dmarc.microsoft

Graded on what DNS can prove. DKIM is not confirmed yet.

Mail handled by Microsoft 365. Checked 10 Nov, 01:03 UTC in 0.1 s.

SPF and DMARC are in place and DMARC is enforced. DKIM is not confirmed yet, because DNS cannot list selector names. The headers of one real email will settle it.

0 critical
0 high
0 medium
1 low

Try a change

Badge and share card Compare with another domain Track it in a workspace

Badge and API docs

Put the grade where your team will see it. The badge updates at most every ten minutes.

README badge

Markdown

[![Email health for dmarc.microsoft on Stamp](https://stamp-zeta-two.vercel.app/badge/dmarc.microsoft.svg)](https://stamp-zeta-two.vercel.app/check/dmarc.microsoft)

HTML

<a href="https://stamp-zeta-two.vercel.app/check/dmarc.microsoft"><img src="https://stamp-zeta-two.vercel.app/badge/dmarc.microsoft.svg" alt="Email health for dmarc.microsoft on Stamp" height="56"></a>

Share card

Slack, LinkedIn and X show this when you paste the link.

Get this report as JSON

dmarc.microsoft

Reading DNS records, live.

MX records and mail servers
SPF, following every include
DKIM on 36 common selectors
DMARC policy
MTA-STS and TLS reporting
Five public blocklists

Checking

What to fix, in order

1 change, most damaging first, each with its record.

LowInbound mail can be downgraded to plain textEncryption

Without MTA-STS, an attacker on the network can strip TLS from mail sent to you. It needs one TXT record and a small policy file on https://mta-sts.dmarc.microsoft.

Type: TXT
Host: _mta-sts
Value: v=STSv1; id=20261110

Then serve the policy at https://mta-sts.dmarc.microsoft/.well-known/mta-sts.txt

4 notes that do not affect the score

NoteDKIM is not confirmed yetDKIM

DNS cannot list a domain's DKIM selectors, and this one is not among the 36 we tried. Enforcing DMARC without DKIM would break forwarded mail, so this is more likely a custom selector than a missing key. Paste the headers of one of its emails into Trace an email to confirm it.

NoteOnly one MX hostMail servers

If that server is down, mail queues at the sender until it comes back. Hosted providers usually handle this for you.

NoteNo TLS reportingEncryption

TLS-RPT sends you a daily report of senders that failed to connect securely. Useful before turning on MTA-STS enforcement.

Type: TXT
Host: _smtp._tls
Value: v=TLSRPTv1; rua=mailto:tls-reports@dmarc.microsoft

NoteReady for BIMIBrand logo

DMARC is enforced, so this domain qualifies to show its logo next to messages in Gmail, Yahoo and Apple Mail. It needs an SVG Tiny PS logo and, for Gmail and Apple Mail, a logo certificate: a Verified Mark Certificate, or for Gmail a Common Mark Certificate.

Requirement	What Stamp found
SPF set upSet up SPF and DKIM email authentication for your domain. SourceA valid record is published. Whether a message passes depends on the server that sent it.	Seen in DNS
DKIM set upSet up SPF and DKIM email authentication for your domain. SourceNo key at the 36 common selectors Stamp tried, but DNS cannot list selector names, so a key may exist under another selector. Enter it in the DKIM section to check it, or let one real email settle it.	Not confirmed
DKIM key of 1024 bits or longerSending to personal Gmail accounts requires a DKIM key of 1024 bits or longer. SourceNo key at the 36 common selectors Stamp tried, but DNS cannot list selector names, so a key may exist under another selector. Enter it in the DKIM section to check it, or let one real email settle it.	Not confirmed
DMARC set up, at least p=noneSet up DMARC email authentication for your sending domain. Your DMARC enforcement policy can be set to none. SourcePublished with p=reject. Whether a message passes DMARC only shows in a real email.	Seen in DNS

Requirement

What Stamp found

SPF set upSet up SPF and DKIM email authentication for your domain. SourceA valid record is published. Whether a message passes depends on the server that sent it.

Seen in DNS

DKIM set upSet up SPF and DKIM email authentication for your domain. SourceNo key at the 36 common selectors Stamp tried, but DNS cannot list selector names, so a key may exist under another selector. Enter it in the DKIM section to check it, or let one real email settle it.

Not confirmed

DKIM key of 1024 bits or longerSending to personal Gmail accounts requires a DKIM key of 1024 bits or longer. SourceNo key at the 36 common selectors Stamp tried, but DNS cannot list selector names, so a key may exist under another selector. Enter it in the DKIM section to check it, or let one real email settle it.

Not confirmed

DMARC set up, at least p=noneSet up DMARC email authentication for your sending domain. Your DMARC enforcement policy can be set to none. SourcePublished with p=reject. Whether a message passes DMARC only shows in a real email.

Seen in DNS

Requirement	What Stamp found
From: domain alignedFor direct email, the domain in the sender's From: header must be aligned with either the SPF domain or the DKIM domain. SourcePaste the headers of a delivered message into Trace an email. It shows whether SPF or DKIM lined up with the From: domain. Open Trace an email	Stamp cannot see this from DNS
Forward and reverse DNS for the senderEnsure that sending domains or IPs have valid forward and reverse DNS records, also referred to as PTR records. SourceLook up the PTR record of the IP that sends your mail, then look up the name it returns. That name should lead back to the same IP.

Requirement

What Stamp found

From: domain alignedFor direct email, the domain in the sender's From: header must be aligned with either the SPF domain or the DKIM domain. SourcePaste the headers of a delivered message into Trace an email. It shows whether SPF or DKIM lined up with the From: domain. Open Trace an email

Stamp cannot see this from DNS

Forward and reverse DNS for the senderEnsure that sending domains or IPs have valid forward and reverse DNS records, also referred to as PTR records. SourceLook up the PTR record of the IP that sends your mail, then look up the name it returns. That name should lead back to the same IP.

Requirement	What Stamp found
SPF implementedImplement both SPF & DKIM SourceA valid record is published. Whether a message passes depends on the server that sent it.	Seen in DNS
DKIM implementedImplement both SPF & DKIM SourceNo key at the 36 common selectors Stamp tried, but DNS cannot list selector names, so a key may exist under another selector. Enter it in the DKIM section to check it, or let one real email settle it.	Not confirmed

Requirement

What Stamp found

SPF implementedImplement both SPF & DKIM SourceA valid record is published. Whether a message passes depends on the server that sent it.

Seen in DNS

DKIM implementedImplement both SPF & DKIM SourceNo key at the 36 common selectors Stamp tried, but DNS cannot list selector names, so a key may exist under another selector. Enter it in the DKIM section to check it, or let one real email settle it.

Not confirmed

Requirement	What Stamp found
SPF record publishedPublish SPF and DKIM records for the domain SourceA valid record is published. Whether a message passes depends on the server that sent it.	Seen in DNS
DKIM record publishedPublish SPF and DKIM records for the domain SourceNo key at the 36 common selectors Stamp tried, but DNS cannot list selector names, so a key may exist under another selector. Enter it in the DKIM section to check it, or let one real email settle it.	Not confirmed

Requirement

What Stamp found

SPF record publishedPublish SPF and DKIM records for the domain SourceA valid record is published. Whether a message passes depends on the server that sent it.

Seen in DNS

DKIM record publishedPublish SPF and DKIM records for the domain SourceNo key at the 36 common selectors Stamp tried, but DNS cannot list selector names, so a key may exist under another selector. Enter it in the DKIM section to check it, or let one real email settle it.

Not confirmed

Checked	Spamhaus ZEN	SpamCop	Barracuda	PSBL	Spamhaus DBL
Checked52.101.202.144	Spamhaus ZENClear	SpamCopClear	BarracudaClear	PSBLClear	Spamhaus DBLNot applicable
Checked52.101.40.0	Spamhaus ZENClear	SpamCopClear	BarracudaClear	PSBLClear	Spamhaus DBLNot applicable
Checked52.101.60.160	Spamhaus ZENClear	SpamCopClear	BarracudaClear	PSBLClear	Spamhaus DBLNot applicable
Checked52.101.202.150	Spamhaus ZENClear	SpamCopClear	BarracudaClear	PSBLClear	Spamhaus DBLNot applicable
Checkeddmarc.microsoft	Spamhaus ZENNot applicable	SpamCopNot applicable	BarracudaNot applicable	PSBLNot applicable	Spamhaus DBLClear

dmarc.microsoft

dmarc.microsoft

What to fix, in order

Could someone fake dmarc.microsoft?

Forge your address

Make up a subdomain

Borrow a service you use

Buy a domain you trust

The forged letter

Domains your records trust

Who can send as you

Gmail, Yahoo and Outlook sender rules

Gmail

Yahoo

Outlook

SPF

DKIM

DMARC

Mail servers

Encryption in transit

Blocklists

Brand logo (BIMI)

Requirement	What Stamp found
From: domain aligned, and DMARC passesEnsure the domain in the From: header is aligned with either the SPF domain or the DKIM domain. SourcePaste the headers of a delivered message into Trace an email. It shows whether SPF or DKIM lined up with the From: domain. Open Trace an email	Stamp cannot see this from DNS
Forward and reverse DNS for the senderHave a valid forward and reverse DNS record for your sending IPs SourceLook up the PTR record of the IP that sends your mail, then look up the name it returns. That name should lead back to the same IP.	Stamp cannot see this from DNS
Spam rate below 0.3%Keep your spam rate below 0.3% SourceYahoo works this out from mail delivered to the inbox, so allow for that when you read its Complaint Feedback Loop data.	Stamp cannot see this from DNS
Mail follows RFC 5321 and RFC 5322Comply with RFCs 5321 and 5322 SourceAsk your sending service about RFC 5321, which covers how its servers talk to receivers. For RFC 5322, read the raw headers of a test message: one From: and one Date: are required.	Stamp cannot see this from DNS
One-click List-Unsubscribe headerImplement a functioning list-unsubscribe header, which supports one-click unsubscribe for marketing and subscribed messages SourceRead the raw headers of a marketing message. Yahoo highly recommends the RFC 8058 POST method and accepts mailto.	Stamp cannot see this from DNS
Visible unsubscribe linkHave a clearly visible unsubscribe link in the email body SourceOpen a marketing message and find the link. It may lead to a preference page.	Stamp cannot see this from DNS
Unsubscribes honored within 2 daysHonor unsubscribes within 2 days SourceUnsubscribe a test address, then watch whether it gets mail after 2 days.	Stamp cannot see this from DNS

Requirement	What Stamp found
Messages pass SPF and DKIMBoth SPF and DKIM checks must pass. SourcePaste the headers of a delivered message into Trace an email to read both results. Open Trace an email	Stamp cannot see this from DNS
Messages pass DMARC, with SPF or DKIM alignedMessages from senders in the domain must pass DMARC validation SourcePaste the headers of a delivered message into Trace an email. It shows whether SPF or DKIM lined up with the From: domain. Open Trace an email	Stamp cannot see this from DNS
Clear way to opt outRecommended, not requiredProvide an easy, clearly visible way for recipients to opt out of further messages, particularly for marketing or bulk mail. SourceOpen a marketing message and follow its unsubscribe link.	Stamp cannot see this from DNS
Invalid addresses removedRecommended, not requiredRemove invalid addresses regularly to reduce spam complaints, bounces, and wasted messages. SourceRead the bounce report in your sending service.	Stamp cannot see this from DNS
Accurate subjects and real consentRecommended, not requiredUse accurate subject lines, avoid deceptive headers, and ensure your recipients have consented to receive your messages. SourceReview your sign-up forms and recent subject lines.	Stamp cannot see this from DNS

Embed and share

README badge

Share card

Embed and share

README badge

Share card

What to fix, in order

Could someone fake dmarc.microsoft?

Forge your address

Make up a subdomain

Borrow a service you use

Buy a domain you trust

The forged letter

Domains your records trust

Who can send as you

Gmail, Yahoo and Outlook sender rules

Gmail

Yahoo

Outlook

SPF

DKIM

DMARC

Mail servers

Encryption in transit

Blocklists

Brand logo (BIMI)