salesforce.com
Solid. A couple of things could still be tighter. 1 item below, ordered by how much inbox it is costing you. Measured 0s ago from public DNS in 110 ms.
Fix these, in this order, or hand the list to your agent
ranked by impactSelectors google._domainkey, s2._domainkey, mandrill._domainkey, m1._domainkey are under 2048 bits, which some receivers already downgrade.
Do this: rotate to a 2048-bit key at the sending service.
Records found
s1._domainkey · 2048-bit
s2._domainkey · 1024-bit
mandrill._domainkey · 1024-bit
m1._domainkey · 1024-bit
10 mxb-00177002.gslb.pphosted.com
Fix this with your AI agent
AGENT-READYA prompt built only from what was measured: the records as published, 1 task in order, exact record values, guardrails, and how to verify. Paste it into Claude, Cursor, Copilot or ChatGPT.
# Fix email authentication for salesforce.com
You are working on the DNS and mail configuration for salesforce.com.
Measured by MailAuthWatch on 17 Oct 2026 from public DNS. Grade A (100/100).
Report: https://www.mailauthwatch.com/check/salesforce.com
## What is published right now (do not assume anything else)
- SPF (TXT salesforce.com): v=spf1 include:_spf.google.com include:_spf.salesforce.com exists:%{i}._spf.corp.salesforce.com ~all — valid, 4 of 10 lookups
- DMARC (TXT _dmarc.salesforce.com): v=DMARC1;p=reject;fo=1:d:s;pct=100;rua=mailto:dmarc_agg@vali.email,mailto:0e5a5c34@inbox.ondmarc.com;ruf=mailto:0e5a5c34@inbox.ondmarc.com
- DKIM: google._domainkey (1024-bit), s1._domainkey (2048-bit), s2._domainkey (1024-bit), mandrill._domainkey (1024-bit), m1._domainkey (1024-bit)
- MX: mxa-00177002.gslb.pphosted.com, mxb-00177002.gslb.pphosted.com → Proofpoint
- Nameservers: pch1.salesforce-dns.com, pch2.salesforce-dns.com … → DNS host not recognised
## Tasks, in order of impact
…
Grade history
SPF OK
v=spf1 include:_spf.google.com include:_spf.salesforce.com exists:%{i}._spf.corp.salesforce.com ~all
- DNS lookups
- 4 of 10 allowed
- Final mechanism
~all
- OK No problems detected.
Include tree
4 / 10DKIM OK
DKIM selectors cannot be listed from DNS, so 79 selectors used by common providers were probed.
| Selector | Key | Record |
|---|---|---|
google | RSA 1024-bit Weak | v=DKIM1;k=rsa;p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCRCUqAlY3xk1yzKshtyKnGPy2vpTDFmMUk2d… |
s1 | RSA 2048-bit OK | k=rsa; t=s; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxxnwZc4IneYo8cRg6PRR6pl4wxaqDxBV… |
s2 | RSA 1024-bit Weak | k=rsa; t=s; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDgq4WY8wH4aXqOltolkyjnUGMTJ1T6k9YscUFO… |
mandrill | RSA 1024-bit Weak | v=DKIM1;k=rsa;p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCrLHiExVd55zd/IQ/J/mRwSRMAocV/hMB3jX… |
m1 | RSA 1024-bit Weak | k=rsa; t=s; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC4lAGz2OOmv30IcJ7OZl7RIlIfvl3QGyg7+GPi… |
- WarningDKIM selectors "google", "s2", "mandrill", "m1" use 1024-bit keys. Rotate to 2048 bits.
DMARC OK
v=DMARC1;p=reject;fo=1:d:s;pct=100;rua=mailto:dmarc_agg@vali.email,mailto:0e5a5c34@inbox.ondmarc.com;ruf=mailto:0e5a5c34@inbox.ondmarc.com
- Policy
p=reject- Applies to
- 100% of failing mail
- Aggregate reports
mailto:dmarc_agg@vali.emailmailto:0e5a5c34@inbox.ondmarc.com
- OK No problems detected.
Mail exchange and extras
- OK No problems detected.
- MTA-STS
- Not published optional: enforces TLS for inbound mail
- TLS-RPT
- Not published
- BIMI
- OK
v=BIMI1; l=https://www.salesforce.com/content/dam/web/en_us/www/images/home/bimi-salesforce-logo.svg;
How the grade is calculated
Score 100/100. SPF present and valid. SPF ends with ~all. DKIM found (5 selectors). DKIM key is 2048-bit or stronger. DMARC present and valid. DMARC policy is reject. DMARC aggregate reporting enabled. SPF contributes up to 35 points, DKIM up to 25, DMARC up to 40 (policy strength and reporting). Any critical issue caps the grade at C. Lookups that failed are shown as "not measured" and never counted as missing.
Check another domain:
Other recently graded domains
Public checks from the last few days. Every report is re-measured from DNS when opened.