SAMPLE. Built from synthetic data to show the format. It is not about a real customer.
Subject: SAMPLE (synthetic data): example.com
Kind: email
Generated: 2026-10-14T00:00:00Z
Score: 83 / 100
1 failed, 3 warnings, 0 could not run, 20 passed.
| Check | Status | Severity | Finding | Evidence |
|---|---|---|---|---|
| BIMI-001 | fail | low | BIMI is published but DMARC is not at enforcement, so mailbox providers will not show the logo | {
"dmarc_policy": "none",
"pct": "100",
"source": "BIMI Group implementation guide"
} |
| BULK-001 | warn | medium | Bulk-sender minimums met only with DMARC p=none | {
"dkim": "ok",
"dmarc": "p=none",
"ptr": "ok",
"source": "Google sender guidelines (support.google.com/a/answer/81126); Yahoo sender best practices",
"spf": "ok"
} |
| DKIM-001 | pass | low | DKIM key found for selector selector1 | {
"found_via": "caller",
"selector": "selector1",
"source": "RFC 6376 s3.1"
} |
| DKIM-002 | pass | low | Selector selector1: 2048-bit RSA key | {
"bits": 2048,
"selector": "selector1",
"source": "RFC 8301 s3.2"
} |
| DKIM-003 | pass | low | Selector selector1 has a live key and no testing flag | {
"selector": "selector1",
"source": "RFC 6376 s3.6.1"
} |
| DMARC-001 | pass | low | One DMARC record is published | {
"found_at": "_dmarc.example.com",
"record": "v=DMARC1; p=none;",
"source": "RFC 7489 s6.6.3; RFC 9989 s4.10"
} |
| DMARC-002 | warn | medium | DMARC policy is none: monitoring only, nothing is enforced | {
"p": "none",
"source": "RFC 9989 s4.7"
} |
| DMARC-003 | pass | low | Subdomain policy is not weaker than the domain policy | {
"p": "none",
"source": "RFC 9989 s4.7"
} |
| DMARC-004 | pass | low | DMARC applies to all mail | {
"pct": null,
"source": "RFC 7489 s6.3; RFC 9989 App A.6"
} |
| DMARC-005 | warn | medium | No DMARC rua= address: no aggregate reports are sent | {
"source": "RFC 7489 s6.3"
} |
| DMARC-007 | pass | low | DMARC alignment modes are valid | {
"adkim": "r",
"aspf": "r",
"source": "RFC 7489 s6.3"
} |
| DNSSEC-001 | pass | low | The zone is DNSSEC signed and validated | {
"source": "Cloudflare DoH JSON documentation (AD flag)"
} |
| MTASTS-001 | pass | low | MTA-STS record is valid | {
"id": "20260101T000000",
"source": "RFC 8461 s3.1"
} |
| MTASTS-002 | pass | low | MTA-STS policy is in enforce mode | {
"content_type": "text/plain",
"max_age": 1209600,
"mode": "enforce",
"mx": [
"mx1.example.com",
"mx2.example.com"
],
"source": "RFC 8461 s3.2-3.3"
} |
| MTASTS-003 | pass | low | Every MX host is listed in the MTA-STS policy | {
"policy_mx": [
"mx1.example.com",
"mx2.example.com"
],
"source": "RFC 8461 s4"
} |
| MX-001 | pass | low | 2 MX hosts resolve | {
"mx": [
"mx1.example.com",
"mx2.example.com"
],
"note": "RFC 5321 s5 behaviour from memory; RFC 7505 null MX not fetched",
"source": "unsourced"
} |
| PTR-001 | pass | low | 192.0.2.20 reverse DNS mx1.example.com resolves back to it | {
"ip": "192.0.2.20",
"ptr": "mx1.example.com",
"source": "Google sender guidelines (support.google.com/a/answer/81126); Yahoo sender best practices"
} |
| SPF-001 | pass | low | One SPF record is published | {
"record": "v=spf1 include:_spf.mail.example.net ip4:192.0.2.10 ~all",
"source": "RFC 7208 s4.5"
} |
| SPF-002 | pass | low | SPF uses 1 of 10 allowed DNS lookups | {
"limit": 10,
"lookups": 1,
"source": "RFC 7208 s4.6.4"
} |
| SPF-003 | pass | low | SPF has 0 void lookups | {
"source": "RFC 7208 s4.6.4",
"voids": 0
} |
| SPF-004 | pass | low | SPF ends in ~all | {
"qualifier": "~all",
"source": "RFC 7208 s5.1, s4.7"
} |
| SPF-005 | pass | low | SPF does not use ptr | {
"source": "RFC 7208 s5.5"
} |
| SPF-006 | pass | low | SPF record is 56 characters in 1 string(s) | {
"source": "RFC 7208 s3.3",
"strings": 1,
"total_length": 56
} |
| TLSRPT-001 | pass | low | TLS-RPT record is valid | {
"rua": [
"mailto:tlsrpt@example.com"
],
"source": "RFC 8460 s3"
} |
Operational review only. It is not legal, security or compliance advice and makes no guarantee of any outcome.