{ "domain": "gmail.com", "mx": [ { "preference": 5, "host": "gmail-smtp-in.l.google.com", "ips": [ "192.178.223.26", "2a00:1450:4009:c0f::1a" ], "starttls": "yes", "tls_version": "TLS 1.3", "cert_valid": true, "rtt": "9ms" }, { "preference": 10, "host": "alt1.gmail-smtp-in.l.google.com", "ips": [ "142.250.102.27", "2a00:1450:4025:402::1a" ], "starttls": "yes", "tls_version": "TLS 1.3", "cert_valid": true, "rtt": "20ms" }, { "preference": 20, "host": "alt2.gmail-smtp-in.l.google.com", "ips": [ "192.178.213.27", "2a00:1450:4013:c1e::1b" ], "starttls": "yes", "tls_version": "TLS 1.3", "cert_valid": true, "rtt": "19ms" }, { "preference": 30, "host": "alt3.gmail-smtp-in.l.google.com", "ips": [ "142.251.127.26", "2a00:1450:4001:c21::1b" ], "starttls": "yes", "tls_version": "TLS 1.3", "cert_valid": true, "rtt": "24ms" }, { "preference": 40, "host": "alt4.gmail-smtp-in.l.google.com", "ips": [ "192.178.228.26", "2a00:1450:4025:4403::1a" ], "starttls": "yes", "tls_version": "TLS 1.3", "cert_valid": true, "rtt": "32ms" } ], "null_mx": false, "mx_source": "MX", "spf": { "domain": "gmail.com", "record": "v=spf1 redirect=_spf.google.com", "terms": [ { "text": "redirect=_spf.google.com", "kind": "redirect", "counts_as_lookup": true, "child": { "domain": "_spf.google.com", "record": "v=spf1 ip4:74.125.0.0/16 ip4:209.85.128.0/17 ip6:2001:4860:4864::/56 ip6:2404:6800:4864::/56 ip6:2607:f8b0:4864::/56 ip6:2800:3f0:4864::/56 ip6:2a00:1450:4864::/56 ip6:2c0f:fb50:4864::/56 ~all", "terms": [ { "text": "ip4:74.125.0.0/16", "kind": "ip4", "counts_as_lookup": false }, { "text": "ip4:209.85.128.0/17", "kind": "ip4", "counts_as_lookup": false }, { "text": "ip6:2001:4860:4864::/56", "kind": "ip6", "counts_as_lookup": false }, { "text": "ip6:2404:6800:4864::/56", "kind": "ip6", "counts_as_lookup": false }, { "text": "ip6:2607:f8b0:4864::/56", "kind": "ip6", "counts_as_lookup": false }, { "text": "ip6:2800:3f0:4864::/56", "kind": "ip6", "counts_as_lookup": false }, { "text": "ip6:2a00:1450:4864::/56", "kind": "ip6", "counts_as_lookup": false }, { "text": "ip6:2c0f:fb50:4864::/56", "kind": "ip6", "counts_as_lookup": false }, { "text": "~all", "kind": "all", "qualifier": "~", "counts_as_lookup": false, "note": "soft fail: unlisted senders are marked, not rejected" } ], "lookups": 0, "void_lookups": 0 } } ], "lookups": 1, "void_lookups": 0 }, "spf_record_count": 1, "spf_all": "~all", "dmarc": { "record": "v=DMARC1; p=none; sp=quarantine; rua=mailto:mailauth-reports@google.com", "tags": { "p": "none", "rua": "mailto:mailauth-reports@google.com", "sp": "quarantine", "v": "DMARC1" }, "policy": "none", "subdomain_policy": "quarantine", "pct": 100, "rua": [ "mailto:mailauth-reports@google.com" ], "adkim": "r", "aspf": "r" }, "dmarc_record_count": 1, "dkim_selectors_tried": 43, "mta_sts": { "record": "v=STSv1; id=20190429T010101;", "id": "20190429T010101", "policy": "version: STSv1\nmode: enforce\nmx: smtp.google.com\nmx: gmail-smtp-in.l.google.com\nmx: *.gmail-smtp-in.l.google.com\nmax_age: 86400", "version": "STSv1", "mode": "enforce", "mx": [ "smtp.google.com", "gmail-smtp-in.l.google.com", "*.gmail-smtp-in.l.google.com" ], "max_age": "86400", "max_age_seconds": 86400, "content_type": "text/plain", "mx_covered": [ "gmail-smtp-in.l.google.com", "alt1.gmail-smtp-in.l.google.com", "alt2.gmail-smtp-in.l.google.com", "alt3.gmail-smtp-in.l.google.com", "alt4.gmail-smtp-in.l.google.com" ] }, "tls_rpt": "v=TLSRPTv1;rua=mailto:sts-reports@google.com", "checks": [ { "name": "MX records", "status": "pass", "value": "5 gmail-smtp-in.l.google.com, 10 alt1.gmail-smtp-in.l.google.com, 20 alt2.gmail-smtp-in.l.google.com, 30 alt3.gmail-smtp-in.l.google.com, 40 alt4.gmail-smtp-in.l.google.com", "note": "Inbound mail is routed to these hosts, lowest preference first." }, { "name": "STARTTLS", "status": "pass", "value": "5 of 5 offer TLS with a valid certificate", "note": "Inbound mail can be encrypted in transit." }, { "name": "SPF", "status": "pass", "value": "~all, 1 of 10 lookups", "note": "Soft fail. Unlisted senders are flagged rather than rejected; with DMARC in place that is enough for alignment. -all is stricter once you are confident every sender is listed." }, { "name": "DMARC", "status": "warn", "value": "p=none", "note": "Monitoring only. Spoofed mail is still delivered; you just get told about it. Once the reports show all legitimate senders passing, move to p=quarantine and then p=reject.", "guide": "https://kirkdiamond.com/guides/dmarc-none-vs-quarantine-vs-reject" }, { "name": "DKIM", "status": "info", "value": "no common selectors found", "note": "Checked 43 selectors used by common providers. DKIM keys live at \u003cselector\u003e._domainkey and the selector name is chosen by the sender, so a custom one cannot be discovered from outside. Check a real message's DKIM-Signature header for the s= value.", "guide": "https://kirkdiamond.com/guides/spf-vs-dkim-vs-dmarc" }, { "name": "MTA-STS", "status": "pass", "value": "mode: enforce", "note": "Senders that support MTA-STS will refuse to deliver over an insecure connection. The policy covers all 5 MX hosts and is cached for 1 day; change the id when you change it." }, { "name": "TLS-RPT", "status": "pass", "value": "v=TLSRPTv1;rua=mailto:sts-reports@google.com", "note": "Senders will report TLS delivery problems to this address." } ], "grade": "B", "pass": 5, "warn": 1, "fail": 0, "elapsed": "433ms", "resolver": "1.1.1.1", "checked_at": "2026-10-29T19:11:34Z" }