Put the grade where your team will see it. The badge updates at most every ten minutes.
README badge
Markdown
[](https://stamp-zeta-two.vercel.app/check/aa.com)
HTML
<a href="https://stamp-zeta-two.vercel.app/check/aa.com"><img src="https://stamp-zeta-two.vercel.app/badge/aa.com.svg" alt="Email health for aa.com on Stamp" height="56"></a>
Share card
Slack, LinkedIn and X show this when you paste the link.
3 changes, most damaging first, each with its record.
LowSPF uses 9 of 10 DNS lookupsSPF
One or two more includes will push this record over the limit. Check before adding another sending service.
Low4 DKIM keys are under 2048 bitsDKIM
"selector2" (1024-bit), "s2" (1024-bit), "smtp" (1024-bit), "cm" (1024-bit): still accepted, but 2048-bit is the current recommendation. Rotate at the next key change.
LowInbound mail can be downgraded to plain textEncryption
Without MTA-STS, an attacker on the network can strip TLS from mail sent to you. It needs one TXT record and a small policy file on https://mta-sts.aa.com.
Type
TXT
Host
_mta-sts
Value
v=STSv1; id=20261110
Then serve the policy at https://mta-sts.aa.com/.well-known/mta-sts.txt
3 notes that do not affect the score
NoteOnly one MX hostMail servers
If that server is down, mail queues at the sender until it comes back. Hosted providers usually handle this for you.
NoteNo TLS reportingEncryption
TLS-RPT sends you a daily report of senders that failed to connect securely. Useful before turning on MTA-STS enforcement.
Type
TXT
Host
_smtp._tls
Value
v=TLSRPTv1; rua=mailto:tls-reports@aa.com
Could someone fake aa.com?
Refused
What an attacker could do with this setup.
Not by the usual routes. Your records tell receivers to refuse forged mail.
Forge your address
Send from any server with From: ceo@aa.com.
DMARC fails and the policy says refuse, so forged mail is turned away at the door.
Refused
Make up a subdomain
Send as billing@secure.aa.com, a name you never created.
DMARC fails and the policy says refuse, so mail from a made-up subdomain is turned away at the door.
Refused
Borrow a service you use
Open an account at a service your SPF approves, and try to send as you.
Your SPF approves servers shared with every other customer of Microsoft 365, Amazon SES, Campaign Monitor. Mail from them passes SPF, so it rests on those services verifying who owns your domain.
Depends
Buy a domain you trust
Note
Ready for BIMI
Brand logo
DMARC is enforced, so this domain qualifies to show its logo next to messages in Gmail, Yahoo and Apple Mail. It needs an SVG Tiny PS logo and, for Gmail and Apple Mail, a logo certificate: a Verified Mark Certificate, or for Gmail a Common Mark Certificate.
Register an expired domain your records still point at.
All 5 outside domains your records trust are still registered and resolving.
Nothing to buy
Worked out on paper from what aa.com publishes; nothing is sent. It shows what your records ask, not what any inbox will do.
The forged letter
Simulated. Nothing was sent.What a receiver would write on mail forged as aa.com, worked out from its records.
From
ceo@aa.com
Sent from, a server the forger controls
mail.attacker.example [203.0.113.25]
Subject
Please pay this invoice today
What the receiver would add
Authentication-Results: mx.receiver.example;
spf=softfail (sender IP is 203.0.113.25, not approved) smtp.mailfrom=ceo@aa.com
Each provider's bulk-sender rules, read against this domain's DNS.
The parts DNS can show meet these rules. 19 more cannot be seen from DNS, so this is not the whole answer.
Gmail
For senders of more than 5,000 messages a day to Gmail accounts. 4 of 4 rows DNS can show are seen. Rules read on 4 Nov 2026
Requirement
What Stamp found
SPF set upSet up SPF and DKIM email authentication for your domain.SourceA valid record is published. Whether a message passes depends on the server that sent it.
Seen in DNS
DKIM set upSet up SPF and DKIM email authentication for your domain.SourceStamp read a usable key at "selector2", "k1", "k2", "k3", "s1", "s2", "smtp", "cm". Whether messages are signed with it only shows in a real email.
Seen in DNS
DKIM key of 1024 bits or longerSending to personal Gmail accounts requires a DKIM key of 1024 bits or longer.SourceLongest key read: 2048 bits.
Seen in DNS
DMARC set up, at least p=noneSet up DMARC email authentication for your sending domain. Your DMARC enforcement policy can be set to none.SourcePublished with p=reject. Whether a message passes DMARC only shows in a real email.
Seen in DNS
7 more requirements Stamp cannot see from DNS, and how to check them
Requirement
What Stamp found
From: domain alignedFor direct email, the domain in the sender's From: header must be aligned with either the SPF domain or the DKIM domain.SourcePaste the headers of a delivered message into Trace an email. It shows whether SPF or DKIM lined up with the From: domain. Open Trace an email
Stamp cannot see this from DNS
Forward and reverse DNS for the senderEnsure that sending domains or IPs have valid forward and reverse DNS records, also referred to as PTR records.SourceLook up the PTR record of the IP that sends your mail, then look up the name it returns. That name should lead back to the same IP.
Yahoo
For bulk senders, meaning a significant volume of mail. Yahoo does not publish a number. 4 of 4 rows DNS can show are seen. Rules read on 4 Nov 2026
Requirement
What Stamp found
SPF implementedImplement both SPF & DKIMSourceA valid record is published. Whether a message passes depends on the server that sent it.
Seen in DNS
DKIM implementedImplement both SPF & DKIMSourceStamp read a usable key at "selector2", "k1", "k2", "k3", "s1", "s2", "smtp", "cm". Whether messages are signed with it only shows in a real email.
Seen in DNS
DKIM key of 1024 bits or longer
Outlook
For senders of 5,000 or more messages to Microsoft consumer email services from one From: domain. 4 of 4 rows DNS can show are seen. Rules read on 4 Nov 2026
Requirement
What Stamp found
SPF record publishedPublish SPF and DKIM records for the domainSourceA valid record is published. Whether a message passes depends on the server that sent it.
Seen in DNS
DKIM record publishedPublish SPF and DKIM records for the domainSourceStamp read a usable key at "selector2", "k1", "k2", "k3", "s1", "s2", "smtp", "cm". Whether messages are signed with it only shows in a real email.
Seen in DNS
Read from DNS; nothing is sent. Stamp cannot see your volume or sending IPs, so it cannot say which apply. Does not affect the grade.
SPF
Pass
Which servers may send as aa.com, read left to right.
Whether senders must use TLS to reach you, and whether you hear when they cannot.
MTA-STS
Not published
TLS reporting
Not published
Blocklists
Pass
Your inbound mail servers (not always the senders) and the domain, against 5 public blocklists.
Checked
Spamhaus ZEN
SpamCop
Barracuda
PSBL
Spamhaus DBL
Checked52.101.194.164
Spamhaus ZENClear
SpamCopClear
BarracudaClear
PSBLClear
Spamhaus DBLn/aNot applicable
Checked52.101.40.104
Spamhaus ZENClear
SpamCopClear
BarracudaClear
PSBLClear
Spamhaus DBLn/aNot applicable
Checked52.101.60.65
Spamhaus ZENClear
SpamCopClear
BarracudaClear
PSBLClear
Spamhaus DBLn/aNot applicable
Checked52.101.8.5
Spamhaus ZENClear
SpamCopClear
BarracudaClear
PSBLClear
Spamhaus DBLn/aNot applicable
Checkedaa.com
Spamhaus ZENn/aNot applicable
SpamCopn/aNot applicable
Barracudan/aNot applicable
PSBLn/aNot applicable
Spamhaus DBLClear
Brand logo (BIMI)
Optional
Your logo in Gmail, Yahoo and Apple Mail. Optional; needs enforced DMARC.
Not published.
Stamp cannot see this from DNS
TLS when sendingUse a TLS connection for transmitting email.SourcePaste the headers of a delivered message into Trace an email. It shows TLS for each leg of the route. Open Trace an email
Stamp cannot see this from DNS
Spam rate below 0.30%Keep spam rates reported in Postmaster Tools below 0.30%.SourceRead your domain's spam rate in Google Postmaster Tools. The same page advises staying below 0.10%.
Stamp cannot see this from DNS
Messages follow RFC 5322Format messages according to the Internet Message Format standard, RFC 5322.SourceSend a test message by your usual route and read its raw headers. RFC 5322 requires one From: and one Date: header.
Stamp cannot see this from DNS
No Gmail From: addressesDon’t impersonate Gmail From: headers.SourceCheck each tool that sends for you. None should put a gmail.com address in From:.
Stamp cannot see this from DNS
One-click unsubscribe and a visible linkMarketing messages and subscribed messages must support one-click unsubscribe, and include a clearly visible unsubscribe link in the message body.SourceSend yourself a marketing message. Look for the List-Unsubscribe and List-Unsubscribe-Post headers, and a link in the body.
Stamp cannot see this from DNS
We require a DKIM key length of 1024 bits or greaterSource
Longest key read: 2048 bits.
Seen in DNS
DMARC published, at least p=nonePublish a valid DMARC policy with at least p=noneSourcePublished with p=reject. Whether a message passes DMARC only shows in a real email.
Seen in DNS
7 more requirements Stamp cannot see from DNS, and how to check them
Requirement
What Stamp found
From: domain aligned, and DMARC passesEnsure the domain in the From: header is aligned with either the SPF domain or the DKIM domain.SourcePaste the headers of a delivered message into Trace an email. It shows whether SPF or DKIM lined up with the From: domain. Open Trace an email
Stamp cannot see this from DNS
Forward and reverse DNS for the senderHave a valid forward and reverse DNS record for your sending IPsSourceLook up the PTR record of the IP that sends your mail, then look up the name it returns. That name should lead back to the same IP.
Stamp cannot see this from DNS
Spam rate below 0.3%Keep your spam rate below 0.3%SourceYahoo works this out from mail delivered to the inbox, so allow for that when you read its Complaint Feedback Loop data.
Stamp cannot see this from DNS
Mail follows RFC 5321 and RFC 5322Comply with RFCs 5321 and 5322SourceAsk your sending service about RFC 5321, which covers how its servers talk to receivers. For RFC 5322, read the raw headers of a test message: one From: and one Date: are required.
Stamp cannot see this from DNS
One-click List-Unsubscribe headerImplement a functioning list-unsubscribe header, which supports one-click unsubscribe for marketing and subscribed messagesSourceRead the raw headers of a marketing message. Yahoo highly recommends the RFC 8058 POST method and accepts mailto.
Stamp cannot see this from DNS
Visible unsubscribe linkHave a clearly visible unsubscribe link in the email bodySourceOpen a marketing message and find the link. It may lead to a preference page.
Stamp cannot see this from DNS
Unsubscribes honored within 2 daysHonor unsubscribes within 2 daysSourceUnsubscribe a test address, then watch whether it gets mail after 2 days.
Stamp cannot see this from DNS
DMARC published, at least p=noneAt least p=none and align with either SPF or DKIM (preferably both).SourcePublished with p=reject. Whether a message passes DMARC only shows in a real email.
Seen in DNS
From: or Reply-To can receive repliesRecommended, not requiredEnsure the “From” or “Reply‐To” address is valid, reflects the true sending domain, and can receive replies.Sourceaa.com has mail servers that resolve. Stamp sends nothing, so this address has not been tested.
Seen in DNS
5 more requirements Stamp cannot see from DNS, and how to check them
Requirement
What Stamp found
Messages pass SPF and DKIMBoth SPF and DKIM checks must pass.SourcePaste the headers of a delivered message into Trace an email to read both results. Open Trace an email
Stamp cannot see this from DNS
Messages pass DMARC, with SPF or DKIM alignedMessages from senders in the domain must pass DMARC validationSourcePaste the headers of a delivered message into Trace an email. It shows whether SPF or DKIM lined up with the From: domain. Open Trace an email
Stamp cannot see this from DNS
Clear way to opt outRecommended, not requiredProvide an easy, clearly visible way for recipients to opt out of further messages, particularly for marketing or bulk mail.SourceOpen a marketing message and follow its unsubscribe link.
Stamp cannot see this from DNS
Invalid addresses removedRecommended, not requiredRemove invalid addresses regularly to reduce spam complaints, bounces, and wasted messages.SourceRead the bounce report in your sending service.
Stamp cannot see this from DNS
Accurate subjects and real consentRecommended, not requiredUse accurate subject lines, avoid deceptive headers, and ensure your recipients have consented to receive your messages.SourceReview your sign-up forms and recent subject lines.
