apollo.io email setup: SPF, DKIM, DMARC & tools

You are viewing a shared snapshot read on . It may differ from what DNS says now.

Domain

apollo.io

The three core checks pass. What is missing is the transport and trust layer around them.

6 of 8 checks pass · 4 tools visible in DNS · nothing urgent

Grade B

SPFValid, soft fail20/20

DKIM6 keys found15/15

DMARCEnforced (p=reject)30/30

MX5 hosts10/10

MTA-STSNot published0/10

TLS-RPTPublished5/5

BIMIPublished5/5

DNSSECNot signed0/5

1 · Authentication and transport

SPF

PassValid, soft fail

Anything not on the list is accepted but marked. Google recommends ~all; with DMARC enforced it is as strong as -all.

v=spf1 include:_s00978643.autospf.email ~all

DKIM

Pass6 keys found

Selectors google, s1, s2, smtp, mandrill, cf2024-1 publish a public key. 2 of them point at a vendor by CNAME.

google._domainkey, s1._domainkey, s2._domainkey, smtp._domainkey, mandrill._domainkey, cf2024-1._domainkey

DMARC

PassEnforced (p=reject)

Failing mail is rejected. This is the finish line.

v=DMARC1;p=reject;sp=reject;pct=100;rua=mailto:20c019a504@rua.easydmarc.us;ruf=mailto:20c019a504@ruf.easydmarc.us;ri=86400;aspf=r;adkim=r;fo=1;

MX

Pass5 hosts

More than one receiving server, so a single outage does not bounce mail.

10 aspmx.l.google.com
20 alt1.aspmx.l.google.com
30 alt2.aspmx.l.google.com
40 alt3.aspmx.l.google.com
50 alt4.aspmx.l.google.com

MTA-STS

ReviewNot published

Sending servers cannot tell that this domain requires TLS, so inbound mail can be downgraded to plain text by anyone on the path.

TLS-RPT

PassPublished

TLS failure reports have somewhere to go.

v=TLSRPTv1; rua=mailto:tls-report@vali.email

BIMI

PassPublished

Logo record found and DMARC qualifies. Yahoo shows it from the record; Gmail and Apple Mail also need a VMC or CMC certificate (the a= tag).

v=BIMI1; l=https://assets.apollo.io/bimi/v3.svg; a=https://assets.apollo.io/bimi/v3.pem;

DNSSEC

OptionalNot signed

Optional. Signing the zone protects every record in this report from tampering.

2 · Tools visible in DNS

Layer	Tool	Evidence
Mailbox	Google Workspace	MX aspmx.l.google.com
Marketing	Mailchimp	DKIM mandrill._domainkey
Transactional	SendGrid	DKIM s1._domainkey → s1.domainkey.u5850035.wl036.sendgrid.net
DMARC reporting	EasyDMARC	DMARC rua=mailto:…@rua.easydmarc.us

Only tools that leave a DNS trace appear. A shared DKIM selector is attributed only when its CNAME target names the vendor.

3 · Sender requirements (Google, Yahoo, Microsoft)

Requirement	Applies to	Status	Note
Authenticate with SPF or DKIM	GoogleYahooMicrosoft	Verified	At least one method is in place.
Bulk senders: both SPF and DKIM	GoogleYahoo	Verified	Both are present.
Publish a DMARC record (p=none is enough)	GoogleYahooMicrosoft	Verified	Policy is p=reject.
From: domain aligns with SPF or DKIM	GoogleYahooMicrosoft	Not checkable here	Needs a real message. The Send-a-Test report will check this.
Valid forward and reverse DNS for sending IPs	GoogleYahoo	Not checkable here	Depends on the sending server, not the domain.
Encrypt in transit (TLS)	GoogleYahoo	Not checkable here	Outbound TLS depends on your sending tool; MTA-STS would cover inbound.
One-click unsubscribe (RFC 8058) for marketing mail	GoogleYahoo	Not checkable here	A message header, not a DNS record. Microsoft recommends it rather than requiring it.
Spam complaint rate under 0.1% (0.3% is the hard limit)	GoogleYahoo	Not checkable here	Read it in Google Postmaster Tools and Yahoo Sender Hub. Google’s target is 0.1%; 0.3% is where enforcement starts.

4 · What to fix, in order

P3
Publish MTA-STS (record and policy file)

Tells sending servers to require TLS to your MX hosts, which prevents downgrade attacks. The TXT record alone does nothing: the policy file must be served over HTTPS at mta-sts.apollo.io. Start in testing mode, watch TLS-RPT, then switch to enforce.

Publish at_mta-sts.apollo.io and https://mta-sts.apollo.io/.well-known/mta-sts.txt
```
TXT  v=STSv1; id=2026100401

mta-sts.txt:
version: STSv1
mode: testing
mx: aspmx.l.google.com
mx: alt1.aspmx.l.google.com
mx: alt2.aspmx.l.google.com
mx: alt3.aspmx.l.google.com
mx: alt4.aspmx.l.google.com
max_age: 86400
```
P3

Sign the zone with DNSSEC

Protects every record in this report from being swapped in transit. Two steps: enable signing at your DNS host (one switch at Cloudflare and most others), then add the DS record it gives you at your registrar.

Publish atapollo.io

Appendix · Raw DNS answers

Name	Type	Answer
apollo.io	MX	10 aspmx.l.google.com 20 alt1.aspmx.l.google.com 30 alt2.aspmx.l.google.com 40 alt3.aspmx.l.google.com 50 alt4.aspmx.l.google.com
apollo.io	A	172.66.133.124 172.66.140.73
apollo.io	TXT	v=spf1 include:_s00978643.autospf.email ~all (+ 33 other TXT records: site-verification tokens and the like, omitted)
_dmarc.apollo.io	TXT	v=DMARC1;p=reject;sp=reject;pct=100;rua=mailto:20c019a504@rua.easydmarc.us;ruf=mailto:20c019a504@ruf.easydmarc.us;ri=86400;aspf=r;adkim=r;fo=1;
<selector>._domainkey.apollo.io	TXT	google → key published s1 → CNAME s1.domainkey.u5850035.wl036.sendgrid.net s2 → CNAME s2.domainkey.u5850035.wl036.sendgrid.net smtp → key published mandrill → key published cf2024-1 → key published
_mta-sts.apollo.io	TXT	no record
_smtp._tls.apollo.io	TXT	v=TLSRPTv1; rua=mailto:tls-report@vali.email
default._bimi.apollo.io	TXT	v=BIMI1; l=https://assets.apollo.io/bimi/v3.svg; a=https://assets.apollo.io/bimi/v3.pem;

About this report

The Email Stack reads public DNS for well-known domains and publishes the result as a report, the same one anyone can generate for any domain at /report. It is a point-in-time read: records change, and a domain that scores B today may score differently next month. The "Re-run live" button reads DNS again in your browser.

Scores weigh SPF 20, DKIM 15, DMARC 30, MX 10, MTA-STS 10, TLS-RPT 5, BIMI 5 and DNSSEC 5. Tools are named only when a DNS record names the vendor; a shared DKIM selector counts only when its CNAME target does. Message-level requirements such as alignment and one-click unsubscribe cannot be read from DNS and are marked as such, never guessed. Method: how we detect tools.

Own this domain and see something wrong? DNS is the source; fix the record and the next read will show it. Questions to hello@theemailstack.com.

apollo.ioemail setup