MailAuthWatch
B75/100

facebook.com

2 fixes stand between this domain and a clean A. 3 items below, ordered by how much inbox they are costing you.

SPF PASSDKIM REVOKED ONLYDMARC REJECTMX OK
Monitor this domainRe-run checkMeasured 0s ago · 105 ms · public DNS

Fix these, in this order

ranked by impact
1
The only DKIM selector found (default) is revoked.

A selector published with an empty key tells receivers to fail any mail signed with it, and no active key was found under common selectors.

Do this: publish a new key under an active selector, or add your real selector to the check if it is one we did not probe.

2
No DKIM key found under 79 common selectors.

Either DKIM signing is off, or it uses a selector we did not probe. Without DKIM, forwarded mail and anything that breaks SPF fails DMARC.

Do this: turn on DKIM at your mail provider and at every third-party sender, then add the selector names when monitoring so they are verified daily. If DKIM is already on with an uncommon selector, add it to the check.

3
Aggregate reports are being sent to a domain that has not authorised yours.

dmarc.facebookmail.com has not published facebook.com._report._dmarc.dmarc.facebookmail.com, so receivers will discard aggregate reports sent there.

Do this: ask the report provider to publish the authorisation record, or use an address on your own domain.

Records found

SPF · TXT
v=spf1 redirect=_spf.facebook.com
DMARC · _dmarc.facebook.com
v=DMARC1; p=reject; rua=mailto:a@dmarc.facebookmail.com; ruf=mailto:fb-dmarc@datafeeds.phishlabs.com; pct=100
DKIM · 0 of 79 selectors
none under common selectors
MX · Custom / other
10 smtpin.vvv.facebook.com

Grade history

Free checks keep nothing. Monitoring records every daily measurement and alerts you on change.
History goes back as far as your subscription.

SPF OK

v=spf1 redirect=_spf.facebook.com
DNS lookups
1 of 10 allowed
Final mechanism
-all
  • OK No problems detected.

Include tree

1 / 10
facebook.com0
└─ include:_spf.facebook.com+1

DKIM Not found

DKIM selectors cannot be listed from DNS, so 79 selectors used by common providers were probed. "Not found" means none of those selectors exist; the domain may still sign with a custom selector.

  • WarningThe only DKIM selector found (default) is revoked. Mail signed with it fails DKIM.

DMARC OK

v=DMARC1; p=reject; rua=mailto:a@dmarc.facebookmail.com; ruf=mailto:fb-dmarc@datafeeds.phishlabs.com; pct=100
Policy
p=reject
Applies to
100% of failing mail
Aggregate reports
mailto:a@dmarc.facebookmail.com
  • Warningdmarc.facebookmail.com has not published facebook.com._report._dmarc.dmarc.facebookmail.com, so receivers will discard aggregate reports sent there.

Mail exchange and extras

  • OK No problems detected.
MTA-STS
OK v=STSv1; id=20191202T113700;
TLS-RPT
OK v=TLSRPTv1;rua=mailto:sts-reports@facebookmail.com
BIMI
Not published optional: brand logo in inboxes, requires p=quarantine or reject

How the grade is calculated

Score 75/100. SPF present and valid. SPF ends with -all. DMARC present and valid. DMARC policy is reject. DMARC aggregate reporting enabled. SPF contributes up to 35 points, DKIM up to 25, DMARC up to 40 (policy strength and reporting). Any critical issue caps the grade at C. Lookups that failed are shown as "not measured" and never counted as missing.

Check another domain: