A95/100
uber.com
Solid. A couple of things could still be tighter. 1 item below, ordered by how much inbox it is costing you.
Fix these, in this order
ranked by impact1
7 DKIM keys are 1024-bit.
Selectors google._domainkey, k1._domainkey, s2._domainkey, smtp._domainkey, mandrill._domainkey, m1._domainkey, smtpapi._domainkey are under 2048 bits, which some receivers already downgrade.
Do this: rotate to a 2048-bit key at the sending service.
Records found
SPF · TXT
v=spf1 include:uber.com._nspf.vali.email include:%{i}._ip.%{h}._ehlo.%{d}._spf.vali.email include:mailgun.org ~all
DMARC · _dmarc.uber.com
v=DMARC1; p=quarantine; rua=mailto:dmarc_agg@vali.email
DKIM · 16 of 79 selectors
google._domainkey · 1024-bit
k1._domainkey · 1024-bit
k2._domainkey · 2048-bit
k3._domainkey · 2048-bit
s1._domainkey · 2048-bit
s2._domainkey · 1024-bit
smtp._domainkey · 1024-bit
mandrill._domainkey · 1024-bit
hs1._domainkey · 2048-bit
hs2._domainkey · 2048-bit
zendesk1._domainkey · 2048-bit
zendesk2._domainkey · 2048-bit
mte1._domainkey · 2048-bit
mte2._domainkey · 2048-bit
m1._domainkey · 1024-bit
smtpapi._domainkey · 1024-bit
k1._domainkey · 1024-bit
k2._domainkey · 2048-bit
k3._domainkey · 2048-bit
s1._domainkey · 2048-bit
s2._domainkey · 1024-bit
smtp._domainkey · 1024-bit
mandrill._domainkey · 1024-bit
hs1._domainkey · 2048-bit
hs2._domainkey · 2048-bit
zendesk1._domainkey · 2048-bit
zendesk2._domainkey · 2048-bit
mte1._domainkey · 2048-bit
mte2._domainkey · 2048-bit
m1._domainkey · 1024-bit
smtpapi._domainkey · 1024-bit
MX · Google Workspace
2 aspmx.l.google.com
5 alt1.aspmx.l.google.com
5 alt2.aspmx.l.google.com
10 alt3.aspmx.l.google.com
10 alt4.aspmx.l.google.com
5 alt1.aspmx.l.google.com
5 alt2.aspmx.l.google.com
10 alt3.aspmx.l.google.com
10 alt4.aspmx.l.google.com
Grade history
Free checks keep nothing. Monitoring records every daily measurement and alerts you on change.
History goes back as far as your subscription.
SPF OK
v=spf1 include:uber.com._nspf.vali.email include:%{i}._ip.%{h}._ehlo.%{d}._spf.vali.email include:mailgun.org ~all
- DNS lookups
- 7 of 10 allowed
- Final mechanism
~all
- Noteinclude:%{i}._ip.%{h}._ehlo.%{d}._spf.vali.email uses per-message macros and is evaluated by the receiver for each message. It costs one lookup here; its own lookups depend on the sender.
Include tree
7 / 10uber.com0
├─ include:mailgun.org+5
│ ├─ _spf.mailgun.org
│ ├─ _spf1.mailgun.org
│ ├─ _spf2.mailgun.org
│ └─ _spf.eu.mailgun.org
├─ include:uber.com._nspf.vali.email+1
└─ include:%{i}._ip.%{h}._ehlo.%{d}._spf.vali.email (macro, evaluated per message)+1
DKIM OK
DKIM selectors cannot be listed from DNS, so 79 selectors used by common providers were probed.
| Selector | Key | Record |
|---|---|---|
google | RSA 1024-bit Weak | v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQD47RWlgqkIHUpMVRDcEDEtf0N2Oy4NieUM… |
k1 | RSA 1024-bit Weak | k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDbNrX2cY/GUKIFx2G/1I00ftdAj713WP9AQ1xir85i8… |
k2 | RSA 2048-bit OK | v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAv2aC2KjGKLOwTweBY5A9RpjsxaBX… |
k3 | RSA 2048-bit OK | v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsYGiMSn7fsUqSvfSX40x9R1OlRtb… |
s1 | RSA 2048-bit OK | k=rsa; t=s; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0KT35wXA5Y8j6fCSI8OE3PD0+LXZFhAt… |
s2 | RSA 1024-bit Weak | k=rsa; t=s; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDUQL+rhtHS8mbLM55T5AN4cWu4HqQ2ciW1V2aR… |
smtp | RSA 1024-bit Weak | v=DKIM1; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCuzjFDdKs0YCQtdtXlRYuTvt/KX5inZRZIX6FE9a5… |
mandrill | RSA 1024-bit Weak | v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCrLHiExVd55zd/IQ/J/mRwSRMAocV/hMB3… |
hs1 | RSA 2048-bit OK | k=rsa;t=s;p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuW4ThOa+rKrEnprhGhj6Yw/zvOaOyuZ8oN… |
hs2 | RSA 2048-bit OK | k=rsa;t=s;p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAonGyezTigDNdHS1v/JxmwgW1fTZjOfl8bO… |
zendesk1 | RSA 2048-bit OK | v=DKIM1;t=s;n=core;k=rsa;p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA9IqdLrO3Zr2/56MHt8o… |
zendesk2 | RSA 2048-bit OK | v=DKIM1; t=s; n=core; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAmiSFNkgXrO3I8aO… |
mte1 | RSA 2048-bit OK | v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA2GGE1A9cwHjf5KYMV0GdrKcEhCVg… |
mte2 | RSA 2048-bit OK | v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAt7NkXm8fhrVVfUvX7UQBHmn8nlT1… |
m1 | RSA 1024-bit Weak | v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDyBopOXKL/mCf7YP48O/4EbVZJJyVl0rjX… |
smtpapi | RSA 1024-bit Weak | v=DKIM1; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDPtW5iwpXVPiH5FzJ7Nrl8USzuY9zqqzjE0D1r04x… |
- WarningDKIM selectors "google", "k1", "s2", "smtp", "mandrill", "m1", "smtpapi" use 1024-bit keys. Rotate to 2048 bits.
DMARC OK
v=DMARC1; p=quarantine; rua=mailto:dmarc_agg@vali.email
- Policy
p=quarantine- Applies to
- 100% of failing mail
- Aggregate reports
mailto:dmarc_agg@vali.email
- NotePolicy is p=quarantine. p=reject is the strongest protection once you are confident all senders are aligned.
Mail exchange and extras
- OK No problems detected.
- MTA-STS
- Not published optional: enforces TLS for inbound mail
- TLS-RPT
- Not published
- BIMI
- OK
v=BIMI1; l=https://amplify.valimail.com/bimi/uber/WSc5-ZpWcvs-uber_tinyps_v4.svg; a=
How the grade is calculated
Score 95/100. SPF present and valid. SPF ends with ~all. DKIM found (16 selectors). DKIM key is 2048-bit or stronger. DMARC present and valid. DMARC policy is quarantine. DMARC aggregate reporting enabled. SPF contributes up to 35 points, DKIM up to 25, DMARC up to 40 (policy strength and reporting). Any critical issue caps the grade at C. Lookups that failed are shown as "not measured" and never counted as missing.
Check another domain:
Other recently graded domains
Public checks from the last few days. Every report is re-measured from DNS when opened.