mailhy.com

Checked 10 Nov, 02:15 UTC in 1.2 s.

1 problem is likely to send this domain's mail to spam. Fix “SPF needs 11 DNS lookups, the limit is 10” first.

0 critical
1 high
2 medium
1 low

Build the fixesTry a change

Badge and share card Compare with another domain Track it in a workspace

Badge and API docs

Put the grade where your team will see it. The badge updates at most every ten minutes.

README badge

Markdown

[![Email health for mailhy.com on Stamp](https://stamp-zeta-two.vercel.app/badge/mailhy.com.svg)](https://stamp-zeta-two.vercel.app/check/mailhy.com)

HTML

<a href="https://stamp-zeta-two.vercel.app/check/mailhy.com"><img src="https://stamp-zeta-two.vercel.app/badge/mailhy.com.svg" alt="Email health for mailhy.com on Stamp" height="56"></a>

Share card

Slack, LinkedIn and X show this when you paste the link.

Get this report as JSON

mailhy.com

Reading DNS records, live.

MX records and mail servers
SPF, following every include
DKIM on 36 common selectors
DMARC policy
MTA-STS and TLS reporting
Five public blocklists

Checking

What to fix, in order

4 changes, most damaging first, each with its record.

HighSPF needs 11 DNS lookups, the limit is 10SPF

Past ten lookups receivers stop evaluating and SPF fails with a permanent error. Remove includes for services you no longer use, or flatten the busiest include into IP ranges.

MediumNo DKIM key found on common selectorsDKIM

We tried 36 common selectors. DKIM may still be set up under a custom one: enter it below to check. If it is not set up, mail cannot pass DMARC through forwarding.

MediumDMARC is monitoring only (p=none)DMARC

p=none reports spoofing but blocks none of it. Once the reports show only your own services, move to quarantine so forged mail goes to spam.

Type: TXT
Host: _dmarc
Value: v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@netcorecloud.com

LowInbound mail can be downgraded to plain textEncryption

Without MTA-STS, an attacker on the network can strip TLS from mail sent to you. It needs one TXT record and a small policy file on https://mta-sts.mailhy.com.

Type: TXT
Host: _mta-sts
Value: v=STSv1; id=20261110

Then serve the policy at https://mta-sts.mailhy.com/.well-known/mta-sts.txt

2 notes that do not affect the score

NoteOnly one MX hostMail servers

If that server is down, mail queues at the sender until it comes back. Hosted providers usually handle this for you.

NoteNo TLS reportingEncryption

TLS-RPT sends you a daily report of senders that failed to connect securely. Useful before turning on MTA-STS enforcement.

Type: TXT
Host: _smtp._tls
Value: v=TLSRPTv1; rua=mailto:tls-reports@mailhy.com

Sender	Type	IPv4 addresses
netcore.co.innetcore.co.in	Not recognised	21,192
Your own servers	Yours	Seen signing, not in SPF

Requirement	What Stamp found
SPF set upSet up SPF and DKIM email authentication for your domain. SourceA record is published, but receivers return a permanent error for it, so SPF fails. The SPF section shows why.	Not met
DKIM set upSet up SPF and DKIM email authentication for your domain. SourceNo key at the 36 common selectors Stamp tried, but DNS cannot list selector names, so a key may exist under another selector. Enter it in the DKIM section to check it, or let one real email settle it.	Not confirmed
DKIM key of 1024 bits or longerSending to personal Gmail accounts requires a DKIM key of 1024 bits or longer. SourceNo key at the 36 common selectors Stamp tried, but DNS cannot list selector names, so a key may exist under another selector. Enter it in the DKIM section to check it, or let one real email settle it.	Not confirmed
DMARC set up, at least p=noneSet up DMARC email authentication for your sending domain. Your DMARC enforcement policy can be set to none. SourcePublished with p=none. Whether a message passes DMARC only shows in a real email.	Seen in DNS

Requirement

What Stamp found

SPF set upSet up SPF and DKIM email authentication for your domain. SourceA record is published, but receivers return a permanent error for it, so SPF fails. The SPF section shows why.

Not met

DKIM set upSet up SPF and DKIM email authentication for your domain. SourceNo key at the 36 common selectors Stamp tried, but DNS cannot list selector names, so a key may exist under another selector. Enter it in the DKIM section to check it, or let one real email settle it.

Not confirmed

DKIM key of 1024 bits or longerSending to personal Gmail accounts requires a DKIM key of 1024 bits or longer. SourceNo key at the 36 common selectors Stamp tried, but DNS cannot list selector names, so a key may exist under another selector. Enter it in the DKIM section to check it, or let one real email settle it.

Not confirmed

DMARC set up, at least p=noneSet up DMARC email authentication for your sending domain. Your DMARC enforcement policy can be set to none. SourcePublished with p=none. Whether a message passes DMARC only shows in a real email.

Seen in DNS

Requirement	What Stamp found
From: domain alignedFor direct email, the domain in the sender's From: header must be aligned with either the SPF domain or the DKIM domain. SourcePaste the headers of a delivered message into Trace an email. It shows whether SPF or DKIM lined up with the From: domain. Open Trace an email	Stamp cannot see this from DNS
Forward and reverse DNS for the senderEnsure that sending domains or IPs have valid forward and reverse DNS records, also referred to as PTR records. SourceLook up the PTR record of the IP that sends your mail, then look up the name it returns. That name should lead back to the same IP.

Requirement

What Stamp found

From: domain alignedFor direct email, the domain in the sender's From: header must be aligned with either the SPF domain or the DKIM domain. SourcePaste the headers of a delivered message into Trace an email. It shows whether SPF or DKIM lined up with the From: domain. Open Trace an email

Stamp cannot see this from DNS

Forward and reverse DNS for the senderEnsure that sending domains or IPs have valid forward and reverse DNS records, also referred to as PTR records. SourceLook up the PTR record of the IP that sends your mail, then look up the name it returns. That name should lead back to the same IP.

Requirement	What Stamp found
SPF implementedImplement both SPF & DKIM SourceA record is published, but receivers return a permanent error for it, so SPF fails. The SPF section shows why.	Not met
DKIM implementedImplement both SPF & DKIM SourceNo key at the 36 common selectors Stamp tried, but DNS cannot list selector names, so a key may exist under another selector. Enter it in the DKIM section to check it, or let one real email settle it.	Not confirmed

Requirement

What Stamp found

SPF implementedImplement both SPF & DKIM SourceA record is published, but receivers return a permanent error for it, so SPF fails. The SPF section shows why.

Not met

DKIM implementedImplement both SPF & DKIM SourceNo key at the 36 common selectors Stamp tried, but DNS cannot list selector names, so a key may exist under another selector. Enter it in the DKIM section to check it, or let one real email settle it.

Not confirmed

Requirement	What Stamp found
SPF record publishedPublish SPF and DKIM records for the domain SourceA record is published, but receivers return a permanent error for it, so SPF fails. The SPF section shows why.	Not met
DKIM record publishedPublish SPF and DKIM records for the domain SourceNo key at the 36 common selectors Stamp tried, but DNS cannot list selector names, so a key may exist under another selector. Enter it in the DKIM section to check it, or let one real email settle it.	Not confirmed

Requirement

What Stamp found

SPF record publishedPublish SPF and DKIM records for the domain SourceA record is published, but receivers return a permanent error for it, so SPF fails. The SPF section shows why.

Not met

DKIM record publishedPublish SPF and DKIM records for the domain SourceNo key at the 36 common selectors Stamp tried, but DNS cannot list selector names, so a key may exist under another selector. Enter it in the DKIM section to check it, or let one real email settle it.

Not confirmed

Checked	Spamhaus ZEN	SpamCop	Barracuda	PSBL	Spamhaus DBL
Checked13.207.88.155	Spamhaus ZENClear	SpamCopClear	BarracudaClear	PSBLClear	Spamhaus DBLNot applicable
Checked65.0.144.121	Spamhaus ZENClear	SpamCopClear	BarracudaClear	PSBLClear	Spamhaus DBLNot applicable
Checked13.234.140.164	Spamhaus ZENClear	SpamCopClear	BarracudaClear	PSBLClear	Spamhaus DBLNot applicable
Checkedmailhy.com	Spamhaus ZENNot applicable	SpamCopNot applicable	BarracudaNot applicable	PSBLNot applicable	Spamhaus DBLClear

mailhy.com

mailhy.com

What to fix, in order

Could someone fake mailhy.com?

Forge your address

Make up a subdomain

Borrow a service you use

Buy a domain you trust

The forged letter

Domains your records trust

Who can send as you

Gmail, Yahoo and Outlook sender rules

Gmail

Yahoo

Outlook

SPF

DKIM

DMARC

Mail servers

Encryption in transit

Blocklists

Brand logo (BIMI)

Requirement	What Stamp found
From: domain aligned, and DMARC passesEnsure the domain in the From: header is aligned with either the SPF domain or the DKIM domain. SourcePaste the headers of a delivered message into Trace an email. It shows whether SPF or DKIM lined up with the From: domain. Open Trace an email	Stamp cannot see this from DNS
Forward and reverse DNS for the senderHave a valid forward and reverse DNS record for your sending IPs SourceLook up the PTR record of the IP that sends your mail, then look up the name it returns. That name should lead back to the same IP.	Stamp cannot see this from DNS
Spam rate below 0.3%Keep your spam rate below 0.3% SourceYahoo works this out from mail delivered to the inbox, so allow for that when you read its Complaint Feedback Loop data.	Stamp cannot see this from DNS
Mail follows RFC 5321 and RFC 5322Comply with RFCs 5321 and 5322 SourceAsk your sending service about RFC 5321, which covers how its servers talk to receivers. For RFC 5322, read the raw headers of a test message: one From: and one Date: are required.	Stamp cannot see this from DNS
One-click List-Unsubscribe headerImplement a functioning list-unsubscribe header, which supports one-click unsubscribe for marketing and subscribed messages SourceRead the raw headers of a marketing message. Yahoo highly recommends the RFC 8058 POST method and accepts mailto.	Stamp cannot see this from DNS
Visible unsubscribe linkHave a clearly visible unsubscribe link in the email body SourceOpen a marketing message and find the link. It may lead to a preference page.	Stamp cannot see this from DNS
Unsubscribes honored within 2 daysHonor unsubscribes within 2 days SourceUnsubscribe a test address, then watch whether it gets mail after 2 days.	Stamp cannot see this from DNS

Requirement	What Stamp found
Messages pass SPF and DKIMBoth SPF and DKIM checks must pass. SourcePaste the headers of a delivered message into Trace an email to read both results. Open Trace an email	Stamp cannot see this from DNS
Messages pass DMARC, with SPF or DKIM alignedMessages from senders in the domain must pass DMARC validation SourcePaste the headers of a delivered message into Trace an email. It shows whether SPF or DKIM lined up with the From: domain. Open Trace an email	Stamp cannot see this from DNS
Clear way to opt outRecommended, not requiredProvide an easy, clearly visible way for recipients to opt out of further messages, particularly for marketing or bulk mail. SourceOpen a marketing message and follow its unsubscribe link.	Stamp cannot see this from DNS
Invalid addresses removedRecommended, not requiredRemove invalid addresses regularly to reduce spam complaints, bounces, and wasted messages. SourceRead the bounce report in your sending service.	Stamp cannot see this from DNS
Accurate subjects and real consentRecommended, not requiredUse accurate subject lines, avoid deceptive headers, and ensure your recipients have consented to receive your messages. SourceReview your sign-up forms and recent subject lines.	Stamp cannot see this from DNS

Embed and share

README badge

Share card

Embed and share

README badge

Share card

What to fix, in order

Could someone fake mailhy.com?

Forge your address

Make up a subdomain

Borrow a service you use

Buy a domain you trust

The forged letter

Domains your records trust

Who can send as you

Gmail, Yahoo and Outlook sender rules

Gmail

Yahoo

Outlook

SPF

DKIM

DMARC

Mail servers

Encryption in transit

Blocklists

Brand logo (BIMI)