The Email Stack Scan a domain
← Domain reports

freshworks.comemail setup

Public DNS report for freshworks.com, read on September 27, 2026: authentication, the email tools its records reveal, the sender rules it meets, and what would raise its score. Every line is a public record.

This page is a snapshot from our index. Re-run to read DNS as it is right now, or type any other domain.

The Email StackPublic DNS Report
Report
TES-20260927-E35769
Read
27 Sept 2026, 12:53 UTC
Source
Index snapshot
Domain

freshworks.com

The three core checks pass. What is missing is the transport and trust layer around them.

4 of 8 checks pass · 5 tools visible in DNS · nothing urgent

C 69/100 Grade C
SPFValid, soft fail20/20
DKIM4 keys found15/15
DMARCPartial (p=quarantine)22/30
MX5 hosts10/10
MTA-STSNot published0/10
TLS-RPTNot published0/5
BIMIDeclined2/5
DNSSECNot signed0/5

1 · Authentication and transport

SPF

PassValid, soft fail

Anything not on the list is accepted but marked. Google recommends ~all; with DMARC enforced it is as strong as -all.

v=spf1 include:_spf.google.com include:sendgrid.net include:_spf.salesforce.com include:_spf.psm.knowbe4.com include:mktomail.com include:48900367.spf03.hubspotemail.net ip4:13.126.240.50/32 ip4:13.126.94.72/32 ip4:13.126.102.198/32 ip4:159.65.239.157 ip4:20.189.177.144/28 ip4:23.101.193.21/32 ip4:91.102.14.0/26 ip4:194.29.227.64/26 ip4:91.102.8.32/27 ip4:149.72.151.35 ip4:149.72.183.8 ip4:149.72.201.153 ip4:149.72.22.42 ip4:149.72.61.106 ip4:159.183.141.212 ip4:159.183.141.213 ip4:159.183.141.214 ip4:54.240.64.201 ip4:54.240.64.202 ip4:54.240.87.174 ip4:54.240.87.175 ip4:52.37.142.146 ip4:52.207.191.216 ip4:52.50.129.119 ip4:54.174.209.165 ip4:52.16.75.109 ip4:52.16.75.118 ip4:52.16.38.44 ip4:52.16.49.62 ip4:54.79.0.4 ip4:35.182.195.41 ip4:54.85.129.207 ip4:52.22.249.69 ip4:18.197.43.76 ip4:54.93.104.220 ip4:3.209.231.65 ip4:34.206.143.108 ip4:35.157.192.122 ip4:18.132.189.127 ip4:52.65.244.27 ip4:15.223.142.138 ip4:3.248.148.18 ip4:107.20.91.250 ip4:3.96.249.213 ip4:52.58.159.50 ip4:3.11.129.102 ip4:34.242.156.53 ip4:52.4.156.8 ip4:34.251.63.7 ip4:52.64.32.126 ~all

DKIM

Pass4 keys found

Selectors google, s1, s2, mandrill publish a public key. 2 of them point at a vendor by CNAME.

google._domainkey, s1._domainkey, s2._domainkey, mandrill._domainkey

DMARC

PassPartial (p=quarantine)

Failing mail goes to spam. One step from full enforcement.

v=DMARC1; p=quarantine; rua=mailto:dmarc-fd-reports@freshworks.com,mailto:dmarc_agg@dmarc.everest.email; ruf=mailto:dmarc-fd-reports@freshworks.com,mailto:dmarc_fr@dmarc.everest.email;

MX

Pass5 hosts

More than one receiving server, so a single outage does not bounce mail.

10 aspmx.l.google.com
20 alt1.aspmx.l.google.com
30 alt2.aspmx.l.google.com
40 aspmx2.googlemail.com
50 aspmx3.googlemail.com

MTA-STS

ReviewNot published

Sending servers cannot tell that this domain requires TLS, so inbound mail can be downgraded to plain text by anyone on the path.

TLS-RPT

OptionalNot published

Nobody is told when TLS to this domain fails. Cheap to add once MTA-STS is in place.

BIMI

ReviewDeclined

An empty l= tag opts the domain out of BIMI.

v=BIMI1;

DNSSEC

OptionalNot signed

Optional. Signing the zone protects every record in this report from tampering.

2 · Tools visible in DNS

LayerToolEvidence
MailboxGoogle WorkspaceMX aspmx.l.google.com
MarketingMailchimpDKIM mandrill._domainkey
MarketingHubSpotSPF include:48900367.spf03.hubspotemail.net
MarketingMarketoSPF include:mktomail.com
TransactionalSendGridSPF include:sendgrid.net

Only tools that leave a DNS trace appear. A shared DKIM selector is attributed only when its CNAME target names the vendor.

3 · Sender requirements (Google, Yahoo, Microsoft)

RequirementApplies toStatusNote
Authenticate with SPF or DKIMGoogleYahooMicrosoftVerifiedAt least one method is in place.
Bulk senders: both SPF and DKIMGoogleYahooVerifiedBoth are present.
Publish a DMARC record (p=none is enough)GoogleYahooMicrosoftVerifiedPolicy is p=quarantine.
From: domain aligns with SPF or DKIMGoogleYahooMicrosoftNot checkable hereNeeds a real message. The Send-a-Test report will check this.
Valid forward and reverse DNS for sending IPsGoogleYahooNot checkable hereDepends on the sending server, not the domain.
Encrypt in transit (TLS)GoogleYahooNot checkable hereOutbound TLS depends on your sending tool; MTA-STS would cover inbound.
One-click unsubscribe (RFC 8058) for marketing mailGoogleYahooNot checkable hereA message header, not a DNS record. Microsoft recommends it rather than requiring it.
Spam complaint rate under 0.1% (0.3% is the hard limit)GoogleYahooNot checkable hereRead it in Google Postmaster Tools and Yahoo Sender Hub. Google’s target is 0.1%; 0.3% is where enforcement starts.

4 · What to fix, in order

  1. P2

    Finish DMARC at p=reject

    Quarantine still delivers spoofed mail, just into spam.

    Publish at_dmarc.freshworks.com
    v=DMARC1; p=reject; rua=mailto:dmarc@freshworks.com; fo=1
  2. P3

    Publish MTA-STS (record and policy file)

    Tells sending servers to require TLS to your MX hosts, which prevents downgrade attacks. The TXT record alone does nothing: the policy file must be served over HTTPS at mta-sts.freshworks.com. Start in testing mode, watch TLS-RPT, then switch to enforce.

    Publish at_mta-sts.freshworks.com and https://mta-sts.freshworks.com/.well-known/mta-sts.txt
    TXT  v=STSv1; id=2026100401

mta-sts.txt:
version: STSv1
mode: testing
mx: aspmx.l.google.com
mx: alt1.aspmx.l.google.com
mx: alt2.aspmx.l.google.com
mx: aspmx2.googlemail.com
mx: aspmx3.googlemail.com
max_age: 86400
  3. P3

    Publish TLS-RPT

    You get a report when TLS delivery to your domain fails; this is what notices a downgrade that MTA-STS is meant to prevent. The address must exist.

    Publish at_smtp._tls.freshworks.com
    v=TLSRPTv1; rua=mailto:tls-rpt@freshworks.com
  4. P3

    Sign the zone with DNSSEC

    Protects every record in this report from being swapped in transit. Two steps: enable signing at your DNS host (one switch at Cloudflare and most others), then add the DS record it gives you at your registrar.

    Publish atfreshworks.com

Appendix · Raw DNS answers

NameTypeAnswer
freshworks.comMX10 aspmx.l.google.com
20 alt1.aspmx.l.google.com
30 alt2.aspmx.l.google.com
40 aspmx2.googlemail.com
50 aspmx3.googlemail.com
freshworks.comA13.225.5.118
13.225.5.65
13.225.5.73
13.225.5.75
freshworks.comTXTv=spf1 include:_spf.google.com include:sendgrid.net include:_spf.salesforce.com include:_spf.psm.knowbe4.com include:mktomail.com include:48900367.spf03.hubspotemail.net ip4:13.126.240.50/32 ip4:13.126.94.72/32 ip4:13.126.102.198/32 ip4:159.65.239.157 ip4:20.189.177.144/28 ip4:23.101.193.21/32 ip4:91.102.14.0/26 ip4:194.29.227.64/26 ip4:91.102.8.32/27 ip4:149.72.151.35 ip4:149.72.183.8 ip4:149.72.201.153 ip4:149.72.22.42 ip4:149.72.61.106 ip4:159.183.141.212 ip4:159.183.141.213 ip4:159.183.141.214 ip4:54.240.64.201 ip4:54.240.64.202 ip4:54.240.87.174 ip4:54.240.87.175 ip4:52.37.142.146 ip4:52.207.191.216 ip4:52.50.129.119 ip4:54.174.209.165 ip4:52.16.75.109 ip4:52.16.75.118 ip4:52.16.38.44 ip4:52.16.49.62 ip4:54.79.0.4 ip4:35.182.195.41 ip4:54.85.129.207 ip4:52.22.249.69 ip4:18.197.43.76 ip4:54.93.104.220 ip4:3.209.231.65 ip4:34.206.143.108 ip4:35.157.192.122 ip4:18.132.189.127 ip4:52.65.244.27 ip4:15.223.142.138 ip4:3.248.148.18 ip4:107.20.91.250 ip4:3.96.249.213 ip4:52.58.159.50 ip4:3.11.129.102 ip4:34.242.156.53 ip4:52.4.156.8 ip4:34.251.63.7 ip4:52.64.32.126 ~all
(+ 62 other TXT records: site-verification tokens and the like, omitted)
_dmarc.freshworks.comTXTv=DMARC1; p=quarantine; rua=mailto:dmarc-fd-reports@freshworks.com,mailto:dmarc_agg@dmarc.everest.email; ruf=mailto:dmarc-fd-reports@freshworks.com,mailto:dmarc_fr@dmarc.everest.email;
<selector>._domainkey.freshworks.comTXTgoogle → key published
s1 → CNAME s1.domainkey.u4470086.wl087.sendgrid.net
s2 → CNAME s2.domainkey.u4470086.wl087.sendgrid.net
mandrill → key published
_mta-sts.freshworks.comTXTno record
_smtp._tls.freshworks.comTXTno record
default._bimi.freshworks.comTXTl=https://cdn.freshmarketer.com/freshworks-logo.svg; a=;
v=BIMI1;

How to verify this yourself. Every line above comes from public DNS. Run dig TXT _dmarc.freshworks.com or dig MX freshworks.com and compare. Method: theemailstack.com/methodology.

Scores weigh SPF 20, DKIM 15, DMARC 30, MX 10, MTA-STS 10, TLS-RPT 5, BIMI 5, DNSSEC 5. Message-level requirements (alignment, unsubscribe headers, complaint rate) are not checkable from DNS and are marked as such, never guessed.

Scan to re-run livetheemailstack.com/report/freshworks.com

About this report

The Email Stack reads public DNS for well-known domains and publishes the result as a report, the same one anyone can generate for any domain at /report. It is a point-in-time read: records change, and a domain that scores C today may score differently next month. The "Re-run live" button reads DNS again in your browser.

Scores weigh SPF 20, DKIM 15, DMARC 30, MX 10, MTA-STS 10, TLS-RPT 5, BIMI 5 and DNSSEC 5. Tools are named only when a DNS record names the vendor; a shared DKIM selector counts only when its CNAME target does. Message-level requirements such as alignment and one-click unsubscribe cannot be read from DNS and are marked as such, never guessed. Method: how we detect tools.

Own this domain and see something wrong? DNS is the source; fix the record and the next read will show it. Questions to hello@theemailstack.com.