deel.com email setup: SPF, DKIM, DMARC & tools

You are viewing a shared snapshot read on . It may differ from what DNS says now.

Domain

deel.com

Authenticated end to end and enforced. Spoofed mail is rejected outright.

7 of 8 checks pass · 6 tools visible in DNS · nothing urgent

Grade A

SPFValid, soft fail20/20

DKIM4 keys found15/15

DMARCEnforced (p=reject)30/30

MX5 hosts10/10

MTA-STSPublished10/10

TLS-RPTPublished5/5

BIMINot published0/5

DNSSECValidated5/5

1 · Authentication and transport

SPF

PassValid, soft fail

Anything not on the list is accepted but marked. Google recommends ~all; with DMARC enforced it is as strong as -all.

v=spf1 include:docebosaas.com include:_spf.google.com include:_spf.salesforce.com include:mail.zendesk.com include:spf.brevo.com include:spfa.cpmails.com include:amazonses.com include:19498232.spf04.hubspotemail.net ~all

8 DNS-lookup mechanisms — close to the limit of 10.

DKIM

Pass4 keys found

Selectors google, s1, s2, mail publish a public key. 2 of them point at a vendor by CNAME.

google._domainkey, s1._domainkey, s2._domainkey, mail._domainkey

DMARC

PassEnforced (p=reject)

Failing mail is rejected. This is the finish line.

v=DMARC1; p=reject; pct=100; rua=mailto:dmarc@deel.com,mailto:deel@eu.cp-dmarc.com,mailto:no-reply-dgp@deel.com

MX

Pass5 hosts

More than one receiving server, so a single outage does not bounce mail.

10 aspmx.l.google.com
20 alt1.aspmx.l.google.com
30 alt2.aspmx.l.google.com
40 alt3.aspmx.l.google.com
50 alt4.aspmx.l.google.com

MTA-STS

PassPublished

The DNS record is present. The policy file at https://mta-sts.<domain>/.well-known/mta-sts.txt cannot be read from a browser, so its mode is not verified here.

v=STSv1;id=1759146246489;

TLS-RPT

PassPublished

TLS failure reports have somewhere to go.

v=TLSRPTv1;rua=mta-sts-policy@deel.com

BIMI

OptionalNot published

DMARC is enforced, so this domain qualifies. Yahoo and Fastmail show the logo from the record alone; Gmail and Apple Mail also need a paid VMC or CMC certificate.

DNSSEC

PassValidated

The resolver validated the zone, so the records above cannot be silently swapped in transit.

2 · Tools visible in DNS

Layer	Tool	Evidence
Mailbox	Google Workspace	MX aspmx.l.google.com
Marketing	HubSpot	SPF include:19498232.spf04.hubspotemail.net
Marketing	Brevo	SPF include:spf.brevo.com
Transactional	Amazon SES	SPF include:amazonses.com
Transactional	SendGrid	DKIM s1._domainkey → s1.domainkey.u55861234.wl235.sendgrid.net
Support	Zendesk	SPF include:mail.zendesk.com

Only tools that leave a DNS trace appear. A shared DKIM selector is attributed only when its CNAME target names the vendor.

3 · Sender requirements (Google, Yahoo, Microsoft)

Requirement	Applies to	Status	Note
Authenticate with SPF or DKIM	GoogleYahooMicrosoft	Verified	At least one method is in place.
Bulk senders: both SPF and DKIM	GoogleYahoo	Verified	Both are present.
Publish a DMARC record (p=none is enough)	GoogleYahooMicrosoft	Verified	Policy is p=reject.
From: domain aligns with SPF or DKIM	GoogleYahooMicrosoft	Not checkable here	Needs a real message. The Send-a-Test report will check this.
Valid forward and reverse DNS for sending IPs	GoogleYahoo	Not checkable here	Depends on the sending server, not the domain.
Encrypt in transit (TLS)	GoogleYahoo	Verified	MTA-STS shows inbound TLS is required; outbound depends on your sending tool.
One-click unsubscribe (RFC 8058) for marketing mail	GoogleYahoo	Not checkable here	A message header, not a DNS record. Microsoft recommends it rather than requiring it.
Spam complaint rate under 0.1% (0.3% is the hard limit)	GoogleYahoo	Not checkable here	Read it in Google Postmaster Tools and Yahoo Sender Hub. Google’s target is 0.1%; 0.3% is where enforcement starts.

4 · What to fix, in order

P3
Add a BIMI logo record (optional)

DMARC already qualifies. The logo must be SVG Tiny PS, square, served over HTTPS. Yahoo and Fastmail show it from the record alone; Gmail and Apple Mail also need a paid VMC or CMC certificate, and a VMC needs a registered trademark. Skip this unless the certificate is worth it to you.

Publish atdefault._bimi.deel.com
```
v=BIMI1; l=https://deel.com/.well-known/bimi.svg;
```

Appendix · Raw DNS answers

Name	Type	Answer
deel.com	MX	10 aspmx.l.google.com 20 alt1.aspmx.l.google.com 30 alt2.aspmx.l.google.com 40 alt3.aspmx.l.google.com 50 alt4.aspmx.l.google.com
deel.com	A	18.155.49.20 18.155.49.47 18.155.49.49 18.155.49.103
deel.com	TXT	v=spf1 include:docebosaas.com include:_spf.google.com include:_spf.salesforce.com include:mail.zendesk.com include:spf.brevo.com include:spfa.cpmails.com include:amazonses.com include:19498232.spf04.hubspotemail.net ~all (+ 33 other TXT records: site-verification tokens and the like, omitted)
_dmarc.deel.com	TXT	v=DMARC1; p=reject; pct=100; rua=mailto:dmarc@deel.com,mailto:deel@eu.cp-dmarc.com,mailto:no-reply-dgp@deel.com
<selector>._domainkey.deel.com	TXT	google → key published s1 → CNAME s1.domainkey.u55861234.wl235.sendgrid.net s2 → CNAME s2.domainkey.u55861234.wl235.sendgrid.net mail → key published
_mta-sts.deel.com	TXT	v=STSv1;id=1759146246489;
_smtp._tls.deel.com	TXT	v=TLSRPTv1;rua=mta-sts-policy@deel.com
default._bimi.deel.com	TXT	no record

About this report

The Email Stack reads public DNS for well-known domains and publishes the result as a report, the same one anyone can generate for any domain at /report. It is a point-in-time read: records change, and a domain that scores A today may score differently next month. The "Re-run live" button reads DNS again in your browser.

Scores weigh SPF 20, DKIM 15, DMARC 30, MX 10, MTA-STS 10, TLS-RPT 5, BIMI 5 and DNSSEC 5. Tools are named only when a DNS record names the vendor; a shared DKIM selector counts only when its CNAME target does. Message-level requirements such as alignment and one-click unsubscribe cannot be read from DNS and are marked as such, never guessed. Method: how we detect tools.

Own this domain and see something wrong? DNS is the source; fix the record and the next read will show it. Questions to hello@theemailstack.com.

deel.comemail setup