msn.com
1 fix stands between this domain and a clean A. 1 item below, ordered by how much inbox it is costing you.
Fix these, in this order
ranked by impactYou are collecting reports and enforcing nothing, so anyone can still send as you. Gmail and Yahoo accept p=none from bulk senders, but it protects nobody.
Do this: move to p=quarantine; pct=25 for two weeks, watch the reports, then step to pct=100 and p=reject.
Records found
Grade history
SPF OK
v=spf1 include:spf.protection.outlook.com include:spf-a.hotmail.com include:spf-b.hotmail.com include:spf-c.hotmail.com include:spf-d.hotmail.com include:_spf-ssg-a.microsoft.com ~all
- DNS lookups
- 7 of 10 allowed
- Final mechanism
~all
- Noteinclude:spf.protection.outlook.com appears more than once in the tree. Each occurrence still costs a lookup.
Include tree
7 / 10DKIM OK
DKIM selectors cannot be listed from DNS, so 79 selectors used by common providers were probed.
| Selector | Key | Record |
|---|---|---|
selector1 | RSA 2048-bit OK | v=DKIM1;k=rsa;p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvWyktrIL8DO/+UGvMbv7cPd/Xogpbs… |
- OK No problems detected.
DMARC OK
v=DMARC1; p=none; sp=quarantine; pct=100; rua=mailto:d@rua.agari.com; fo=1
- Policy
p=none· subdomainssp=quarantine- Applies to
- 100% of failing mail
- Aggregate reports
mailto:d@rua.agari.com
- WarningPolicy is p=none: you receive reports but spoofed mail is still delivered. Move to p=quarantine, then p=reject, once reports show legitimate mail passing.
Mail exchange and extras
- OK No problems detected.
- MTA-STS
- Not published optional: enforces TLS for inbound mail
- TLS-RPT
- Not published
- BIMI
- Not published optional: brand logo in inboxes, requires p=quarantine or reject
How the grade is calculated
Score 80/100. SPF present and valid. SPF ends with ~all. DKIM found (1 selector). DKIM key is 2048-bit or stronger. DMARC present and valid. DMARC policy is none (monitoring only). DMARC aggregate reporting enabled. SPF contributes up to 35 points, DKIM up to 25, DMARC up to 40 (policy strength and reporting). Any critical issue caps the grade at C. Lookups that failed are shown as "not measured" and never counted as missing.
Check another domain:
Other recently graded domains
Public checks from the last few days. Every report is re-measured from DNS when opened.