asana.com
The three core checks pass. What is missing is the transport and trust layer around them.
7 of 8 checks pass · 5 tools visible in DNS · nothing urgent
1 · Authentication and transport
SPF
PassValid, hard failAnything not on the list is rejected. The strongest setting.
v=spf1 include:_spf.google.com include:amazonses.com exists:%{i}._spf.sparkpostmail.com include:mktomail.com include:mg-spf.greenhouse.io include:mail.zendesk.com -all
DKIM
Pass2 keys foundSelectors google, smtp publish a public key.
google._domainkey, smtp._domainkey
DMARC
PassPartial (p=quarantine)Failing mail goes to spam. One step from full enforcement.
v=DMARC1; p=quarantine; rua=mailto:7ddf7bedf2@rua.easydmarc.us,mailto:dmarc_agg@dmarc.everest.email; ruf=mailto:7ddf7bedf2@ruf.easydmarc.us,mailto:dmarc-ruf@asana.com; fo=1; sp=quarantine;
MX
Pass5 hostsMore than one receiving server, so a single outage does not bounce mail.
10 aspmx.l.google.com 20 alt1.aspmx.l.google.com 30 alt2.aspmx.l.google.com 40 aspmx2.googlemail.com 50 aspmx3.googlemail.com
MTA-STS
PassPublishedThe DNS record is present. The policy file at https://mta-sts.<domain>/.well-known/mta-sts.txt cannot be read from a browser, so its mode is not verified here.
v=STSv1;id=20251008T001826
TLS-RPT
PassPublishedTLS failure reports have somewhere to go.
v=TLSRPTv1; rua=mailto:dmarcreports@asana.com
BIMI
PassPublishedLogo record found and DMARC qualifies. Yahoo shows it from the record; Gmail and Apple Mail also need a VMC or CMC certificate (the a= tag).
v=BIMI1;l=https://vmc.digicert.com/a026a7f7-edfa-427b-ae54-f89d7534b056.svg;a=https://vmc.digicert.com/a026a7f7-edfa-427b-ae54-f89d7534b056.pem
DNSSEC
OptionalNot signedOptional. Signing the zone protects every record in this report from tampering.
2 · Tools visible in DNS
| Layer | Tool | Evidence |
|---|---|---|
| Mailbox | Google Workspace | MX aspmx.l.google.com |
| Marketing | Marketo | SPF include:mktomail.com |
| Transactional | Amazon SES | SPF include:amazonses.com |
| Support | Zendesk | SPF include:mail.zendesk.com |
| DMARC reporting | EasyDMARC | DMARC rua=mailto:…@rua.easydmarc.us |
Only tools that leave a DNS trace appear. A shared DKIM selector is attributed only when its CNAME target names the vendor.
3 · Sender requirements (Google, Yahoo, Microsoft)
| Requirement | Applies to | Status | Note |
|---|---|---|---|
| Authenticate with SPF or DKIM | GoogleYahooMicrosoft | Verified | At least one method is in place. |
| Bulk senders: both SPF and DKIM | GoogleYahoo | Verified | Both are present. |
| Publish a DMARC record (p=none is enough) | GoogleYahooMicrosoft | Verified | Policy is p=quarantine. |
| From: domain aligns with SPF or DKIM | GoogleYahooMicrosoft | Not checkable here | Needs a real message. The Send-a-Test report will check this. |
| Valid forward and reverse DNS for sending IPs | GoogleYahoo | Not checkable here | Depends on the sending server, not the domain. |
| Encrypt in transit (TLS) | GoogleYahoo | Verified | MTA-STS shows inbound TLS is required; outbound depends on your sending tool. |
| One-click unsubscribe (RFC 8058) for marketing mail | GoogleYahoo | Not checkable here | A message header, not a DNS record. Microsoft recommends it rather than requiring it. |
| Spam complaint rate under 0.1% (0.3% is the hard limit) | GoogleYahoo | Not checkable here | Read it in Google Postmaster Tools and Yahoo Sender Hub. Google’s target is 0.1%; 0.3% is where enforcement starts. |
4 · What to fix, in order
-
P2
Finish DMARC at p=reject
Quarantine still delivers spoofed mail, just into spam.
Publish at_dmarc.asana.comv=DMARC1; p=reject; rua=mailto:dmarc@asana.com; fo=1
-
P3
Sign the zone with DNSSEC
Protects every record in this report from being swapped in transit. Two steps: enable signing at your DNS host (one switch at Cloudflare and most others), then add the DS record it gives you at your registrar.
Publish atasana.com
Appendix · Raw DNS answers
| Name | Type | Answer |
|---|---|---|
| asana.com | MX | 10 aspmx.l.google.com 20 alt1.aspmx.l.google.com 30 alt2.aspmx.l.google.com 40 aspmx2.googlemail.com 50 aspmx3.googlemail.com |
| asana.com | A | 15.197.167.90 3.33.186.135 |
| asana.com | TXT | v=spf1 include:_spf.google.com include:amazonses.com exists:%{i}._spf.sparkpostmail.com include:mktomail.com include:mg-spf.greenhouse.io include:mail.zendesk.com -all (+ 42 other TXT records: site-verification tokens and the like, omitted) |
| _dmarc.asana.com | TXT | v=DMARC1; p=quarantine; rua=mailto:7ddf7bedf2@rua.easydmarc.us,mailto:dmarc_agg@dmarc.everest.email; ruf=mailto:7ddf7bedf2@ruf.easydmarc.us,mailto:dmarc-ruf@asana.com; fo=1; sp=quarantine; |
| <selector>._domainkey.asana.com | TXT | google → key published smtp → key published |
| _mta-sts.asana.com | TXT | v=STSv1;id=20251008T001826 |
| _smtp._tls.asana.com | TXT | v=TLSRPTv1; rua=mailto:dmarcreports@asana.com |
| default._bimi.asana.com | TXT | v=BIMI1;l=https://vmc.digicert.com/a026a7f7-edfa-427b-ae54-f89d7534b056.svg;a=https://vmc.digicert.com/a026a7f7-edfa-427b-ae54-f89d7534b056.pem |