D35/100

office.com

Name: office.com email authentication report
Creator: MailAuthWatch
License: https://creativecommons.org/publicdomain/zero/1.0/

1 critical issue stands between this domain and the inbox. 2 items below, ordered by how much inbox they are costing you. Measured 0s ago from public DNS in 104 ms.

SPF MISSINGDKIM NOT FOUNDDMARC QUARANTINENO MX

Monitor this domain Re-run check

Fix these, in this order, or hand the list to your agent

ranked by impact

No SPF record. Receivers cannot tell who may send as this domain.

Without SPF, every message is judged on DKIM alone, and Gmail and Yahoo require at least one of the two.

Do this: office.com has no MX records. If it never sends mail, publish v=spf1 -all so receivers reject anything claiming to be from it.

No DKIM key found under 79 common selectors.

Either DKIM signing is off, or it uses a selector we did not probe. Without DKIM, forwarded mail and anything that breaks SPF fails DMARC.

Do this: turn on DKIM at your mail provider and at every third-party sender, then add the selector names when monitoring so they are verified daily. If DKIM is already on with an uncommon selector, add it to the check.

Records found

SPF · TXT

none published

DMARC · _dmarc.office.com

v=DMARC1; p=quarantine; pct=100; rua=mailto:rua@dmarc.microsoft; ruf=mailto:ruf@dmarc.microsoft; fo=1

DKIM · 0 of 79 selectors

none under common selectors

MX · None (no MX)

none

Fix this with your AI agent

AGENT-READY

A prompt built only from what was measured: the records as published, 2 tasks in order, exact record values and Azure DNS commands, guardrails, and how to verify. Paste it into Claude, Cursor, Copilot or ChatGPT.

# Fix email authentication for office.com

You are working on the DNS and mail configuration for office.com.
Measured by MailAuthWatch on 17 Oct 2026 from public DNS. Grade D (35/100).
Report: https://www.mailauthwatch.com/check/office.com

## What is published right now (do not assume anything else)
- SPF (TXT office.com): none published
- DMARC (TXT _dmarc.office.com): v=DMARC1; p=quarantine; pct=100; rua=mailto:rua@dmarc.microsoft; ruf=mailto:ruf@dmarc.microsoft; fo=1
- DKIM: no key found under 79 common selectors
- MX: none (domain does not receive mail)
- Nameservers: ns1-05.azure-dns.com, ns2-05.azure-dns.net …  → records are managed in Azure DNS

## Tasks, in order of impact
…

# Fix email authentication for office.com

You are working on the DNS and mail configuration for office.com.
Measured by MailAuthWatch on 17 Oct 2026 from public DNS. Grade D (35/100).
Report: https://www.mailauthwatch.com/check/office.com

## What is published right now (do not assume anything else)
- SPF (TXT office.com): none published
- DMARC (TXT _dmarc.office.com): v=DMARC1; p=quarantine; pct=100; rua=mailto:rua@dmarc.microsoft; ruf=mailto:ruf@dmarc.microsoft; fo=1
- DKIM: no key found under 79 common selectors
- MX: none (domain does not receive mail)
- Nameservers: ns1-05.azure-dns.com, ns2-05.azure-dns.net …  → records are managed in Azure DNS

## Tasks, in order of impact
### 1. No SPF record. Receivers cannot tell who may send as this domain.
Why: Without SPF, every message is judged on DKIM alone, and Gmail and Yahoo require at least one of the two.
Add TXT record:
  office.com  TXT  v=spf1 -all
List every service that sends mail for this domain (each provider documents its include:) before ~all.
Azure DNS CLI/API (adjust identifiers):
  az network dns record-set txt add-record -g $RESOURCE_GROUP -z office.com -n @ -v "v=spf1 -all"

### 2. No DKIM key found under 79 common selectors.
Why: Either DKIM signing is off, or it uses a selector we did not probe. Without DKIM, forwarded mail and anything that breaks SPF fails DMARC.
Turn on DKIM signing at the mail provider and at every third-party service that sends as this domain (CRM, newsletter tool, help desk).
Publish the selector records each service shows. If DKIM is already on with a selector not in the common list, add that selector to the MailAuthWatch check instead.

## Rules
- Publish exactly one SPF record; never add a second v=spf1 TXT.
- Do not remove any include: or ip4: you cannot account for; mail may depend on it.
- Do not set DMARC to p=reject in one step; stage through p=none → quarantine → reject.
- Show the planned DNS changes as a diff (record, old value, new value) before applying them.
- If you cannot access Azure DNS, stop and say exactly what access you need.

## Verify
  dig +short TXT office.com
  dig +short TXT _dmarc.office.com
Then open https://www.mailauthwatch.com/check/office.com?fresh=1 and confirm:
  SPF present and valid; DKIM found. Target grade: A.

## Report back
List each record you changed (name, type, old value, new value), what you verified, and anything you could not do.

Open in Claude Open in ChatGPT fix.md

Your agent, your DNS, your review. MailAuthWatch never changes records; it writes the plan and re-checks the result.

Grade history

Free checks keep nothing. Monitoring records every daily measurement and alerts you on change.

History goes back as far as your subscription.

SPF Missing

CriticalNo SPF record found. Receivers cannot verify which servers may send mail for this domain; Gmail and Yahoo require SPF or DKIM to pass.

DKIM Not found

DKIM selectors cannot be listed from DNS, so 79 selectors used by common providers were probed. "Not found" means none of those selectors exist; the domain may still sign with a custom selector.

WarningNo DKIM key found under 79 common selectors. If you know your selector, add it to the check; if you have no DKIM at all, enable it at your mail provider.

DMARC OK

v=DMARC1; p=quarantine; pct=100; rua=mailto:rua@dmarc.microsoft; ruf=mailto:ruf@dmarc.microsoft; fo=1

Policy: p=quarantine
Applies to: 100% of failing mail
Aggregate reports: mailto:rua@dmarc.microsoft

NotePolicy is p=quarantine. p=reject is the strongest protection once you are confident all senders are aligned.

Mail exchange and extras

NoteNo MX records: this domain does not receive mail. If it also never sends mail, publish "v=spf1 -all" and a p=reject DMARC record to stop spoofing.

MTA-STS: OK v=STSv1; id=20180321T030303;
TLS-RPT: Not published
BIMI: Not published optional: brand logo in inboxes, requires p=quarantine or reject

How the grade is calculated

Score 35/100. DMARC present and valid. DMARC policy is quarantine. DMARC aggregate reporting enabled. SPF contributes up to 35 points, DKIM up to 25, DMARC up to 40 (policy strength and reporting). Any critical issue caps the grade at C. Lookups that failed are shown as "not measured" and never counted as missing.

Check another domain:

Other recently graded domains

Public checks from the last few days. Every report is re-measured from DNS when opened.

live

DomainSPFDKIMDMARCGrade

youtube.com3 lookupsnot foundp=rejectB live.com5 lookups2048-bitp=noneB spotify.com6 lookups2048-bitp=rejectA linkedin.com2 lookups1024-bitp=rejectA google.com1 lookupsnot foundp=rejectB amazon.com4 lookups1024-bitp=quarantineA gmail.com1 lookupsnot foundp=noneC salesforce.com4 lookups2048-bitp=rejectA gandi.net2 lookupsnot foundp=noneC zoom.us6 lookups2048-bitp=rejectA skype.com2 lookupsnot foundp=rejectB shopify.com4 lookups2048-bitp=rejectA