A

google.com

Scores 97 / 100 on email authentication. 0 critical, 2 warning.

Measured just now. Live DNS, nothing cached from a third party.

Findings

Ordered worst first. Every item says what to change.

warnSPF ends in ~all (soft fail)

Unauthorised senders are marked, not rejected.

Fix: Once your DMARC reports show every legitimate sender passing, tighten this to -all.

warnNo DKIM key found at any common selector

26 well-known selectors were probed and none answered. DKIM selectors cannot be enumerated from DNS, so this is not proof of absence - but if you do not know your selector, neither does anyone auditing you.

Fix: Enable DKIM signing at your mail provider and publish the key it gives you.

goodMX records found

10 smtp.google.com

goodSPF record found

v=spf1 include:_spf.google.com ~all

goodSPF uses 1 of 10 permitted DNS lookups

goodDMARC record found

v=DMARC1; p=reject; rua=mailto:mailauth-reports@google.com

goodDMARC policy is p=reject

Spoofed mail is refused.

goodAggregate reporting is on

rua=mailto:mailauth-reports@google.com

goodMTA-STS record published

v=STSv1; id=20210803T010101;

goodTLS-RPT record published

v=TLSRPTv1;rua=mailto:sts-reports@google.com

Records as published

LookupResult
MX 10 smtp.google.com
TXT (root) v=spf1 include:_spf.google.com ~all
google-site-verification=TV9-DBe4R80X4v0M4U_bd_J9cpOJM0nikft0jAgjmsQ
Z29vZ2xl
facebook-domain-verification=22rm551cu4k0ab0bxsw536tlds4h95
docusign=05958488-4752-4ef2-95eb-aa7ba8a3bd0e
MS=E4A68B9AB2BB9670BCE15412F62916164C0B20BB
google-site-verification=4ibFUgB-wXLQ_S7vsXVomSTVamuOXBiVAzpR5IZ87D0
globalsign-smime-dv=CDYX+XFHUw2wml6/Gb8+59BsH31KzUr6c1l2BPvqKX8=
work-accounts-domain-verification=Tcj6JjIMZOw2KsSEw2Nt2rLae89tN6
onetrust-domain-verification=6d685f1d41a94696ad7ef771f68993e0
docusign=1b0a6754-49b1-4db5-8540-d2c12664b289
onetrust-domain-verification=0d477fe608074e6f9c12bca7826035cc
google-site-verification=wD8N7i1JTNTkezJ49swvWW48f8_9xveREV4oB-0Hf5o
_r4rd1pvwyrpi7sw4a3hzmw8e51yh9td
cisco-ci-domain-verification=47c38bc8c4b74b7233e9053220c1bbe76bcc1cd33c7acf7acd36cd6a5332004b
apple-domain-verification=30afIBcvSuDV2PLX
_dmarc TXT v=DMARC1; p=reject; rua=mailto:mailauth-reports@google.com
BIMI none published
MTA-STS v=STSv1; id=20210803T010101;
TLS-RPT v=TLSRPTv1;rua=mailto:sts-reports@google.com
DKIM no key at any probed selector

This page is a permanent link. Send it to whoever owns the DNS.

A grade is a snapshot. Reports are the film.

This page tells you what google.com has published. It cannot tell you who is actually sending mail as google.com today - only DMARC reports do that, and only if somebody is collecting them.

Monitor google.com free Pricing for a roster