A100/100

kayak.com

Name: kayak.com email authentication report
Creator: MailAuthWatch
License: https://creativecommons.org/publicdomain/zero/1.0/

Solid. A couple of things could still be tighter. 1 item below, ordered by how much inbox it is costing you. Measured 0s ago from public DNS in 328 ms.

SPF PASSDKIM 1024-BITDMARC REJECTMX OK

Monitor this domain Re-run check

Fix these, in this order, or hand the list to your agent

ranked by impact

5 DKIM keys are 1024-bit.

Selectors google._domainkey, k1._domainkey, s2._domainkey, mandrill._domainkey, dk._domainkey are under 2048 bits, which some receivers already downgrade.

Do this: rotate to a 2048-bit key at the sending service.

Records found

SPF · TXT

v=spf1 include:_spf.psm.knowbe4.com include:mail.zendesk.com include:_spf.presscloud.com include:helpscoutemail.com include:kayak.com._nspf.vali.email include:%{i}._ip.%{h}._ehlo.%{d}._spf.vali.email ~all

DMARC · _dmarc.kayak.com

v=DMARC1; p=reject; pct=100; adkim=r; aspf=r; rua=mailto:dmarc_agg@vali.email

DKIM · 10 of 79 selectors

google._domainkey · 1024-bit
k1._domainkey · 1024-bit
k2._domainkey · 2048-bit
k3._domainkey · 2048-bit
s1._domainkey · 2048-bit
s2._domainkey · 1024-bit
mandrill._domainkey · 1024-bit
zendesk1._domainkey · 2048-bit
zendesk2._domainkey · 2048-bit
dk._domainkey · 1024-bit

MX · Proofpoint

10 mxa-009e5101.gslb.pphosted.com
10 mxb-009e5101.gslb.pphosted.com

Fix this with your AI agent

AGENT-READY

A prompt built only from what was measured: the records as published, 1 task in order, exact record values, guardrails, and how to verify. Paste it into Claude, Cursor, Copilot or ChatGPT.

# Fix email authentication for kayak.com

You are working on the DNS and mail configuration for kayak.com.
Measured by MailAuthWatch on 17 Oct 2026 from public DNS. Grade A (100/100).
Report: https://www.mailauthwatch.com/check/kayak.com

## What is published right now (do not assume anything else)
- SPF (TXT kayak.com): v=spf1 include:_spf.psm.knowbe4.com include:mail.zendesk.com include:_spf.presscloud.com include:helpscoutemail.com include:kayak.com._nspf.vali.email include:%{i}._ip.%{h}._ehlo.%{d}._spf.vali.email ~all   — valid, 6 of 10 lookups
- DMARC (TXT _dmarc.kayak.com): v=DMARC1; p=reject; pct=100; adkim=r; aspf=r; rua=mailto:dmarc_agg@vali.email
- DKIM: google._domainkey (1024-bit), k1._domainkey (1024-bit), k2._domainkey (2048-bit), k3._domainkey (2048-bit), s1._domainkey (2048-bit), s2._domainkey (1024-bit), mandrill._domainkey (1024-bit), zendesk1._domainkey (2048-bit), zendesk2._domainkey (2048-bit), dk._domainkey (1024-bit)
- MX: mxa-009e5101.gslb.pphosted.com, mxb-009e5101.gslb.pphosted.com  → Proofpoint
- Nameservers: blue.foundationdns.com, blue.foundationdns.net …  → DNS host not recognised

## Tasks, in order of impact
…

# Fix email authentication for kayak.com

You are working on the DNS and mail configuration for kayak.com.
Measured by MailAuthWatch on 17 Oct 2026 from public DNS. Grade A (100/100).
Report: https://www.mailauthwatch.com/check/kayak.com

## What is published right now (do not assume anything else)
- SPF (TXT kayak.com): v=spf1 include:_spf.psm.knowbe4.com include:mail.zendesk.com include:_spf.presscloud.com include:helpscoutemail.com include:kayak.com._nspf.vali.email include:%{i}._ip.%{h}._ehlo.%{d}._spf.vali.email ~all   — valid, 6 of 10 lookups
- DMARC (TXT _dmarc.kayak.com): v=DMARC1; p=reject; pct=100; adkim=r; aspf=r; rua=mailto:dmarc_agg@vali.email
- DKIM: google._domainkey (1024-bit), k1._domainkey (1024-bit), k2._domainkey (2048-bit), k3._domainkey (2048-bit), s1._domainkey (2048-bit), s2._domainkey (1024-bit), mandrill._domainkey (1024-bit), zendesk1._domainkey (2048-bit), zendesk2._domainkey (2048-bit), dk._domainkey (1024-bit)
- MX: mxa-009e5101.gslb.pphosted.com, mxb-009e5101.gslb.pphosted.com  → Proofpoint
- Nameservers: blue.foundationdns.com, blue.foundationdns.net …  → DNS host not recognised

## Tasks, in order of impact
### 1. 5 DKIM keys are 1024-bit.
Why: Selectors google._domainkey, k1._domainkey, s2._domainkey, mandrill._domainkey, dk._domainkey are under 2048 bits, which some receivers already downgrade. 
Rotate to a 2048-bit key at the sending service.

## Rules
- Publish exactly one SPF record; never add a second v=spf1 TXT.
- Do not remove any include: or ip4: you cannot account for; mail may depend on it.
- Do not set DMARC to p=reject in one step; stage through p=none → quarantine → reject.
- Show the planned DNS changes as a diff (record, old value, new value) before applying them.
- If you cannot access the DNS provider or Proofpoint, stop and say exactly what access you need.

## Verify
  dig +short TXT kayak.com
  dig +short TXT _dmarc.kayak.com
Then open https://www.mailauthwatch.com/check/kayak.com?fresh=1 and confirm:
  the grade is unchanged and no new issues appear. Target grade: A.

## Report back
List each record you changed (name, type, old value, new value), what you verified, and anything you could not do.

Open in Claude Open in ChatGPT fix.md

Your agent, your DNS, your review. MailAuthWatch never changes records; it writes the plan and re-checks the result.

Grade history

Free checks keep nothing. Monitoring records every daily measurement and alerts you on change.

History goes back as far as your subscription.

SPF OK

v=spf1 include:_spf.psm.knowbe4.com include:mail.zendesk.com include:_spf.presscloud.com include:helpscoutemail.com include:kayak.com._nspf.vali.email include:%{i}._ip.%{h}._ehlo.%{d}._spf.vali.email ~all

DNS lookups: 6 of 10 allowed
Final mechanism: ~all

Noteinclude:%{i}._ip.%{h}._ehlo.%{d}._spf.vali.email uses per-message macros and is evaluated by the receiver for each message. It costs one lookup here; its own lookups depend on the sender.

Include tree

6 / 10

kayak.com0

├─ include:_spf.psm.knowbe4.com+1

├─ include:mail.zendesk.com+1

├─ include:_spf.presscloud.com+1

├─ include:helpscoutemail.com+1

├─ include:kayak.com._nspf.vali.email+1

└─ include:%{i}._ip.%{h}._ehlo.%{d}._spf.vali.email (macro, evaluated per message)+1

DKIM OK

DKIM selectors cannot be listed from DNS, so 79 selectors used by common providers were probed.

Selector	Key	Record
`google`	RSA 1024-bit Weak	`v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDWuUuD6OJIvN9lweAU6bzfFmGVBfUwd1eu…`
`k1`	RSA 1024-bit Weak	`k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDbNrX2cY/GUKIFx2G/1I00ftdAj713WP9AQ1xir85i8…`
`k2`	RSA 2048-bit OK	`v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAv2aC2KjGKLOwTweBY5A9RpjsxaBX…`
`k3`	RSA 2048-bit OK	`v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsYGiMSn7fsUqSvfSX40x9R1OlRtb…`
`s1`	RSA 2048-bit OK	`k=rsa; t=s; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqhvWtKL0MLxiwwttjKHFYD3aL+FBxxq1…`
`s2`	RSA 1024-bit Weak	`k=rsa; t=s; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDc+5hFDAs9zVKmEQZZMO1ORzx47njXAG5NPw3N…`
`mandrill`	RSA 1024-bit Weak	`v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCrLHiExVd55zd/IQ/J/mRwSRMAocV/hMB3…`
`zendesk1`	RSA 2048-bit OK	`v=DKIM1;t=s;n=core;k=rsa;p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA9IqdLrO3Zr2/56MHt8o…`
`zendesk2`	RSA 2048-bit OK	`v=DKIM1; t=s; n=core; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAmiSFNkgXrO3I8aO…`
`dk`	RSA 1024-bit Weak	`v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDhkOo8s6fh9Byz1uy69tfQ6eUnzi/5P22E…`

WarningDKIM selectors "google", "k1", "s2", "mandrill", "dk" use 1024-bit keys. Rotate to 2048 bits.

DMARC OK

v=DMARC1; p=reject; pct=100; adkim=r; aspf=r; rua=mailto:dmarc_agg@vali.email

Policy: p=reject
Applies to: 100% of failing mail
Aggregate reports: mailto:dmarc_agg@vali.email
Alignment: DKIM relaxed, SPF relaxed

OK No problems detected.

Mail exchange and extras

OK No problems detected.

MTA-STS: Not published optional: enforces TLS for inbound mail
TLS-RPT: Not published
BIMI: OK v=BIMI1; l=https://amplify.valimail.com/bimi/kayak/OQPx5pfa2nG-kayak_software_corporation_1551936114.svg; a=https://amplify.valimail.com/bimi/kayak/OQPx5pfa2nG-kayak_software_corporation_1551936114.pem

How the grade is calculated

Score 100/100. SPF present and valid. SPF ends with ~all. DKIM found (10 selectors). DKIM key is 2048-bit or stronger. DMARC present and valid. DMARC policy is reject. DMARC aggregate reporting enabled. SPF contributes up to 35 points, DKIM up to 25, DMARC up to 40 (policy strength and reporting). Any critical issue caps the grade at C. Lookups that failed are shown as "not measured" and never counted as missing.

Check another domain:

Other recently graded domains

Public checks from the last few days. Every report is re-measured from DNS when opened.

live

DomainSPFDKIMDMARCGrade

notion.so0 lookupsnot foundp=quarantineC youtube.com3 lookupsnot foundp=rejectB live.com5 lookups2048-bitp=noneB spotify.com6 lookups2048-bitp=rejectA linkedin.com2 lookups1024-bitp=rejectA google.com1 lookupsnot foundp=rejectB amazon.com4 lookups1024-bitp=quarantineA gmail.com1 lookupsnot foundp=noneC salesforce.com4 lookups2048-bitp=rejectA gandi.net2 lookupsnot foundp=noneC zoom.us6 lookups2048-bitp=rejectA skype.com2 lookupsnot foundp=rejectB