mit.edu

Mail handled by Microsoft 365. Checked 10 Nov, 00:08 UTC in 0.3 s.

No blocking problems, but a few settings leave room for spoofing or slower delivery.

0 critical
0 high
1 medium
3 low

Build the fixesTry a change

Badge and share card Compare with another domain Track it in a workspace

Badge and API docs

Put the grade where your team will see it. The badge updates at most every ten minutes.

README badge

Markdown

[![Email health for mit.edu on Stamp](https://stamp-zeta-two.vercel.app/badge/mit.edu.svg)](https://stamp-zeta-two.vercel.app/check/mit.edu)

HTML

<a href="https://stamp-zeta-two.vercel.app/check/mit.edu"><img src="https://stamp-zeta-two.vercel.app/badge/mit.edu.svg" alt="Email health for mit.edu on Stamp" height="56"></a>

Share card

Slack, LinkedIn and X show this when you paste the link.

Get this report as JSON

mit.edu

Reading DNS records, live.

MX records and mail servers
SPF, following every include
DKIM on 36 common selectors
DMARC policy
MTA-STS and TLS reporting
Five public blocklists

Checking

What to fix, in order

4 changes, most damaging first, each with its record.

MediumDMARC is monitoring only (p=none)DMARC

p=none reports spoofing but blocks none of it. Once the reports show only your own services, move to quarantine so forged mail goes to spam.

Type: TXT
Host: _dmarc
Value: v=DMARC1; p=quarantine; rua=mailto:dmarcreports@mit.edu

LowSPF uses 10 of 10 DNS lookupsSPF

One or two more includes will push this record over the limit. Check before adding another sending service.

Low7 DKIM keys are under 2048 bitsDKIM

"selector2" (1024-bit), "k1" (1024-bit), "s2" (1024-bit), "mandrill" (1024-bit), "cm" (1024-bit), "mailjet" (1024-bit), "s1024" (1024-bit): still accepted, but 2048-bit is the current recommendation. Rotate at the next key change.

LowInbound mail can be downgraded to plain textEncryption

Without MTA-STS, an attacker on the network can strip TLS from mail sent to you. It needs one TXT record and a small policy file on https://mta-sts.mit.edu.

Type: TXT
Host: _mta-sts
Value: v=STSv1; id=20261110

Then serve the policy at https://mta-sts.mit.edu/.well-known/mta-sts.txt

2 notes that do not affect the score

NoteOnly one MX hostMail servers

If that server is down, mail queues at the sender until it comes back. Hosted providers usually handle this for you.

NoteNo TLS reportingEncryption

TLS-RPT sends you a daily report of senders that failed to connect securely. Useful before turning on MTA-STS enforcement.

Type: TXT
Host: _smtp._tls
Value: v=TLSRPTv1; rua=mailto:tls-reports@mit.edu

Sender	Type	IPv4 addresses
autospf.email_s00430413.autospf.email	Not recognised	910,122
Campaign MonitorDKIM selector cm	Marketing	Seen signing, not in SPF
Google WorkspaceDKIM selector google	Mailbox	Seen signing, not in SPF
MailjetDKIM selector mailjet	Transactional	Seen signing, not in SPF
MandrillDKIM selector mandrill	Transactional	Seen signing, not in SPF
Microsoft 365DKIM selector selector2	Mailbox	Seen signing, not in SPF

Requirement	What Stamp found
SPF set upSet up SPF and DKIM email authentication for your domain. SourceA valid record is published. Whether a message passes depends on the server that sent it.	Seen in DNS
DKIM set upSet up SPF and DKIM email authentication for your domain. SourceStamp read a usable key at "google", "selector2", "k1", "k2", "k3", "s1", "s2", "mandrill", "cm", "mailjet", "s1024". Whether messages are signed with it only shows in a real email.	Seen in DNS
DKIM key of 1024 bits or longerSending to personal Gmail accounts requires a DKIM key of 1024 bits or longer. SourceLongest key read: 2048 bits.	Seen in DNS
DMARC set up, at least p=noneSet up DMARC email authentication for your sending domain. Your DMARC enforcement policy can be set to none. SourcePublished with p=none. Whether a message passes DMARC only shows in a real email.	Seen in DNS

Requirement

What Stamp found

SPF set upSet up SPF and DKIM email authentication for your domain. SourceA valid record is published. Whether a message passes depends on the server that sent it.

Seen in DNS

DKIM set upSet up SPF and DKIM email authentication for your domain. SourceStamp read a usable key at "google", "selector2", "k1", "k2", "k3", "s1", "s2", "mandrill", "cm", "mailjet", "s1024". Whether messages are signed with it only shows in a real email.

Seen in DNS

DKIM key of 1024 bits or longerSending to personal Gmail accounts requires a DKIM key of 1024 bits or longer. SourceLongest key read: 2048 bits.

Seen in DNS

DMARC set up, at least p=noneSet up DMARC email authentication for your sending domain. Your DMARC enforcement policy can be set to none. SourcePublished with p=none. Whether a message passes DMARC only shows in a real email.

Seen in DNS

Requirement	What Stamp found
From: domain alignedFor direct email, the domain in the sender's From: header must be aligned with either the SPF domain or the DKIM domain. SourcePaste the headers of a delivered message into Trace an email. It shows whether SPF or DKIM lined up with the From: domain. Open Trace an email	Stamp cannot see this from DNS
Forward and reverse DNS for the senderEnsure that sending domains or IPs have valid forward and reverse DNS records, also referred to as PTR records. SourceLook up the PTR record of the IP that sends your mail, then look up the name it returns. That name should lead back to the same IP.

Requirement

What Stamp found

From: domain alignedFor direct email, the domain in the sender's From: header must be aligned with either the SPF domain or the DKIM domain. SourcePaste the headers of a delivered message into Trace an email. It shows whether SPF or DKIM lined up with the From: domain. Open Trace an email

Stamp cannot see this from DNS

Forward and reverse DNS for the senderEnsure that sending domains or IPs have valid forward and reverse DNS records, also referred to as PTR records. SourceLook up the PTR record of the IP that sends your mail, then look up the name it returns. That name should lead back to the same IP.

Requirement	What Stamp found
SPF implementedImplement both SPF & DKIM SourceA valid record is published. Whether a message passes depends on the server that sent it.	Seen in DNS
DKIM implementedImplement both SPF & DKIM SourceStamp read a usable key at "google", "selector2", "k1", "k2", "k3", "s1", "s2", "mandrill", "cm", "mailjet", "s1024". Whether messages are signed with it only shows in a real email.	Seen in DNS

Requirement

What Stamp found

SPF implementedImplement both SPF & DKIM SourceA valid record is published. Whether a message passes depends on the server that sent it.

Seen in DNS

DKIM implementedImplement both SPF & DKIM SourceStamp read a usable key at "google", "selector2", "k1", "k2", "k3", "s1", "s2", "mandrill", "cm", "mailjet", "s1024". Whether messages are signed with it only shows in a real email.

Seen in DNS

Requirement	What Stamp found
SPF record publishedPublish SPF and DKIM records for the domain SourceA valid record is published. Whether a message passes depends on the server that sent it.	Seen in DNS
DKIM record publishedPublish SPF and DKIM records for the domain SourceStamp read a usable key at "google", "selector2", "k1", "k2", "k3", "s1", "s2", "mandrill", "cm", "mailjet", "s1024". Whether messages are signed with it only shows in a real email.	Seen in DNS

Requirement

What Stamp found

SPF record publishedPublish SPF and DKIM records for the domain SourceA valid record is published. Whether a message passes depends on the server that sent it.

Seen in DNS

DKIM record publishedPublish SPF and DKIM records for the domain SourceStamp read a usable key at "google", "selector2", "k1", "k2", "k3", "s1", "s2", "mandrill", "cm", "mailjet", "s1024". Whether messages are signed with it only shows in a real email.

Seen in DNS

Selector	Key	Strength	State
Selectorgoogle	Keyrsa	Strength2048-bit	StateSigning
Selectorselector2	Keyrsa	Strength1024-bit	StateRotate soon
Selectork1	Keyrsa	Strength1024-bit	StateRotate soon
Selectork2	Keyrsa	Strength2048-bit	StateSigning
Selectork3	Keyrsa	Strength2048-bit	StateSigning
Selectors1	Keyrsa	Strength2048-bit	StateSigning
Selectors2	Keyrsa	Strength1024-bit	StateRotate soon
Selectormandrill	Keyrsa	Strength1024-bit	StateRotate soon
Selectorcm	Keyrsa	Strength1024-bit	StateRotate soon
Selectormailjet	Keyrsa	Strength1024-bit	StateRotate soon
Selectors1024	Keyrsa	Strength1024-bit	StateRotate soon

Checked	Spamhaus ZEN	SpamCop	Barracuda	PSBL	Spamhaus DBL
Checked52.101.50.13	Spamhaus ZENClear	SpamCopClear	BarracudaClear	PSBLClear	Spamhaus DBLNot applicable
Checked52.101.42.165	Spamhaus ZENClear	SpamCopClear	BarracudaClear	PSBLClear	Spamhaus DBLNot applicable
Checked52.101.41.58	Spamhaus ZENClear	SpamCopClear	BarracudaClear	PSBLClear	Spamhaus DBLNot applicable
Checked52.101.8.32	Spamhaus ZENClear	SpamCopClear	BarracudaClear	PSBLClear	Spamhaus DBLNot applicable
Checkedmit.edu	Spamhaus ZENNot applicable	SpamCopNot applicable	BarracudaNot applicable	PSBLNot applicable	Spamhaus DBLClear

mit.edu

mit.edu

What to fix, in order

Could someone fake mit.edu?

Forge your address

Make up a subdomain

Borrow a service you use

Buy a domain you trust

The forged letter

Domains your records trust

Who can send as you

Gmail, Yahoo and Outlook sender rules

Gmail

Yahoo

Outlook

SPF

DKIM

DMARC

Mail servers

Encryption in transit

Blocklists

Brand logo (BIMI)

Requirement	What Stamp found
From: domain aligned, and DMARC passesEnsure the domain in the From: header is aligned with either the SPF domain or the DKIM domain. SourcePaste the headers of a delivered message into Trace an email. It shows whether SPF or DKIM lined up with the From: domain. Open Trace an email	Stamp cannot see this from DNS
Forward and reverse DNS for the senderHave a valid forward and reverse DNS record for your sending IPs SourceLook up the PTR record of the IP that sends your mail, then look up the name it returns. That name should lead back to the same IP.	Stamp cannot see this from DNS
Spam rate below 0.3%Keep your spam rate below 0.3% SourceYahoo works this out from mail delivered to the inbox, so allow for that when you read its Complaint Feedback Loop data.	Stamp cannot see this from DNS
Mail follows RFC 5321 and RFC 5322Comply with RFCs 5321 and 5322 SourceAsk your sending service about RFC 5321, which covers how its servers talk to receivers. For RFC 5322, read the raw headers of a test message: one From: and one Date: are required.	Stamp cannot see this from DNS
One-click List-Unsubscribe headerImplement a functioning list-unsubscribe header, which supports one-click unsubscribe for marketing and subscribed messages SourceRead the raw headers of a marketing message. Yahoo highly recommends the RFC 8058 POST method and accepts mailto.	Stamp cannot see this from DNS
Visible unsubscribe linkHave a clearly visible unsubscribe link in the email body SourceOpen a marketing message and find the link. It may lead to a preference page.	Stamp cannot see this from DNS
Unsubscribes honored within 2 daysHonor unsubscribes within 2 days SourceUnsubscribe a test address, then watch whether it gets mail after 2 days.	Stamp cannot see this from DNS

Requirement	What Stamp found
Messages pass SPF and DKIMBoth SPF and DKIM checks must pass. SourcePaste the headers of a delivered message into Trace an email to read both results. Open Trace an email	Stamp cannot see this from DNS
Messages pass DMARC, with SPF or DKIM alignedMessages from senders in the domain must pass DMARC validation SourcePaste the headers of a delivered message into Trace an email. It shows whether SPF or DKIM lined up with the From: domain. Open Trace an email	Stamp cannot see this from DNS
Clear way to opt outRecommended, not requiredProvide an easy, clearly visible way for recipients to opt out of further messages, particularly for marketing or bulk mail. SourceOpen a marketing message and follow its unsubscribe link.	Stamp cannot see this from DNS
Invalid addresses removedRecommended, not requiredRemove invalid addresses regularly to reduce spam complaints, bounces, and wasted messages. SourceRead the bounce report in your sending service.	Stamp cannot see this from DNS
Accurate subjects and real consentRecommended, not requiredUse accurate subject lines, avoid deceptive headers, and ensure your recipients have consented to receive your messages. SourceReview your sign-up forms and recent subject lines.	Stamp cannot see this from DNS

Embed and share

README badge

Share card

Embed and share

README badge

Share card

What to fix, in order

Could someone fake mit.edu?

Forge your address

Make up a subdomain

Borrow a service you use

Buy a domain you trust

The forged letter

Domains your records trust

Who can send as you

Gmail, Yahoo and Outlook sender rules

Gmail

Yahoo

Outlook

SPF

DKIM

DMARC

Mail servers

Encryption in transit

Blocklists

Brand logo (BIMI)