Error reference

Every problem the checker can report, with what causes it, what it actually breaks, and the steps to fix it. These are the same explanations the product itself shows.

• BIMI record published without DMARC enforcement

  BIMI requires a DMARC policy of quarantine or reject. The record will be ignored.

  Policy · usually medium

  Medium

• No DKIM key found at the selectors we checked

  We probed the selectors used by common providers and found no DKIM record.

  Authentication · usually medium

  Medium

• DKIM record is malformed

  The record at this selector is not a valid DKIM key record.

  Authentication · usually high

  High

• DKIM key is shorter than 1024 bits

  The RSA key is too short to be considered secure and some receivers reject it.

  Authentication · usually high

  High

• External reporting address is not authorised

  Reports are directed to another domain that has not published the required authorisation record.

  Policy · usually medium

  Medium

• DMARC record requests no aggregate reports

  There is no rua address, so you receive no data about who sends as your domain.

  Policy · usually medium

  Medium

• DMARC policy is set to none

  The policy monitors but does not act — failing mail is still delivered.

  Policy · usually medium

  Medium

• No DMARC record found

  There is no DMARC policy at _dmarc for this domain.

  Authentication · usually high

  High

• Subdomain policy is weaker than the domain policy

  sp= is set to a laxer value than p=, leaving subdomains less protected.

  Policy · usually medium

  Medium

• DMARC record contains a syntax error

  A tag in the DMARC record is malformed, which can invalidate the whole policy.

  Authentication · usually high

  High

• No email configuration of any kind was found

  No MX, SPF or DMARC records exist for this domain.

  Infrastructure · usually medium

  Medium

• MTA-STS is not configured

  The domain does not publish an MTA-STS policy. This is optional but worth having.

  Infrastructure · usually info

  Info

• MTA-STS record published but the policy file is unreachable

  The DNS record announces a policy that cannot be fetched.

  Infrastructure · usually medium

  Medium

• More than one DMARC record published

  Multiple DMARC records exist at _dmarc, so receivers ignore the policy entirely.

  Authentication · usually high

  High

• More than one SPF record published

  Two or more SPF records exist. Receivers treat this as a permanent error and SPF fails outright.

  Authentication · usually critical

  Critical

• An MX host does not resolve to an address

  A mail exchanger is published but its hostname has no A or AAAA record.

  Infrastructure · usually high

  High

• An MX record points at an alias

  MX targets must be hostnames with address records, not CNAMEs.

  Infrastructure · usually medium

  Medium

• No MX records found

  This domain publishes no mail exchangers, so it cannot receive email.

  Infrastructure · usually critical

  Critical

• Non-sending domain is not protected against forgery

  This domain appears not to send mail, but publishes no policy preventing others from doing so.

  Policy · usually medium

  Medium

• SPF record has mechanisms after the all term

  Terms placed after all are never evaluated.

  Authentication · usually medium

  Medium

• SPF record ends with ?all

  The record explicitly takes no position on unlisted senders.

  Policy · usually medium

  Medium

• SPF record ends with +all

  The record authorises the entire internet to send mail as this domain.

  Policy · usually critical

  Critical

• No SPF record found

  This domain publishes no SPF record, so receivers have no list of authorised senders.

  Authentication · usually high

  High

• SPF record contains a syntax error

  Part of the record is not valid SPF, so receivers may reject the whole record.

  Authentication · usually high

  High

• SPF record exceeds the 10 DNS lookup limit

  Evaluating this SPF record needs more than the 10 DNS lookups the specification permits.

  Authentication · usually high

  High