {
      "selector": "google",
      "record": "v=DKIM1; p=",
      "key_type": "rsa",
      "testing": false,
      "revoked": true
    },
    {
      "selector": "hs1",
      "record": "v=DKIM1; p=",
      "key_type": "rsa",
      "testing": false,
      "revoked": true
    },
    {
      "selector": "hs2",
      "record": "v=DKIM1; p=",
      "key_type": "rsa",
      "testing": false,
      "revoked": true
    },
    {
      "selector": "k1",
      "record": "v=DKIM1; p=",
      "key_type": "rsa",
      "testing": false,
      "revoked": true
    },
    {
      "selector": "k2",
      "record": "v=DKIM1; p=",
      "key_type": "rsa",
      "testing": false,
      "revoked": true
    },
    {
      "selector": "k3",
      "record": "v=DKIM1; p=",
      "key_type": "rsa",
      "testing": false,
      "revoked": true
    },
    {
      "selector": "krs",
      "record": "v=DKIM1; p=",
      "key_type": "rsa",
      "testing": false,
      "revoked": true
    },
    {
      "selector": "litesrv",
      "record": "v=DKIM1; p=",
      "key_type": "rsa",
      "testing": false,
      "revoked": true
    },
    {
      "selector": "m1",
      "record": "v=DKIM1; p=",
      "key_type": "rsa",
      "testing": false,
      "revoked": true
    },
    {
      "selector": "mail",
      "record": "v=DKIM1; p=",
      "key_type": "rsa",
      "testing": false,
      "revoked": true
    },
    {
      "selector": "mailjet",
      "record": "v=DKIM1; p=",
      "key_type": "rsa",
      "testing": false,
      "revoked": true
    },
    {
      "selector": "mandrill",
      "record": "v=DKIM1; p=",
      "key_type": "rsa",
      "testing": false,
      "revoked": true
    },
    {
      "selector": "mimecast",
      "record": "v=DKIM1; p=",
      "key_type": "rsa",
      "testing": false,
      "revoked": true
    },
    {
      "selector": "mte1",
      "record": "v=DKIM1; p=",
      "key_type": "rsa",
      "testing": false,
      "revoked": true
    },
    {
      "selector": "mte2",
      "record": "v=DKIM1; p=",
      "key_type": "rsa",
      "testing": false,
      "revoked": true
    },
    {
      "selector": "mxvault",
      "record": "v=DKIM1; p=",
      "key_type": "rsa",
      "testing": false,
      "revoked": true
    },
    {
      "selector": "pm",
      "record": "v=DKIM1; p=",
      "key_type": "rsa",
      "testing": false,
      "revoked": true
    },
    {
      "selector": "protonmail",
      "record": "v=DKIM1; p=",
      "key_type": "rsa",
      "testing": false,
      "revoked": true
    },
    {
      "selector": "protonmail2",
      "record": "v=DKIM1; p=",
      "key_type": "rsa",
      "testing": false,
      "revoked": true
    },
    {
      "selector": "protonmail3",
      "record": "v=DKIM1; p=",
      "key_type": "rsa",
      "testing": false,
      "revoked": true
    },
    {
      "selector": "s1",
      "record": "v=DKIM1; p=",
      "key_type": "rsa",
      "testing": false,
      "revoked": true
    },
    {
      "selector": "s2",
      "record": "v=DKIM1; p=",
      "key_type": "rsa",
      "testing": false,
      "revoked": true
    },
    {
      "selector": "s3",
      "record": "v=DKIM1; p=",
      "key_type": "rsa",
      "testing": false,
      "revoked": true
    },
    {
      "selector": "selector1",
      "record": "v=DKIM1; p=",
      "key_type": "rsa",
      "testing": false,
      "revoked": true
    },
    {
      "selector": "selector2",
      "record": "v=DKIM1; p=",
      "key_type": "rsa",
      "testing": false,
      "revoked": true
    },
    {
      "selector": "sendgrid",
      "record": "v=DKIM1; p=",
      "key_type": "rsa",
      "testing": false,
      "revoked": true
    },
    {
      "selector": "sg",
      "record": "v=DKIM1; p=",
      "key_type": "rsa",
      "testing": false,
      "revoked": true
    },
    {
      "selector": "sig1",
      "record": "v=DKIM1; p=",
      "key_type": "rsa",
      "testing": false,
      "revoked": true
    },
    {
      "selector": "smtp",
      "record": "v=DKIM1; p=",
      "key_type": "rsa",
      "testing": false,
      "revoked": true
    },
    {
      "selector": "sparkpost",
      "record": "v=DKIM1; p=",
      "key_type": "rsa",
      "testing": false,
      "revoked": true
    },
    {
      "selector": "x",
      "record": "v=DKIM1; p=",
      "key_type": "rsa",
      "testing": false,
      "revoked": true
    },
    {
      "selector": "zendesk1",
      "record": "v=DKIM1; p=",
      "key_type": "rsa",
      "testing": false,
      "revoked": true
    },
    {
      "selector": "zendesk2",
      "record": "v=DKIM1; p=",
      "key_type": "rsa",
      "testing": false,
      "revoked": true
    },
    {
      "selector": "zoho",
      "record": "v=DKIM1; p=",
      "key_type": "rsa",
      "testing": false,
      "revoked": true
    }
  ],
  "dkim_selectors_tried": 43,
  "checks": [
    {
      "name": "MX records",
      "status": "info",
      "value": "null MX",
      "note": "The domain publishes a null MX (RFC 7505): it deliberately does not accept mail. That is the right way to say so."
    },
    {
      "name": "SPF",
      "status": "pass",
      "value": "-all, 0 of 10 lookups",
      "note": "Hard fail for anyone not listed. This is the strongest setting."
    },
    {
      "name": "DMARC",
      "status": "warn",
      "value": "p=reject, no rua",
      "note": "Enforcing, but no aggregate report address. You will not find out when a legitimate sender breaks or when someone starts spoofing you. Add rua=mailto:...",
      "guide": "https://kirkdiamond.com/guides/dmarc-none-vs-quarantine-vs-reject"
    },
    {
      "name": "DKIM",
      "status": "pass",
      "value": "amazonses, cm, default, dkim, everlytickey1, everlytickey2, fm1, fm2, fm3, google, hs1, hs2, k1, k2, k3, krs, litesrv, m1, mail, mailjet, mandrill, mimecast, mte1, mte2, mxvault, pm, protonmail, protonmail2, protonmail3, s1, s2, s3, selector1, selector2, sendgrid, sg, sig1, smtp, sparkpost, x, zendesk1, zendesk2, zoho",
      "note": "Public keys found for these selectors, all 2048 bits or stronger."
    },
    {
      "name": "MTA-STS",
      "status": "info",
      "value": "not published",
      "note": "Optional. MTA-STS tells sending servers to require TLS and a valid certificate when delivering to you, closing the downgrade gap in opportunistic STARTTLS. Gmail and Outlook honour it.",
      "guide": "https://kirkdiamond.com/guides/mta-sts-explained"
    },
    {
      "name": "TLS-RPT",
      "status": "info",
      "value": "not published",
      "note": "Optional. TLS-RPT gives you daily reports from big senders about TLS failures when delivering to your domain. Cheap to add and very useful alongside MTA-STS.",
      "guide": "https://kirkdiamond.com/guides/mta-sts-explained"
    }
  ],
  "grade": "B",
  "pass": 2,
  "warn": 1,
  "fail": 0,
  "elapsed": "37ms",
  "resolver": "1.1.1.1",
  "checked_at": "2026-10-29T19:11:33Z"
}