Email Deliverability Check

2 MX record(s) found.

MX records define where email for your domain is delivered. Without them, no mail can be received. Multiple MX records with different priorities provide automatic failover. An RFC 7505 Null MX (priority 0, host “.”) is detected and shown here — it explicitly declares the domain does not accept email.

SPF uses -all (hard fail). Strict and recommended.

SPF lists which IP addresses are authorised to send email as your domain. A hard fail (-all) is strongest — receivers reject anything not on the list outright.

v=spf1 include:%{ir}.%{v}.%{d}.spf.has.pphosted.com -all

DKIM records found but contain tag errors — see breakdown below.

DKIM adds a cryptographic signature to every outgoing message. Receiving servers use your public key (published in DNS) to verify the message hasn't been altered in transit.

selector1._domainkey Microsoft 365 RSA  1024-bit ⚠ collapse

Tag	Value	Status	Notes & Guidance
v=	DKIM1	✓
k=	rsa	✓
p=	MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCwjnBe+Q6zdxEJ…	✓
n=	1024,1450207371,1466018571	i	Human-readable notes field — no validation required

k1._domainkey Klaviyo RSA  1024-bit ⚠ HAS ERRORS expand

Tag	Value	Status	Notes & Guidance
v=	(missing)	✗	Required tag v= is absent. Record must include v=DKIM1
k=	rsa	✓
p=	MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDbNrX2cY/GUKIF…	✓

k2._domainkey Klaviyo RSA  2048-bit expand

Tag	Value	Status	Notes & Guidance
v=	DKIM1	✓
k=	rsa	✓
p=	MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAv2aC2KjG…	✓

k3._domainkey Klaviyo RSA  2048-bit expand

Tag	Value	Status	Notes & Guidance
v=	DKIM1	✓
k=	rsa	✓
p=	MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsYGiMSn7…	✓

DMARC policy is reject. Excellent.

DMARC ties SPF and DKIM together with an enforcement policy. p=reject is the gold standard — it instructs receivers to block unauthenticated mail entirely and protects your domain from spoofing.

v=DMARC1; p=reject; rua=mailto:dmarc_rua@emaildefense.proofpoint.com; ruf=mailto:dmarc_ruf@emaildefense.proofpoint.com

DMARC reporting configured. Aggregate (rua): mailto:dmarc_rua@emaildefense.proofpoint.com; Forensic (ruf): mailto:dmarc_ruf@emaildefense.proofpoint.com.

DMARC can send you daily XML reports (rua=) about which servers are sending mail as your domain and whether they pass authentication. Forensic reports (ruf=) include individual failure samples. Without these you are flying blind.

No MTA-STS DNS record found. MTA-STS forces TLS for inbound mail.

MTA-STS forces other mail servers to use TLS encryption when delivering to you, blocking downgrade attacks that would expose messages in transit. It works together with TLSRPT for visibility.

No TLS Reporting (TLSRPT) record. Optional but recommended alongside MTA-STS.

When TLS negotiation fails during inbound delivery, TLSRPT sends you a structured JSON report. This lets you detect misconfigured sending servers or active downgrade attacks targeting your MTA-STS policy.

BIMI is configured.

BIMI lets you display your verified brand logo in supporting inboxes (Gmail, Apple Mail, Yahoo). It requires DMARC with quarantine or reject, and an SVG logo hosted at a published URL.

v=BIMI1; l=https://www.reuters.com/static/email/bimi_logo.svg

All MX server IPs have valid PTR records with forward-confirmed reverse DNS (FCrDNS).

Checks that each MX server IP has a PTR record and that the PTR hostname forward-resolves back to the same IP (FCrDNS). Most spam filters require FCrDNS to pass — a missing or non-confirming PTR raises the spam score of your outbound mail.

1 IP checked against 10 DNSBL zones — all clean.

Checks whether your MX server IPs (IPv4 and IPv6) appear on major spam blocklists (Spamhaus, SpamCop, Barracuda, SORBS, and others). A single listing can cause severe delivery failures at major providers.