vultr.com
The three core checks pass. What is missing is the transport and trust layer around them.
5 of 8 checks pass · 3 tools visible in DNS · nothing urgent
1 · Authentication and transport
SPF
PassValid, hard failAnything not on the list is rejected. The strongest setting.
v=spf1 ip4:108.61.13.174 ip4:107.191.35.128/29 ip4:208.167.225.32/28 ip4:208.167.225.253 ip4:66.42.112.23 ip4:108.61.150.28 ip4:64.237.34.251 ip4:192.254.117.0/24 include:_spf2.vultr.com include:_spf3.vultr.com include:_spf.google.com include:_spf4.vultr.com include:mg-spf.greenhouse.io include:usb._netblocks.mimecast.com -all
DKIM
Pass3 keys foundSelectors google, s1, s2 publish a public key. 2 of them point at a vendor by CNAME.
google._domainkey, s1._domainkey, s2._domainkey
DMARC
PassEnforced (p=reject)Failing mail is rejected. This is the finish line.
v=DMARC1; p=reject; rua=mailto:noreply@vultr.com; ruf=mailto:noreply@vultr.com; pct=100; sp=reject; fo=1; ri=3600;
MX
Pass7 hostsMore than one receiving server, so a single outage does not bounce mail.
10 alt1.aspmx.l.google.com 20 alt3.aspmx.l.google.com 30 alt2.aspmx.l.google.com 40 aspmx.l.google.com 50 alt4.aspmx.l.google.com 60 usb-smtp-inbound-2.mimecast.com 70 usb-smtp-inbound-1.mimecast.com
MTA-STS
PassPublishedThe DNS record is present. The policy file at https://mta-sts.<domain>/.well-known/mta-sts.txt cannot be read from a browser, so its mode is not verified here.
v=STSv1; id=20240911T1200
TLS-RPT
OptionalNot publishedNobody is told when TLS to this domain fails. Cheap to add once MTA-STS is in place.
BIMI
OptionalNot publishedDMARC is enforced, so this domain qualifies. Yahoo and Fastmail show the logo from the record alone; Gmail and Apple Mail also need a paid VMC or CMC certificate.
DNSSEC
OptionalNot signedOptional. Signing the zone protects every record in this report from tampering.
2 · Tools visible in DNS
| Layer | Tool | Evidence |
|---|---|---|
| Mailbox | Google Workspace | MX alt1.aspmx.l.google.com |
| Gateway | Mimecast | MX usb-smtp-inbound-2.mimecast.com |
| Transactional | SendGrid | DKIM s1._domainkey → s1.domainkey.u23058167.wl168.sendgrid.net |
Only tools that leave a DNS trace appear. A shared DKIM selector is attributed only when its CNAME target names the vendor.
3 · Sender requirements (Google, Yahoo, Microsoft)
| Requirement | Applies to | Status | Note |
|---|---|---|---|
| Authenticate with SPF or DKIM | GoogleYahooMicrosoft | Verified | At least one method is in place. |
| Bulk senders: both SPF and DKIM | GoogleYahoo | Verified | Both are present. |
| Publish a DMARC record (p=none is enough) | GoogleYahooMicrosoft | Verified | Policy is p=reject. |
| From: domain aligns with SPF or DKIM | GoogleYahooMicrosoft | Not checkable here | Needs a real message. The Send-a-Test report will check this. |
| Valid forward and reverse DNS for sending IPs | GoogleYahoo | Not checkable here | Depends on the sending server, not the domain. |
| Encrypt in transit (TLS) | GoogleYahoo | Verified | MTA-STS shows inbound TLS is required; outbound depends on your sending tool. |
| One-click unsubscribe (RFC 8058) for marketing mail | GoogleYahoo | Not checkable here | A message header, not a DNS record. Microsoft recommends it rather than requiring it. |
| Spam complaint rate under 0.1% (0.3% is the hard limit) | GoogleYahoo | Not checkable here | Read it in Google Postmaster Tools and Yahoo Sender Hub. Google’s target is 0.1%; 0.3% is where enforcement starts. |
4 · What to fix, in order
-
P3
Publish TLS-RPT
You get a report when TLS delivery to your domain fails; this is what notices a downgrade that MTA-STS is meant to prevent. The address must exist.
Publish at_smtp._tls.vultr.comv=TLSRPTv1; rua=mailto:tls-rpt@vultr.com
-
P3
Add a BIMI logo record (optional)
DMARC already qualifies. The logo must be SVG Tiny PS, square, served over HTTPS. Yahoo and Fastmail show it from the record alone; Gmail and Apple Mail also need a paid VMC or CMC certificate, and a VMC needs a registered trademark. Skip this unless the certificate is worth it to you.
Publish atdefault._bimi.vultr.comv=BIMI1; l=https://vultr.com/.well-known/bimi.svg;
-
P3
Sign the zone with DNSSEC
Protects every record in this report from being swapped in transit. Two steps: enable signing at your DNS host (one switch at Cloudflare and most others), then add the DS record it gives you at your registrar.
Publish atvultr.com
Appendix · Raw DNS answers
| Name | Type | Answer |
|---|---|---|
| vultr.com | MX | 10 alt1.aspmx.l.google.com 20 alt3.aspmx.l.google.com 30 alt2.aspmx.l.google.com 40 aspmx.l.google.com 50 alt4.aspmx.l.google.com 60 usb-smtp-inbound-2.mimecast.com 70 usb-smtp-inbound-1.mimecast.com |
| vultr.com | A | 108.61.13.174 |
| vultr.com | TXT | v=spf1 ip4:108.61.13.174 ip4:107.191.35.128/29 ip4:208.167.225.32/28 ip4:208.167.225.253 ip4:66.42.112.23 ip4:108.61.150.28 ip4:64.237.34.251 ip4:192.254.117.0/24 include:_spf2.vultr.com include:_spf3.vultr.com include:_spf.google.com include:_spf4.vultr.com include:mg-spf.greenhouse.io include:usb._netblocks.mimecast.com -all (+ 25 other TXT records: site-verification tokens and the like, omitted) |
| _dmarc.vultr.com | TXT | v=DMARC1; p=reject; rua=mailto:noreply@vultr.com; ruf=mailto:noreply@vultr.com; pct=100; sp=reject; fo=1; ri=3600; |
| <selector>._domainkey.vultr.com | TXT | google → key published s1 → CNAME s1.domainkey.u23058167.wl168.sendgrid.net s2 → CNAME s2.domainkey.u23058167.wl168.sendgrid.net |
| _mta-sts.vultr.com | TXT | v=STSv1; id=20240911T1200 |
| _smtp._tls.vultr.com | TXT | v=spf1 include:vultr.com -all |
| default._bimi.vultr.com | TXT | v=spf1 include:vultr.com -all |