{ "domain": "github.com", "mx": [ { "preference": 0, "host": "github-com.mail.protection.outlook.com", "ips": [ "52.101.9.34", "52.101.194.3", "52.101.9.87", "52.101.194.161", "2a01:111:f403:c946::7", "2a01:111:f403:f805::2", "2a01:111:f403:c802::2", "2a01:111:f403:c922::7" ], "starttls": "yes", "tls_version": "TLS 1.3", "cert_valid": true, "rtt": "87ms" } ], "null_mx": false, "mx_source": "MX", "spf": { "domain": "github.com", "record": "v=spf1 ip4:192.30.252.0/22 include:spf.protection.outlook.com include:_netblocks.google.com include:_netblocks2.google.com include:mail.zendesk.com include:_spf.salesforce.com include:servers.mcsv.net include:mktomail.com include:sendgrid.net ip4:62.253.227.114 ip4:166.78.69.169 ip4:166.78.69.170 ip4:166.78.71.131 ~all", "terms": [ { "text": "ip4:192.30.252.0/22", "kind": "ip4", "counts_as_lookup": false }, { "text": "include:spf.protection.outlook.com", "kind": "include", "counts_as_lookup": true, "child": { "domain": "spf.protection.outlook.com", "record": "v=spf1 ip4:40.92.0.0/15 ip4:40.107.0.0/16 ip4:52.100.0.0/15 ip4:52.102.0.0/16 ip4:52.103.0.0/17 ip4:104.47.0.0/17 ip6:2a01:111:f400::/48 ip6:2a01:111:f403::/49 ip6:2a01:111:f403:8000::/51 ip6:2a01:111:f403:c000::/51 ip6:2a01:111:f403:f000::/52 -all", "terms": [ { "text": "ip4:40.92.0.0/15", "kind": "ip4", "counts_as_lookup": false }, { "text": "ip4:40.107.0.0/16", "kind": "ip4", "counts_as_lookup": false }, { "text": "ip4:52.100.0.0/15", "kind": "ip4", "counts_as_lookup": false }, { "text": "ip4:52.102.0.0/16", "kind": "ip4", "counts_as_lookup": false }, { "text": "ip4:52.103.0.0/17", "kind": "ip4", "counts_as_lookup": false }, { "text": "ip4:104.47.0.0/17", "kind": "ip4", "counts_as_lookup": false }, { "text": "ip6:2a01:111:f400::/48", "kind": "ip6", "counts_as_lookup": false }, { "text": "ip6:2a01:111:f403::/49", "kind": "ip6", "counts_as_lookup": false }, { "text": "ip6:2a01:111:f403:8000::/51", "kind": "ip6", "counts_as_lookup": false }, { "text": "ip6:2a01:111:f403:c000::/51", "kind": "ip6", "counts_as_lookup": false }, { "text": "ip6:2a01:111:f403:f000::/52", "kind": "ip6", "counts_as_lookup": false }, { "text": "-all", "kind": "all", "qualifier": "-", "counts_as_lookup": false, "note": "hard fail: anything else is rejected" } ], "lookups": 0, "void_lookups": 0 } }, { "text": "include:_netblocks.google.com", "kind": "include", "counts_as_lookup": true, "child": { "domain": "_netblocks.google.com", "record": "v=spf1 ip4:74.125.0.0/16 ip4:209.85.128.0/17 ~all", "terms": [ { "text": "ip4:74.125.0.0/16", "kind": "ip4", "counts_as_lookup": false }, { "text": "ip4:209.85.128.0/17", "kind": "ip4", "counts_as_lookup": false }, { "text": "~all", "kind": "all", "qualifier": "~", "counts_as_lookup": false, "note": "soft fail: unlisted senders are marked, not rejected" } ], "lookups": 0, "void_lookups": 0 } }, { "text": "include:_netblocks2.google.com", "kind": "include", "counts_as_lookup": true, "child": { "domain": "_netblocks2.google.com", "record": "v=spf1 ip6:2001:4860:4000::/36 ip6:2404:6800:4000::/36 ip6:2607:f8b0:4000::/36 ip6:2800:3f0:4000::/36 ip6:2a00:1450:4000::/36 ip6:2c0f:fb50:4000::/36 ~all", "terms": [ { "text": "ip6:2001:4860:4000::/36", "kind": "ip6", "counts_as_lookup": false }, { "text": "ip6:2404:6800:4000::/36", "kind": "ip6", "counts_as_lookup": false }, { "text": "ip6:2607:f8b0:4000::/36", "kind": "ip6", "counts_as_lookup": false }, { "text": "ip6:2800:3f0:4000::/36", "kind": "ip6", "counts_as_lookup": false }, { "text": "ip6:2a00:1450:4000::/36", "kind": "ip6", "counts_as_lookup": false }, { "text": "ip6:2c0f:fb50:4000::/36", "kind": "ip6", "counts_as_lookup": false }, { "text": "~all", "kind": "all", "qualifier": "~", "counts_as_lookup": false, "note": "soft fail: unlisted senders are marked, not rejected" } ], "lookups": 0, "void_lookups": 0 } }, { "text": "include:mail.zendesk.com", "kind": "include", "counts_as_lookup": true, "child": { "domain": "mail.zendesk.com", "record": "v=spf1 ip4:103.151.192.0/23 ip4:185.12.80.0/22 ip4:188.172.128.0/20 ip4:192.161.144.0/20 ip4:216.198.0.0/18 ~all", "terms": [ { "text": "ip4:103.151.192.0/23", "kind": "ip4", "counts_as_lookup": false }, { "text": "ip4:185.12.80.0/22", "kind": "ip4", "counts_as_lookup": false }, { "text": "ip4:188.172.128.0/20", "kind": "ip4", "counts_as_lookup": false }, { "text": "ip4:192.161.144.0/20", "kind": "ip4", "counts_as_lookup": false }, { "text": "ip4:216.198.0.0/18", "kind": "ip4", "counts_as_lookup": false }, { "text": "~all", "kind": "all", "qualifier": "~", "counts_as_lookup": false, "note": "soft fail: unlisted senders are marked, not rejected" } ], "lookups": 0, "void_lookups": 0 } }, { "text": "include:_spf.salesforce.com", "kind": "include", "counts_as_lookup": true, "child": { "domain": "_spf.salesforce.com", "record": "v=spf1 exists:%{i}._spf.mta.salesforce.com -all", "terms": [ { "text": "exists:%{i}._spf.mta.salesforce.com", "kind": "exists", "counts_as_lookup": true, "note": "macro: expanded per message, so the target cannot be checked here" }, { "text": "-all", "kind": "all", "qualifier": "-", "counts_as_lookup": false, "note": "hard fail: anything else is rejected" } ], "lookups": 1, "void_lookups": 0 } }, { "text": "include:servers.mcsv.net", "kind": "include", "counts_as_lookup": true, "child": { "domain": "servers.mcsv.net", "record": "v=spf1 ip4:205.201.128.0/20 ip4:198.2.128.0/18 ip4:148.105.0.0/16 -all", "terms": [ { "text": "ip4:205.201.128.0/20", "kind": "ip4", "counts_as_lookup": false }, { "text": "ip4:198.2.128.0/18", "kind": "ip4", "counts_as_lookup": false }, { "text": "ip4:148.105.0.0/16", "kind": "ip4", "counts_as_lookup": false }, { "text": "-all", "kind": "all", "qualifier": "-", "counts_as_lookup": false, "note": "hard fail: anything else is rejected" } ], "lookups": 0, "void_lookups": 0 } }, { "text": "include:mktomail.com", "kind": "include", "counts_as_lookup": true, "child": { "domain": "mktomail.com", "record": "v=spf1 ip4:199.15.212.0/22 ip4:72.3.185.0/24 ip4:72.32.154.0/24 ip4:72.32.217.0/24 ip4:72.32.243.0/24 ip4:94.236.119.0/26 ip4:37.188.97.188/32 ip4:185.28.196.0/22 ip4:192.28.128.0/18 ip4:103.237.104.0/22 ip4:130.248.172.0/24 ip4:130.248.173.0/24 ~all", "terms": [ { "text": "ip4:199.15.212.0/22", "kind": "ip4", "counts_as_lookup": false }, { "text": "ip4:72.3.185.0/24", "kind": "ip4", "counts_as_lookup": false }, { "text": "ip4:72.32.154.0/24", "kind": "ip4", "counts_as_lookup": false }, { "text": "ip4:72.32.217.0/24", "kind": "ip4", "counts_as_lookup": false }, { "text": "ip4:72.32.243.0/24", "kind": "ip4", "counts_as_lookup": false }, { "text": "ip4:94.236.119.0/26", "kind": "ip4", "counts_as_lookup": false }, { "text": "ip4:37.188.97.188/32", "kind": "ip4", "counts_as_lookup": false }, { "text": "ip4:185.28.196.0/22", "kind": "ip4", "counts_as_lookup": false }, { "text": "ip4:192.28.128.0/18", "kind": "ip4", "counts_as_lookup": false }, { "text": "ip4:103.237.104.0/22", "kind": "ip4", "counts_as_lookup": false }, { "text": "ip4:130.248.172.0/24", "kind": "ip4", "counts_as_lookup": false }, { "text": "ip4:130.248.173.0/24", "kind": "ip4", "counts_as_lookup": false }, { "text": "~all", "kind": "all", "qualifier": "~", "counts_as_lookup": false, "note": "soft fail: unlisted senders are marked, not rejected" } ], "lookups": 0, "void_lookups": 0 } }, { "text": "include:sendgrid.net", "kind": "include", "counts_as_lookup": true, "child": { "domain": "sendgrid.net", "record": "v=spf1 ip4:167.89.0.0/17 ip4:208.117.48.0/20 ip4:50.31.32.0/19 ip4:198.37.144.0/20 ip4:198.21.0.0/21 ip4:192.254.112.0/20 ip4:168.245.0.0/17 ip4:149.72.0.0/16 ip4:159.183.0.0/16 ip4:134.128.64.0/18 ip4:159.26.176.0/20 include:ab.sendgrid.net ~all", "terms": [ { "text": "ip4:167.89.0.0/17", "kind": "ip4", "counts_as_lookup": false }, { "text": "ip4:208.117.48.0/20", "kind": "ip4", "counts_as_lookup": false }, { "text": "ip4:50.31.32.0/19", "kind": "ip4", "counts_as_lookup": false }, { "text": "ip4:198.37.144.0/20", "kind": "ip4", "counts_as_lookup": false }, { "text": "ip4:198.21.0.0/21", "kind": "ip4", "counts_as_lookup": false }, { "text": "ip4:192.254.112.0/20", "kind": "ip4", "counts_as_lookup": false }, { "text": "ip4:168.245.0.0/17", "kind": "ip4", "counts_as_lookup": false }, { "text": "ip4:149.72.0.0/16", "kind": "ip4", "counts_as_lookup": false }, { "text": "ip4:159.183.0.0/16", "kind": "ip4", "counts_as_lookup": false }, { "text": "ip4:134.128.64.0/18", "kind": "ip4", "counts_as_lookup": false }, { "text": "ip4:159.26.176.0/20", "kind": "ip4", "counts_as_lookup": false }, { "text": "include:ab.sendgrid.net", "kind": "include", "counts_as_lookup": true, "child": { "domain": "ab.sendgrid.net", "record": "v=spf1 ip4:223.165.113.0/24 ip4:223.165.115.0/24 ip4:223.165.118.0/23 ip4:223.165.120.0/23 ~all", "terms": [ { "text": "ip4:223.165.113.0/24", "kind": "ip4", "counts_as_lookup": false }, { "text": "ip4:223.165.115.0/24", "kind": "ip4", "counts_as_lookup": false }, { "text": "ip4:223.165.118.0/23", "kind": "ip4", "counts_as_lookup": false }, { "text": "ip4:223.165.120.0/23", "kind": "ip4", "counts_as_lookup": false }, { "text": "~all", "kind": "all", "qualifier": "~", "counts_as_lookup": false, "note": "soft fail: unlisted senders are marked, not rejected" } ], "lookups": 0, "void_lookups": 0 } }, { "text": "~all", "kind": "all", "qualifier": "~", "counts_as_lookup": false, "note": "soft fail: unlisted senders are marked, not rejected" } ], "lookups": 1, "void_lookups": 0 } }, { "text": "ip4:62.253.227.114", "kind": "ip4", "counts_as_lookup": false }, { "text": "ip4:166.78.69.169", "kind": "ip4", "counts_as_lookup": false }, { "text": "ip4:166.78.69.170", "kind": "ip4", "counts_as_lookup": false }, { "text": "ip4:166.78.71.131", "kind": "ip4", "counts_as_lookup": false }, { "text": "~all", "kind": "all", "qualifier": "~", "counts_as_lookup": false, "note": "soft fail: unlisted senders are marked, not rejected" } ], "lookups": 10, "void_lookups": 0 }, "spf_record_count": 1, "spf_all": "~all", "dmarc": { "record": "v=DMARC1; p=quarantine; sp=reject; pct=100; rua=mailto:dmarc@github.com; ruf=mailto:dmarc@github.com; fo=1", "tags": { "fo": "1", "p": "quarantine", "pct": "100", "rua": "mailto:dmarc@github.com", "ruf": "mailto:dmarc@github.com", "sp": "reject", "v": "DMARC1" }, "policy": "quarantine", "subdomain_policy": "reject", "pct": 100, "rua": [ "mailto:dmarc@github.com" ], "ruf": [ "mailto:dmarc@github.com" ], "adkim": "r", "aspf": "r" }, "dmarc_record_count": 1, "dkim": [ { "selector": "cm", "record": "k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDXLybkpDQnCyQYlQc46kL2sPMsYDqwkjPyFRSDiaq6qUeujAlU775+f8rzxIrjHc8sPstAZOuJzqcgDPiidRxdE2Th/lcnfbN4btWvJwHKK6KD/IazNWNqQtunYyPzfmSRTtOE4Nii4Oxwx1glTJAVhCTObD2uh2U44lCG+pgYswIDAQAB", "key_type": "rsa", "bits": 1024, "testing": false, "revoked": false }, { "selector": "google", "record": "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAj6T5sl/RwdSqGoYWaWaFbS2UAeyPrEmd0gogocmRfS441qwR8/0KB81Hw89P0l4YiFRrXYk7NVIGfyCRHAYYZUzCkGeOysI2EjgzLFhd/NEsbRzOEc/kWkK/RO6JFq/5lOn6M9AZw/ap9tds4JG9ApgNNdSpPxp9DmvpsOSgNMVflRxQFrk3kdS4RNAPKu/OPoA7dlR/A/pECryjRoYgENtDXzdnK70HgCekems6UDzxDj61cjyoKoXtEMF/QsaHEQ1Gjfv014rDJBsubk/kT5VqHkWHa/ia68Z5r228Ety/wFfQNjXTx/J7KGZ9GkZlKED659eiJcLnWcKDSiQlhwIDAQAB", "key_type": "rsa", "bits": 2048, "testing": false, "revoked": false }, { "selector": "k1", "record": "k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDbNrX2cY/GUKIFx2G/1I00ftdAj713WP9AQ1xir85i89sA2guU0ta4UX1Xzm06XIU6iBP41VwmPwBGRNofhBVR+e6WHUoNyIR4Bn84LVcfZE20rmDeXQblIupNWBqLXM1Q+VieI/eZu/7k9/vOkLSaQQdml4Cv8lb3PcnluMVIhQIDAQAB;", "key_type": "rsa", "bits": 1024, "testing": false, "revoked": false }, { "selector": "k2", "record": "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAv2aC2KjGKLOwTweBY5A9RpjsxaBXR9r7OAU6U8/zn92ivImI75naUujWbItRI/QmL1jy5PWGqLwoUA0b90ObWaLDc+i9MtTNmGeWO009hr20fIxhGg6XBT2kjZ1DTThopSe1nAndsupmcBwlQ5Q6LJ+ZAxLcujnPIxM0ZBLmgpkv8u6RfY4eFP8OLvdAW3oSuB0DyLDigQX4Sj8wBO4YIdQH6AAmBeOsidsKAFNFUCpc3vCxtBDR12U+cBg724l3sBkMQ8evnz6idnqxq9QAVYh8k4kJ+RP+6cqTdy7LjIm8xY/bQNpQIpGUAuDo2DjLcCDun9DAI4Q/3z+Q0o9QuQIDAQAB;", "key_type": "rsa", "bits": 2048, "testing": false, "revoked": false }, { "selector": "k3", "record": "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsYGiMSn7fsUqSvfSX40x9R1OlRtbNiCY80lHRIlcKx3XDIR7257aUx+q9CSIARdfTL6KCuLGNFx5g9TgVr6png4ajcieSQGtOehBgxnkDN8aAA5TX0FmFrcefJU0JoxLOF09EKgXxhSSHCk/ekVb0PXSboHXoZ9+EI404F1qhcwXXIgHXTaUthHTut2P6BBZhIXIgvDe/w49GchR7MRJqjNb7neEBbYHbgWuBTvvHCg7Gy6m6n9krYK+ROWq3dVvXy9plAGK3ygM+HtjIiMt7arRGMOF0WgDTz7YdN9BGpt6BvXxLnjiQcgS5T9n+cIyPZgiWzDMXNlaEEdKTEKxrwIDAQAB;", "key_type": "rsa", "bits": 2048, "testing": false, "revoked": false }, { "selector": "s1", "record": "k=rsa; t=s; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAyn3fMCVpb7ryIRKOGXhXVGYmsWUitNlSckqGHOwNFZgFadplOrD+Qzf1XQkP7MH/VB/97DsAAJGtEXW1Uq71Hjnfr/DuBN/YfjF/gU70qEFb7q1sdIiNtjFL2TkOpoW+X/bhhPNheW/fYwyFb6ZHFM6LTgXyuimWRHTOUP3VjZzhNVda79nt+2WZYbS4l8HdMgWpTNHjpVw5PtXESA9KBg/evSRk5fIaXIX5eRXW3baoV9yVzD8O29/IL/DiSk+yNvaO0EHL5c4yGuZJhGzvpiznb2IDVdemJK4Dqzdy5FTN/SGYZhAEr7MguG3Z314hMS2scgMsOMgB64uj/6+6UwIDAQAB", "key_type": "rsa", "bits": 2048, "testing": false, "revoked": false }, { "selector": "s2", "record": "k=rsa; t=s; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnNt2/H6bKs99C6DAaokPp62KN9mKaD20D1PBakkObejkJvzM6Un/fKHPeI2/qXdvFFBPQE3mxMNoe+hwBVDgMgCuZEn8J6gZYI4amITure9/ny6+GaNVRoH2m6xAtWwKINkKxMayGiehkWlRVb7D23F0U8y+VDHKQFz1bnXA5jDpcDiMXy8i2lV5vEys+qt+1WGhDKCAwamT8c3xkZz8aXMJaXYCiN2HMgHDU81+mVCk4+u6mY+a98APVfFhsQ0KCq/mVZXaXTV06QrG9M5PtBHUFW7VtwXKp+AFrAut0KW1NnwaA5IGA5sc+n9dma7bSqdfGS+ixdSmJ69NwmYSHwIDAQAB", "key_type": "rsa", "bits": 2048, "testing": false, "revoked": false }, { "selector": "selector1", "record": "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCxZC/z2cK+2s1f/ktzSDSeFzkfIHrjwtGFsfKMAYvKaXjPVNzKykpbXBkX5nB7dVUTFttda7aROr2iSrIseQ27Ui+4rUZVzgFanE8RaXhYM9n5wPKNv8GtLJk7JgcsYZ7ErgID4uW2sEYyV/dnRYw6rDzOaeRKkKELTUfJI5ebLQIDAQAB;", "key_type": "rsa", "bits": 1024, "testing": false, "revoked": false }, { "selector": "zendesk1", "record": "v=DKIM1;t=s;n=core;k=rsa;p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA9IqdLrO3Zr2/56MHt8oQVCQorP0Bl2Fz9sM2tFBnJCdB/HogQmuudEg2xAovCN2PYpw44UijIvPuBoT9vxiv6ZCBJTLJXa82r6ke5rE4tbe9NKFIrVIb9S306cJDrnKFMDb8p0dU/Su0+eUR5gVAOtCuz2L8HAzs5edvsEvD/Fb4ny1RLNSEPZkIQLfGhVxQeWANm3+1Jwb/OBVXV9k0nKpWrpgqcmO7NzroJirp014RQY7rGi60JLUubc6XhvoFQBQrtOAdVlZC5wvfS1bgpq5kQpdP7cajIqWCeqxPTeo0ZUpey2ZcaygEsZz0Z3Gs5wDzyuqd7/ADpr2jNF7ozwIDAQAB", "key_type": "rsa", "bits": 2048, "testing": false, "revoked": false }, { "selector": "zendesk2", "record": "v=DKIM1; t=s; n=core; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAmiSFNkgXrO3I8aOaPONDZWHv027rkiGIwb838OyXPgvFDEkCV/qGcdXSjZnaVAadrTm/oKnL8WOltP9zB1FLEuKt0fTi5zRyKPE4oIYCnEzXwrGqzjUcCABQBawQVqvXjDOaYh9Lhp8W5PYOLo905vRW7ipyIMDhuzBOJls91/WWXnNK0OwP3RghiisZjA3K2KqtRwf7w6GjNeNuAMNhvcmgAN15d/mhK+dev/hcRbal66RoYyTD8c0F0isahWH0envEX8aj+SBhheNk0/U37dGE+4nFaY5yP9CUlYjFKDSIKZgHzG4Hci3t/RubU58pi6BCrQQdAFvIOeDFeCZ0ywIDAQAB", "key_type": "rsa", "bits": 2048, "testing": false, "revoked": false } ], "dkim_selectors_tried": 43, "checks": [ { "name": "MX records", "status": "pass", "value": "0 github-com.mail.protection.outlook.com", "note": "A single MX host. Fine for a hosted provider that is itself redundant; a self-hosted server would want a backup." }, { "name": "STARTTLS", "status": "pass", "value": "1 of 1 offer TLS with a valid certificate", "note": "Inbound mail can be encrypted in transit." }, { "name": "SPF", "status": "warn", "value": "~all, 10 of 10 lookups", "note": "Valid, but right at the lookup limit. One more include (or a provider adding one on their side) breaks it.", "guide": "https://kirkdiamond.com/guides/spf-10-dns-lookup-limit" }, { "name": "DMARC", "status": "pass", "value": "p=quarantine", "note": "Failing mail goes to spam. p=reject is the final step once you are confident." }, { "name": "DKIM", "status": "warn", "value": "cm, google, k1, k2, k3, s1, s2, selector1, zendesk1, zendesk2", "note": "Found, but cm (1024 bit), k1 (1024 bit), selector1 (1024 bit) is shorter than 2048 bits. 1024-bit RSA is considered breakable and some receivers ignore such signatures. Rotate to 2048.", "guide": "https://kirkdiamond.com/guides/spf-vs-dkim-vs-dmarc" }, { "name": "MTA-STS", "status": "info", "value": "not published", "note": "Optional. MTA-STS tells sending servers to require TLS and a valid certificate when delivering to you, closing the downgrade gap in opportunistic STARTTLS. Gmail and Outlook honour it.", "guide": "https://kirkdiamond.com/guides/mta-sts-explained" }, { "name": "TLS-RPT", "status": "info", "value": "not published", "note": "Optional. TLS-RPT gives you daily reports from big senders about TLS failures when delivering to your domain. Cheap to add and very useful alongside MTA-STS.", "guide": "https://kirkdiamond.com/guides/mta-sts-explained" } ], "grade": "B", "pass": 3, "warn": 2, "fail": 0, "elapsed": "740ms", "resolver": "1.1.1.1", "checked_at": "2026-10-29T19:12:56Z" }