{"domain":"cloudflare.com","checkedAt":"2026-08-06T22:05:25.455Z","resolver":"Cloudflare (1.1.1.1)","dnssec":true,"checks":[{"id":"spf","title":"SPF","status":"pass","found":true,"records":["v=spf1 ip4:199.15.212.0/22 ip4:173.245.48.0/20 include:_spf.google.com include:spf1.mcsv.net include:spf.mandrillapp.com include:mail.zendesk.com include:stspg-customer.com include:_spf.salesforce.com -all"],"findings":[{"severity":"pass","message":"SPF record published"},{"severity":"pass","message":"`-all` (hard fail)","detail":"Strict policy: unlisted servers are rejected. Recommended."},{"severity":"pass","message":"7 of 10 DNS lookups used"}],"details":{"record":"v=spf1 ip4:199.15.212.0/22 ip4:173.245.48.0/20 include:_spf.google.com include:spf1.mcsv.net include:spf.mandrillapp.com include:mail.zendesk.com include:stspg-customer.com include:_spf.salesforce.com -all","all":"-all","dnsLookups":7,"maxLookups":10,"voidLookups":0,"lookupErrors":0,"duplicates":[],"expansion":{"domain":"cloudflare.com","record":"v=spf1 ip4:199.15.212.0/22 ip4:173.245.48.0/20 include:_spf.google.com include:spf1.mcsv.net include:spf.mandrillapp.com include:mail.zendesk.com include:stspg-customer.com include:_spf.salesforce.com -all","terms":[{"kind":"include","value":"_spf.google.com","record":"v=spf1 ip4:74.125.0.0/16 ip4:209.85.128.0/17 ip6:2001:4860:4864::/56 ip6:2404:6800:4864::/56 ip6:2607:f8b0:4864::/56 ip6:2800:3f0:4864::/56 ip6:2a00:1450:4864::/56 ip6:2c0f:fb50:4864::/56 ~all","children":[]},{"kind":"include","value":"spf1.mcsv.net","record":"v=spf1 ip4:205.201.128.0/20 ip4:198.2.128.0/18 ?all","children":[]},{"kind":"include","value":"spf.mandrillapp.com","record":"v=spf1 ip4:198.2.128.0/24 ip4:198.2.132.0/22 ip4:198.2.136.0/23 ip4:198.2.145.0/24 ip4:198.2.186.0/23 ip4:205.201.131.0/24 ip4:205.201.134.128/25 ip4:205.201.136.0/23 ip4:205.201.139.0/24 ip4:198.2.177.0/24 ip4:198.2.178.0/23 ip4:198.2.180.0/24 ~all","children":[]},{"kind":"include","value":"mail.zendesk.com","record":"v=spf1 ip4:103.151.192.0/23 ip4:185.12.80.0/22 ip4:188.172.128.0/20 ip4:192.161.144.0/20 ip4:216.198.0.0/18 ~all","children":[]},{"kind":"include","value":"stspg-customer.com","record":"v=spf1 ip4:23.253.182.103 ip4:23.253.183.145 ip4:23.253.183.146 ip4:23.253.183.147 ip4:23.253.183.148 ip4:23.253.183.150 ip4:166.78.68.221 ip4:167.89.46.159 ip4:167.89.64.9 ip4:167.89.65.0 ip4:167.89.65.53 ip4:167.89.65.100 ip4:167.89.74.233 ip4:167.89.75.33 ip4:167.89.75.126 ip4:167.89.75.136 ip4:167.89.75.164 ip4:192.237.159.42 ip4:192.237.159.43 ip4:159.112.242.162 ip4:159.135.228.10 ip4:198.244.56.107 ip4:198.244.56.108 ip4:198.244.56.109 ip4:198.244.56.111 ip4:198.244.56.112 ip4:198.244.56.113 ip4:198.244.56.114 ip4:198.244.56.115 ip4:204.220.181.105 ~all","children":[]},{"kind":"include","value":"_spf.salesforce.com","record":"v=spf1 exists:%{i}._spf.mta.salesforce.com -all","children":[{"kind":"exists","value":"%{i}._spf.mta.salesforce.com"}]}]}}},{"id":"dkim","title":"DKIM","status":"fail","found":true,"records":["k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDbNrX2cY/GUKIFx2G/1I00ftdAj713WP9AQ1xir85i89sA2guU0ta4UX1Xzm06XIU6iBP41VwmPwBGRNofhBVR+e6WHUoNyIR4Bn84LVcfZE20rmDeXQblIupNWBqLXM1Q+VieI/eZu/7k9/vOkLSaQQdml4Cv8lb3PcnluMVIhQIDAQAB;","k=rsa; t=s; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA1m74n5R+xcz+ICbNBWRIlQeHI65Hjp67+P59XSe71jItafrcJ4/5y/UvU+uNg7KNeOcEsotGo7QvLN87hqZSZqfzVyyGnQuEUXoKPdKokD6Pa5KmJSqbA5Y/f977HpikU9Xtd7Orc7ctRLK6H5QFvGwRi+oC9NRkgNB55UUnLbbkKK+LGeTw4Ghmr5gupw7iYzFXZ1qlFNqV6s9Pmgb+b7oDv+OfQxB/MJyUzQ5eWdKlJWfmW3s77J3fHFfysUbKKUBxEXPxNiMFRG1ClllZ4+AYRh1jrFpjbvZ5j43kqahKXeHDNkF+Gpptd7ufWIevAPTQDSVdKB9vyJQN6wfcQQIDAQAB","k=rsa; t=s; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDPtW5iwpXVPiH5FzJ7Nrl8USzuY9zqqzjE0D1r04xDN6qwziDnmgcFNNfMewVKN2D1O+2J9N14hRprzByFwfQW76yojh54Xu3uSbQ3JP0A7k8o8GutRF8zbFUA8n0ZH2y0cIEjMliXY4W4LwPA7m4q0ObmvSjhd63O9d8z1XkUBwIDAQAB"],"findings":[{"severity":"fail","message":"Valid DKIM key on selector `k1`","detail":"RSA key, ~992-bit — keys under 1024 bits are insecure and widely rejected."},{"severity":"pass","message":"Valid DKIM key on selector `s1`","detail":"RSA key, ~2048-bit"},{"severity":"fail","message":"Valid DKIM key on selector `smtpapi`","detail":"RSA key, ~992-bit — keys under 1024 bits are insecure and widely rejected."},{"severity":"info","message":"5 selector probes didn't complete — results may be incomplete","detail":"A temporary DNS error prevented probing these selectors (marked “lookup failed” in the probed-selector list below). Keys may still exist on them — re-run the check in a moment."}],"details":{"probed":33,"errors":5,"selectors":[{"selector":"google","found":false,"error":false},{"selector":"selector1","found":false,"error":false},{"selector":"selector2","found":false,"error":false},{"selector":"k1","found":true,"error":false,"record":"k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDbNrX2cY/GUKIFx2G/1I00ftdAj713WP9AQ1xir85i89sA2guU0ta4UX1Xzm06XIU6iBP41VwmPwBGRNofhBVR+e6WHUoNyIR4Bn84LVcfZE20rmDeXQblIupNWBqLXM1Q+VieI/eZu/7k9/vOkLSaQQdml4Cv8lb3PcnluMVIhQIDAQAB;","keyType":"rsa","keyBits":992,"revoked":false},{"selector":"k2","found":false,"error":false},{"selector":"k3","found":false,"error":false},{"selector":"s1","found":true,"error":false,"record":"k=rsa; t=s; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA1m74n5R+xcz+ICbNBWRIlQeHI65Hjp67+P59XSe71jItafrcJ4/5y/UvU+uNg7KNeOcEsotGo7QvLN87hqZSZqfzVyyGnQuEUXoKPdKokD6Pa5KmJSqbA5Y/f977HpikU9Xtd7Orc7ctRLK6H5QFvGwRi+oC9NRkgNB55UUnLbbkKK+LGeTw4Ghmr5gupw7iYzFXZ1qlFNqV6s9Pmgb+b7oDv+OfQxB/MJyUzQ5eWdKlJWfmW3s77J3fHFfysUbKKUBxEXPxNiMFRG1ClllZ4+AYRh1jrFpjbvZ5j43kqahKXeHDNkF+Gpptd7ufWIevAPTQDSVdKB9vyJQN6wfcQQIDAQAB","keyType":"rsa","keyBits":2048,"revoked":false},{"selector":"s2","found":false,"error":false},{"selector":"smtpapi","found":true,"error":false,"record":"k=rsa; t=s; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDPtW5iwpXVPiH5FzJ7Nrl8USzuY9zqqzjE0D1r04xDN6qwziDnmgcFNNfMewVKN2D1O+2J9N14hRprzByFwfQW76yojh54Xu3uSbQ3JP0A7k8o8GutRF8zbFUA8n0ZH2y0cIEjMliXY4W4LwPA7m4q0ObmvSjhd63O9d8z1XkUBwIDAQAB","keyType":"rsa","keyBits":992,"revoked":false},{"selector":"mail","found":false,"error":false},{"selector":"default","found":false,"error":false},{"selector":"dkim","found":false,"error":false},{"selector":"smtp","found":false,"error":false},{"selector":"mxvault","found":false,"error":false},{"selector":"sig1","found":false,"error":false},{"selector":"litesrv","found":false,"error":false},{"selector":"mte1","found":false,"error":false},{"selector":"pm","found":false,"error":false},{"selector":"pic","found":false,"error":false},{"selector":"scph0","found":false,"error":false},{"selector":"scph1","found":false,"error":false},{"selector":"dkim1","found":false,"error":false},{"selector":"ctct1","found":false,"error":false},{"selector":"ctct2","found":false,"error":false},{"selector":"sm1","found":false,"error":false},{"selector":"zoho","found":false,"error":false},{"selector":"zmail","found":false,"error":false},{"selector":"fm1","found":false,"error":false},{"selector":"fm2","found":false,"error":true},{"selector":"fm3","found":false,"error":true},{"selector":"mandrill","found":false,"error":true},{"selector":"dtd","found":false,"error":true},{"selector":"dtd2","found":false,"error":true}]}},{"id":"dmarc","title":"DMARC","status":"info","found":true,"records":["v=DMARC1; p=reject; sp=reject; adkim=r; aspf=r; pct=100; rua=mailto:a1c47f179bc04efd8ee4dcd4d85dfc65@dmarc-reports.cloudflare.net,mailto:rua@cloudflare.com"],"findings":[{"severity":"pass","message":"DMARC record published"},{"severity":"pass","message":"Policy `p=reject` (strongest)","detail":"Mail that fails authentication is rejected. Best protection against spoofing."},{"severity":"info","message":"Policy applied to all mail (`pct=100`)","detail":"`pct` is the percentage of failing mail your `p` policy is applied to. 100 (also the default when the tag is omitted) means every failing message is subject to the policy — full enforcement."},{"severity":"pass","message":"Aggregate reports enabled (rua)","detail":"mailto:a1c47f179bc04efd8ee4dcd4d85dfc65@dmarc-reports.cloudflare.net,mailto:rua@cloudflare.com"},{"severity":"info","message":"Subdomain policy `sp=reject`","detail":"Sets the DMARC policy for subdomains separately from `p` — here, mail from a subdomain that fails authentication is rejected outright. Without an `sp` tag, subdomains inherit the `p` policy."},{"severity":"info","message":"DKIM alignment `adkim=r` (relaxed)"},{"severity":"info","message":"SPF alignment `aspf=r` (relaxed)"}],"details":{"record":"v=DMARC1; p=reject; sp=reject; adkim=r; aspf=r; pct=100; rua=mailto:a1c47f179bc04efd8ee4dcd4d85dfc65@dmarc-reports.cloudflare.net,mailto:rua@cloudflare.com","tags":{"v":"DMARC1","p":"reject","sp":"reject","adkim":"r","aspf":"r","pct":"100","rua":"mailto:a1c47f179bc04efd8ee4dcd4d85dfc65@dmarc-reports.cloudflare.net,mailto:rua@cloudflare.com"},"policy":"reject"}},{"id":"mx","title":"MX","status":"pass","found":true,"records":["5 mxa-canary.global.inbound.cf-emailsecurity.net","5 mxb-canary.global.inbound.cf-emailsecurity.net","10 mxa.global.inbound.cf-emailsecurity.net","10 mxb.global.inbound.cf-emailsecurity.net"],"findings":[{"severity":"pass","message":"4 MX records found"}],"details":{"records":[{"priority":5,"host":"mxa-canary.global.inbound.cf-emailsecurity.net","ipv4":["172.65.169.99"],"ipv6":[]},{"priority":5,"host":"mxb-canary.global.inbound.cf-emailsecurity.net","ipv4":["172.65.65.66"],"ipv6":[]},{"priority":10,"host":"mxa.global.inbound.cf-emailsecurity.net","ipv4":["172.65.64.78"],"ipv6":[]},{"priority":10,"host":"mxb.global.inbound.cf-emailsecurity.net","ipv4":["172.65.64.78"],"ipv6":[]}]}},{"id":"bimi","title":"BIMI","status":"pass","found":true,"records":["v=BIMI1; l=https://www.cloudflare.com/cloudflare_1171114652.svg; a=https://www.cloudflare.com/cloudflare_1171114652.pem"],"findings":[{"severity":"pass","message":"BIMI record published"},{"severity":"pass","message":"Logo URL present (l=)"},{"severity":"pass","message":"Verified Mark Certificate present (a=)"}],"details":{"record":"v=BIMI1; l=https://www.cloudflare.com/cloudflare_1171114652.svg; a=https://www.cloudflare.com/cloudflare_1171114652.pem","logoUrl":"https://www.cloudflare.com/cloudflare_1171114652.svg","vmcUrl":"https://www.cloudflare.com/cloudflare_1171114652.pem"}},{"id":"mta-sts","title":"MTA-STS","status":"info","found":false,"records":[],"findings":[{"severity":"info","message":"No MTA-STS record (optional)","detail":"MTA-STS lets you require TLS encryption for inbound mail, protecting against downgrade and interception attacks. Publish a _mta-sts TXT record and a policy file to enable it."}]},{"id":"dnssec","title":"DNSSEC","status":"pass","found":true,"records":["2371 ECDSAP256SHA256 2 32996839a6d808afe3eb4a795a0e6a7a39a76fc52ff228b22b76f6d63826f2b9"],"findings":[{"severity":"pass","message":"DNSSEC enabled and validating — 1 DS record at the parent","detail":"The resolver cryptographically validated the chain of trust up to the root, confirming your DNS answers can't be tampered with. The zone publishes 2 DNSKEYs (0 KSK, 0 ZSK)."}],"details":{"state":"validating-ok","ds":{"outcome":"records","ad":true,"status":0,"records":["2371 ECDSAP256SHA256 2 32996839a6d808afe3eb4a795a0e6a7a39a76fc52ff228b22b76f6d63826f2b9"]},"dnskey":{"outcome":"records","ad":true,"status":0,"records":["256 3 ECDSAP256SHA256 oJMRESz5E4gYzS/q6XDrvU1qMPYIjCWzJaOau8XNEZeqCYKD5ar0IRd8KqXXFJkqmVfRvMGPmM1x8fGAa2XhSA==","257 3 ECDSAP256SHA256 mdsswUyr3DPW132mOi8V9xESWE8jTo0dxCjjnopKl+GqJxpVXckHAeF+KkxLbxILfDLUT0rAK9iUzy1L53eKGQ=="]},"keys":[],"dsRecords":[]}}],"summary":{"status":"fail","passCount":12,"warnCount":0,"failCount":2}}