MailAuthWatch
B80/100

msn.com

1 fix stands between this domain and a clean A. 1 item below, ordered by how much inbox it is costing you.

SPF PASSDKIM PASSDMARC NOT ENFORCINGMX OK
Monitor this domainRe-run checkMeasured 0s ago · 65 ms · public DNS

Fix these, in this order

ranked by impact
1
DMARC is sitting at p=none.

You are collecting reports and enforcing nothing, so anyone can still send as you. Gmail and Yahoo accept p=none from bulk senders, but it protects nobody.

Do this: move to p=quarantine; pct=25 for two weeks, watch the reports, then step to pct=100 and p=reject.

Records found

SPF · TXT
v=spf1 include:spf.protection.outlook.com include:spf-a.hotmail.com include:spf-b.hotmail.com include:spf-c.hotmail.com include:spf-d.hotmail.com include:_spf-ssg-a.microsoft.com ~all
DMARC · _dmarc.msn.com
v=DMARC1; p=none; sp=quarantine; pct=100; rua=mailto:d@rua.agari.com; fo=1
DKIM · 1 of 79 selectors
selector1._domainkey · 2048-bit
MX · Microsoft 365
2 msn-com.olc.protection.outlook.com

Grade history

Free checks keep nothing. Monitoring records every daily measurement and alerts you on change.
History goes back as far as your subscription.

SPF OK

v=spf1 include:spf.protection.outlook.com include:spf-a.hotmail.com include:spf-b.hotmail.com include:spf-c.hotmail.com include:spf-d.hotmail.com include:_spf-ssg-a.microsoft.com ~all
DNS lookups
7 of 10 allowed
Final mechanism
~all
  • Noteinclude:spf.protection.outlook.com appears more than once in the tree. Each occurrence still costs a lookup.

Include tree

7 / 10
msn.com+1 direct
├─ include:spf.protection.outlook.com+1
├─ include:spf-a.hotmail.com+1
├─ include:spf-b.hotmail.com+1
├─ include:spf-c.hotmail.com+1
├─ include:spf-d.hotmail.com+1
└─ include:_spf-ssg-a.microsoft.com+1

DKIM OK

DKIM selectors cannot be listed from DNS, so 79 selectors used by common providers were probed.

SelectorKeyRecord
selector1RSA 2048-bit OKv=DKIM1;k=rsa;p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvWyktrIL8DO/+UGvMbv7cPd/Xogpbs…
  • OK No problems detected.

DMARC OK

v=DMARC1; p=none; sp=quarantine; pct=100; rua=mailto:d@rua.agari.com; fo=1
Policy
p=none · subdomains sp=quarantine
Applies to
100% of failing mail
Aggregate reports
mailto:d@rua.agari.com
  • WarningPolicy is p=none: you receive reports but spoofed mail is still delivered. Move to p=quarantine, then p=reject, once reports show legitimate mail passing.

Mail exchange and extras

  • OK No problems detected.
MTA-STS
Not published optional: enforces TLS for inbound mail
TLS-RPT
Not published
BIMI
Not published optional: brand logo in inboxes, requires p=quarantine or reject

How the grade is calculated

Score 80/100. SPF present and valid. SPF ends with ~all. DKIM found (1 selector). DKIM key is 2048-bit or stronger. DMARC present and valid. DMARC policy is none (monitoring only). DMARC aggregate reporting enabled. SPF contributes up to 35 points, DKIM up to 25, DMARC up to 40 (policy strength and reporting). Any critical issue caps the grade at C. Lookups that failed are shown as "not measured" and never counted as missing.

Check another domain: