B80/100

stagewest.org

Name: stagewest.org email authentication report
Creator: MailAuthWatch
License: https://creativecommons.org/publicdomain/zero/1.0/

2 fixes stand between this domain and a clean A. 2 items below, ordered by how much inbox they are costing you. Measured 0s ago from public DNS in 216 ms.

SPF PASSDKIM 1024-BITDMARC NOT ENFORCINGMX OK

Monitor this domain Re-run check

Fix these, in this order, or hand the list to your agent

ranked by impact

DMARC is sitting at p=none.

You are collecting reports and enforcing nothing, so anyone can still send as you. Gmail and Yahoo accept p=none from bulk senders, but it protects nobody.

Do this: move to p=quarantine; pct=25 for two weeks, watch the reports, then step to pct=100 and p=reject.

One DKIM key is 1024-bit.

Selector litesrv._domainkey is under 2048 bits, which some receivers already downgrade.

Do this: rotate to a 2048-bit key at the sending service.

Records found

SPF · TXT

v=spf1 a mx include:_spf.mlsend.com include:_spf.google.com ~all

DMARC · _dmarc.stagewest.org

v=DMARC1; p=none; fo=1; rua=mailto:dmarc@stagewest.org; sp=none;

DKIM · 2 of 79 selectors

google._domainkey · 2048-bit
litesrv._domainkey · 1024-bit

MX · Google Workspace

1 aspmx.l.google.com
5 alt1.aspmx.l.google.com
5 alt2.aspmx.l.google.com
10 alt4.aspmx.l.google.com
10 alt3.aspmx.l.google.com

Fix this with your AI agent

AGENT-READY

A prompt built only from what was measured: the records as published, 2 tasks in order, exact record values and Squarespace Domains commands, guardrails, and how to verify. Paste it into Claude, Cursor, Copilot or ChatGPT.

# Fix email authentication for stagewest.org

You are working on the DNS and mail configuration for stagewest.org.
Measured by MailAuthWatch on 18 Oct 2026 from public DNS. Grade B (80/100).
Report: https://www.mailauthwatch.com/check/stagewest.org

## What is published right now (do not assume anything else)
- SPF (TXT stagewest.org): v=spf1 a mx include:_spf.mlsend.com include:_spf.google.com ~all   — valid, 4 of 10 lookups
- DMARC (TXT _dmarc.stagewest.org): v=DMARC1; p=none; fo=1; rua=mailto:dmarc@stagewest.org; sp=none;
- DKIM: google._domainkey (2048-bit), litesrv._domainkey (1024-bit)
- MX: aspmx.l.google.com, alt1.aspmx.l.google.com, alt2.aspmx.l.google.com, alt4.aspmx.l.google.com, alt3.aspmx.l.google.com  → Google Workspace
- Nameservers: dns4.p04.nsone.net, dns3.p04.nsone.net …  → records are managed in Squarespace Domains

## Tasks, in order of impact
…

# Fix email authentication for stagewest.org

You are working on the DNS and mail configuration for stagewest.org.
Measured by MailAuthWatch on 18 Oct 2026 from public DNS. Grade B (80/100).
Report: https://www.mailauthwatch.com/check/stagewest.org

## What is published right now (do not assume anything else)
- SPF (TXT stagewest.org): v=spf1 a mx include:_spf.mlsend.com include:_spf.google.com ~all   — valid, 4 of 10 lookups
- DMARC (TXT _dmarc.stagewest.org): v=DMARC1; p=none; fo=1; rua=mailto:dmarc@stagewest.org; sp=none;
- DKIM: google._domainkey (2048-bit), litesrv._domainkey (1024-bit)
- MX: aspmx.l.google.com, alt1.aspmx.l.google.com, alt2.aspmx.l.google.com, alt4.aspmx.l.google.com, alt3.aspmx.l.google.com  → Google Workspace
- Nameservers: dns4.p04.nsone.net, dns3.p04.nsone.net …  → records are managed in Squarespace Domains

## Tasks, in order of impact
### 1. DMARC is sitting at p=none.
Why: You are collecting reports and enforcing nothing, so anyone can still send as you. Gmail and Yahoo accept p=none from bulk senders, but it protects nobody.
Replace TXT record:
  _dmarc.stagewest.org  TXT  v=DMARC1; p=quarantine; pct=25; fo=1; rua=mailto:dmarc@stagewest.org; sp=none;
Only after DKIM is verified working (see the DKIM task if present). Hold for 14 days, review reports, then pct=100, then p=reject.
Where: Squarespace → Domains → DNS settings.

### 2. One DKIM key is 1024-bit.
Why: Selector litesrv._domainkey is under 2048 bits, which some receivers already downgrade. 
Rotate to a 2048-bit key at the sending service.

## Rules
- Publish exactly one SPF record; never add a second v=spf1 TXT.
- Do not remove any include: or ip4: you cannot account for; mail may depend on it.
- Do not set DMARC to p=reject in one step; stage through p=none → quarantine → reject.
- Show the planned DNS changes as a diff (record, old value, new value) before applying them.
- If you cannot access Squarespace Domains or Google Workspace, stop and say exactly what access you need.

## Verify
  dig +short TXT _dmarc.stagewest.org
  dig +short TXT stagewest.org
Then open https://www.mailauthwatch.com/check/stagewest.org?fresh=1 and confirm:
  DMARC p=quarantine. Target grade: A.

## Report back
List each record you changed (name, type, old value, new value), what you verified, and anything you could not do.

Open in Claude Open in ChatGPT fix.md

Your agent, your DNS, your review. MailAuthWatch never changes records; it writes the plan and re-checks the result.

Grade history

Free checks keep nothing. Monitoring records every daily measurement and alerts you on change.

History goes back as far as your subscription.

SPF OK

v=spf1 a mx include:_spf.mlsend.com include:_spf.google.com ~all

DNS lookups: 4 of 10 allowed
Final mechanism: ~all

OK No problems detected.

Include tree

4 / 10

stagewest.org+2 direct

├─ include:_spf.mlsend.com+1

└─ include:_spf.google.com+1

DKIM OK

DKIM selectors cannot be listed from DNS, so 79 selectors used by common providers were probed.

Selector	Key	Record
`google`	RSA 2048-bit OK	`v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAibV/iAtAyKjpSOqZMoZkAYEcBWz5…`
`litesrv`	RSA 1024-bit Weak	`v=DKIM1;p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC6SIHVq/vJmsR3R3saPiVGNPfMZ1Qv9otreQKGFLXP…`

WarningDKIM selector "litesrv" uses a 1024-bit key. Rotate to 2048 bits.

DMARC OK

v=DMARC1; p=none; fo=1; rua=mailto:dmarc@stagewest.org; sp=none;

Policy: p=none · subdomains sp=none
Applies to: 100% of failing mail
Aggregate reports: mailto:dmarc@stagewest.org

WarningPolicy is p=none: you receive reports but spoofed mail is still delivered. Move to p=quarantine, then p=reject, once reports show legitimate mail passing.

Mail exchange and extras

OK No problems detected.

MTA-STS: Not published optional: enforces TLS for inbound mail
TLS-RPT: Not published
BIMI: Not published optional: brand logo in inboxes, requires p=quarantine or reject

How the grade is calculated

Score 80/100. SPF present and valid. SPF ends with ~all. DKIM found (2 selectors). DKIM key is 2048-bit or stronger. DMARC present and valid. DMARC policy is none (monitoring only). DMARC aggregate reporting enabled. SPF contributes up to 35 points, DKIM up to 25, DMARC up to 40 (policy strength and reporting). Any critical issue caps the grade at C. Lookups that failed are shown as "not measured" and never counted as missing.

Check another domain:

Other recently graded domains

Public checks from the last few days. Every report is re-measured from DNS when opened.

live

DomainSPFDKIMDMARCGrade

bing.com1 lookupsnot foundp=rejectB mailship.com1 lookupsnot foundmissingD icloud.com4 lookupsnot foundp=quarantineC mail.ru1 lookups1024-bitp=rejectA digicert.com3 lookups2048-bitp=quarantineA msn.com7 lookups2048-bitp=noneB jlwaviation.com1 lookups2048-bitp=rejectA claude.ai0 lookupsnot foundp=rejectA github.com10 lookups2048-bitp=quarantineA gandi.net2 lookupsnot foundp=noneC salesforce.com4 lookups2048-bitp=rejectA amazon.com4 lookups1024-bitp=quarantineA