CHECK RESULT
google.com
Some records exist, but authorization or the failure policy is incomplete.
73
/ 100
20 + 8 + 30 + 15 = 73
2026-10-20T13:37:05.622Z · Node DNS (1.1.1.1 / 8.8.8.8)
Fix first
SPF uses softfail (~all)
~all means suspicious, and many receivers still accept the message. After every legitimate sender is listed, change the qualifier to -all.
No DKIM key on common selectors
DNS cannot list every selector. None of the 19 common names (google, selector1, selector2, k1, s1, fm1, and others) published a key. Custom or date-based selectors are not queried.
spfWho may send
20/30 · Check
SPF uses softfail (~all)
dkimSignature key
8/25 · Unknown
No DKIM key on common selectors
dmarcFailure policy
30/30 · Pass
DMARC policy is reject
Mail that fails alignment should be rejected. Before you change sending services, add them to SPF and sign with DKIM.
mxWhere bounces go
15/15 · Pass
MX records look usable
The lowest preference is smtp.google.com (10). Confirm that host actually accepts mail.
Records we saw
- SPF
- v=spf1 include:_spf.google.com ~all
- DMARC
- v=DMARC1; p=reject; rua=mailto:mailauth-reports@google.com
- MX
- 10 smtp.google.com
- DKIM
- Checked google, selector1, selector2, k1, k2, k3, s1, s2, default, dkim, mail, cm, protonmail, zoho, mandrill, pic, fm1, fm2, fm3; no records
What this check does not do
- DKIM is limited to common selectors. A miss does not prove the domain never signs.
- SPF include chains are not expanded. The 10-lookup warning counts mechanisms on this record only.
- Public DNS reads only. No mail is sent, no mailbox is opened, and no registrar is contacted.