D35/100

mailship.com

Name: mailship.com email authentication report
Creator: MailAuthWatch
License: https://creativecommons.org/publicdomain/zero/1.0/

1 critical issue stands between this domain and the inbox. 2 items below, ordered by how much inbox they are costing you. Measured 1s ago from public DNS in 137 ms.

SPF PASSDKIM NOT FOUNDDMARC MISSINGMX OK

Monitor this domain Re-run check

Fix these, in this order, or hand the list to your agent

ranked by impact

No DMARC record. Nothing ties SPF and DKIM to the visible From address.

Without DMARC, a passing SPF or DKIM on some other domain is enough to reach the inbox as you, and you receive no reports about who is sending as your domain.

Do this: add a TXT record at _dmarc.mailship.com with the value v=DMARC1; p=none; rua=mailto:dmarc@mailship.com. Start at p=none to collect reports, then move to quarantine and reject.

No DKIM key found under 79 common selectors.

Either DKIM signing is off, or it uses a selector we did not probe. Without DKIM, forwarded mail and anything that breaks SPF fails DMARC.

Do this: in Microsoft 365 Defender go to Email & collaboration → Policies → DKIM, publish the two CNAME records (selector1 and selector2) and enable signing.

Records found

SPF · TXT

v=spf1 include:spf.protection.outlook.com -all

DMARC · _dmarc.mailship.com

none published

DKIM · 0 of 79 selectors

none under common selectors

MX · Microsoft 365

0 mailship-com.mail.protection.outlook.com

Fix this with your AI agent

AGENT-READY

A prompt built only from what was measured: the records as published, 2 tasks in order, exact record values and Amazon Route 53 commands, guardrails, and how to verify. Paste it into Claude, Cursor, Copilot or ChatGPT.

# Fix email authentication for mailship.com

You are working on the DNS and mail configuration for mailship.com.
Measured by MailAuthWatch on 18 Oct 2026 from public DNS. Grade D (35/100).
Report: https://www.mailauthwatch.com/check/mailship.com

## What is published right now (do not assume anything else)
- SPF (TXT mailship.com): v=spf1 include:spf.protection.outlook.com -all   — valid, 1 of 10 lookups
- DMARC (TXT _dmarc.mailship.com): none published
- DKIM: no key found under 79 common selectors
- MX: mailship-com.mail.protection.outlook.com  → Microsoft 365
- Nameservers: ns-1006.awsdns-61.net, ns-1283.awsdns-32.org …  → records are managed in Amazon Route 53

## Tasks, in order of impact
…

# Fix email authentication for mailship.com

You are working on the DNS and mail configuration for mailship.com.
Measured by MailAuthWatch on 18 Oct 2026 from public DNS. Grade D (35/100).
Report: https://www.mailauthwatch.com/check/mailship.com

## What is published right now (do not assume anything else)
- SPF (TXT mailship.com): v=spf1 include:spf.protection.outlook.com -all   — valid, 1 of 10 lookups
- DMARC (TXT _dmarc.mailship.com): none published
- DKIM: no key found under 79 common selectors
- MX: mailship-com.mail.protection.outlook.com  → Microsoft 365
- Nameservers: ns-1006.awsdns-61.net, ns-1283.awsdns-32.org …  → records are managed in Amazon Route 53

## Tasks, in order of impact
### 1. No DMARC record. Nothing ties SPF and DKIM to the visible From address.
Why: Without DMARC, a passing SPF or DKIM on some other domain is enough to reach the inbox as you, and you receive no reports about who is sending as your domain.
Add TXT record:
  _dmarc.mailship.com  TXT  v=DMARC1; p=none; rua=mailto:dmarc@mailship.com
Start at p=none to collect reports. After 2 to 4 weeks of reports showing legitimate mail aligned, move to p=quarantine, then p=reject.
Amazon Route 53 CLI/API (adjust identifiers):
  aws route53 change-resource-record-sets --hosted-zone-id $ZONE_ID --change-batch '{"Changes":[{"Action":"UPSERT","ResourceRecordSet":{"Name":"_dmarc.mailship.com.","Type":"TXT","TTL":3600,"ResourceRecords":[{"Value":"\"v=DMARC1; p=none; rua=mailto:dmarc@mailship.com\""}]}}]}'

### 2. No DKIM key found under 79 common selectors.
Why: Either DKIM signing is off, or it uses a selector we did not probe. Without DKIM, forwarded mail and anything that breaks SPF fails DMARC.
Add CNAME record:
  selector1._domainkey.mailship.com  CNAME  selector1-mailship-com._domainkey.<tenant>.onmicrosoft.com   (value comes from the provider step below)
Add CNAME record:
  selector2._domainkey.mailship.com  CNAME  selector2-mailship-com._domainkey.<tenant>.onmicrosoft.com   (value comes from the provider step below)
Microsoft 365 Defender → Email & collaboration → Policies & rules → Threat policies → DKIM → select the domain → Create DKIM keys.
Publish the two CNAME records it shows, then return and turn signing on.
Where: Route 53 console → Hosted zones → the zone → Create record.

## Rules
- Publish exactly one SPF record; never add a second v=spf1 TXT.
- Do not remove any include: or ip4: you cannot account for; mail may depend on it.
- Do not set DMARC to p=reject in one step; stage through p=none → quarantine → reject.
- Show the planned DNS changes as a diff (record, old value, new value) before applying them.
- If you cannot access Amazon Route 53 or Microsoft 365, stop and say exactly what access you need.

## Verify
  dig +short TXT _dmarc.mailship.com
  dig +short CNAME selector1._domainkey.mailship.com
  dig +short CNAME selector2._domainkey.mailship.com
  dig +short TXT mailship.com
Then open https://www.mailauthwatch.com/check/mailship.com?fresh=1 and confirm:
  DKIM found; DMARC present. Target grade: A.

## Report back
List each record you changed (name, type, old value, new value), what you verified, and anything you could not do.

Open in Claude Open in ChatGPT fix.md

Your agent, your DNS, your review. MailAuthWatch never changes records; it writes the plan and re-checks the result.

Grade history

Free checks keep nothing. Monitoring records every daily measurement and alerts you on change.

History goes back as far as your subscription.

SPF OK

v=spf1 include:spf.protection.outlook.com -all

DNS lookups: 1 of 10 allowed
Final mechanism: -all

OK No problems detected.

Include tree

1 / 10

mailship.com0

└─ include:spf.protection.outlook.com+1

DKIM Not found

DKIM selectors cannot be listed from DNS, so 79 selectors used by common providers were probed. "Not found" means none of those selectors exist; the domain may still sign with a custom selector.

WarningNo DKIM key found under 79 common selectors. If you know your selector, add it to the check; if you have no DKIM at all, enable it at your mail provider.
NoteThis zone answers every _domainkey name with a non-DKIM record (wildcard DNS); only selectors carrying a public key are counted.

DMARC Missing

CriticalNo DMARC record found. Without DMARC, SPF and DKIM results are not tied to the visible From address and spoofing is not blocked. Gmail and Yahoo require DMARC for bulk senders.

Mail exchange and extras

OK No problems detected.

MTA-STS: Not published optional: enforces TLS for inbound mail
TLS-RPT: Not published
BIMI: Not published optional: brand logo in inboxes, requires p=quarantine or reject

How the grade is calculated

Score 35/100. SPF present and valid. SPF ends with -all. SPF contributes up to 35 points, DKIM up to 25, DMARC up to 40 (policy strength and reporting). Any critical issue caps the grade at C. Lookups that failed are shown as "not measured" and never counted as missing.

Check another domain:

Other recently graded domains

Public checks from the last few days. Every report is re-measured from DNS when opened.

live

DomainSPFDKIMDMARCGrade

digicert.com3 lookups2048-bitp=quarantineA msn.com7 lookups2048-bitp=noneB icloud.com4 lookupsnot foundp=quarantineC stagewest.org4 lookups2048-bitp=noneB jlwaviation.com1 lookups2048-bitp=rejectA claude.ai0 lookupsnot foundp=rejectA github.com10 lookups2048-bitp=quarantineA gandi.net2 lookupsnot foundp=noneC salesforce.com4 lookups2048-bitp=rejectA amazon.com4 lookups1024-bitp=quarantineA stripe.com7 lookups2048-bitp=rejectA wikipedia.org1 lookupsnot foundp=rejectB