cloudflare.com
Authenticated end to end and enforced. Spoofed mail is rejected outright.
8 of 8 checks pass · 5 tools visible in DNS · nothing urgent
1 · Authentication and transport
SPF
PassValid, hard failAnything not on the list is rejected. The strongest setting.
v=spf1 ip4:199.15.212.0/22 ip4:173.245.48.0/20 include:_spf.google.com include:spf1.mcsv.net include:spf.mandrillapp.com include:mail.zendesk.com include:stspg-customer.com include:_spf.salesforce.com -all
DKIM
Pass3 keys foundSelectors k1, s1, mandrill publish a public key. 2 of them point at a vendor by CNAME.
k1._domainkey, s1._domainkey, mandrill._domainkey
DMARC
PassEnforced (p=reject)Failing mail is rejected. This is the finish line.
v=DMARC1; p=reject; sp=reject; adkim=r; aspf=r; pct=100; rua=mailto:a1c47f179bc04efd8ee4dcd4d85dfc65@dmarc-reports.cloudflare.net,mailto:rua@cloudflare.com
MX
Pass4 hostsMore than one receiving server, so a single outage does not bounce mail.
10 mxa-canary.global.inbound.cf-emailsecurity.net 20 mxb-canary.global.inbound.cf-emailsecurity.net 30 mxa.global.inbound.cf-emailsecurity.net 40 mxb.global.inbound.cf-emailsecurity.net
MTA-STS
PassPublishedThe DNS record is present. The policy file at https://mta-sts.<domain>/.well-known/mta-sts.txt cannot be read from a browser, so its mode is not verified here.
v=STSv1;id=1769609691387;
TLS-RPT
PassPublishedTLS failure reports have somewhere to go.
v=TLSRPTv1; rua=mailto:rua@cloudflare.com;
BIMI
PassPublishedLogo record found and DMARC qualifies. Yahoo shows it from the record; Gmail and Apple Mail also need a VMC or CMC certificate (the a= tag).
v=BIMI1; l=https://www.cloudflare.com/cloudflare_1171114652.svg; a=https://www.cloudflare.com/cloudflare_1171114652.pem
DNSSEC
PassValidatedThe resolver validated the zone, so the records above cannot be silently swapped in transit.
2 · Tools visible in DNS
| Layer | Tool | Evidence |
|---|---|---|
| Mailbox | Google Workspace | SPF include:_spf.google.com |
| Marketing | Mailchimp | DKIM k1._domainkey → dkim.mcsv.net |
| Transactional | SendGrid | DKIM s1._domainkey → s1.domainkey.u5338572.wl073.sendgrid.net |
| Support | Zendesk | SPF include:mail.zendesk.com |
| DMARC reporting | Cloudflare DMARC Management | DMARC rua=mailto:…@dmarc-reports.cloudflare.net |
Only tools that leave a DNS trace appear. A shared DKIM selector is attributed only when its CNAME target names the vendor.
3 · Sender requirements (Google, Yahoo, Microsoft)
| Requirement | Applies to | Status | Note |
|---|---|---|---|
| Authenticate with SPF or DKIM | GoogleYahooMicrosoft | Verified | At least one method is in place. |
| Bulk senders: both SPF and DKIM | GoogleYahoo | Verified | Both are present. |
| Publish a DMARC record (p=none is enough) | GoogleYahooMicrosoft | Verified | Policy is p=reject. |
| From: domain aligns with SPF or DKIM | GoogleYahooMicrosoft | Not checkable here | Needs a real message. The Send-a-Test report will check this. |
| Valid forward and reverse DNS for sending IPs | GoogleYahoo | Not checkable here | Depends on the sending server, not the domain. |
| Encrypt in transit (TLS) | GoogleYahoo | Verified | MTA-STS shows inbound TLS is required; outbound depends on your sending tool. |
| One-click unsubscribe (RFC 8058) for marketing mail | GoogleYahoo | Not checkable here | A message header, not a DNS record. Microsoft recommends it rather than requiring it. |
| Spam complaint rate under 0.1% (0.3% is the hard limit) | GoogleYahoo | Not checkable here | Read it in Google Postmaster Tools and Yahoo Sender Hub. Google’s target is 0.1%; 0.3% is where enforcement starts. |
4 · What to fix, in order
Nothing to fix. Every check in this report passes.
Appendix · Raw DNS answers
| Name | Type | Answer |
|---|---|---|
| cloudflare.com | MX | 10 mxa-canary.global.inbound.cf-emailsecurity.net 20 mxb-canary.global.inbound.cf-emailsecurity.net 30 mxa.global.inbound.cf-emailsecurity.net 40 mxb.global.inbound.cf-emailsecurity.net |
| cloudflare.com | A | 104.16.132.229 104.16.133.229 |
| cloudflare.com | TXT | v=spf1 ip4:199.15.212.0/22 ip4:173.245.48.0/20 include:_spf.google.com include:spf1.mcsv.net include:spf.mandrillapp.com include:mail.zendesk.com include:stspg-customer.com include:_spf.salesforce.com -all (+ 28 other TXT records: site-verification tokens and the like, omitted) |
| _dmarc.cloudflare.com | TXT | v=DMARC1; p=reject; sp=reject; adkim=r; aspf=r; pct=100; rua=mailto:a1c47f179bc04efd8ee4dcd4d85dfc65@dmarc-reports.cloudflare.net,mailto:rua@cloudflare.com |
| <selector>._domainkey.cloudflare.com | TXT | k1 → CNAME dkim.mcsv.net s1 → CNAME s1.domainkey.u5338572.wl073.sendgrid.net mandrill → key published |
| _mta-sts.cloudflare.com | TXT | v=STSv1;id=1769609691387; |
| _smtp._tls.cloudflare.com | TXT | v=TLSRPTv1; rua=mailto:rua@cloudflare.com; |
| default._bimi.cloudflare.com | TXT | v=BIMI1; l=https://www.cloudflare.com/cloudflare_1171114652.svg; a=https://www.cloudflare.com/cloudflare_1171114652.pem |