walgreens.com

Mail handled by Mimecast. Checked 10 Nov, 00:09 UTC in 0.4 s.

No blocking problems, but a few settings leave room for spoofing or slower delivery.

0 critical
0 high
1 medium
2 low

Build the fixesTry a change

Badge and share card Compare with another domain Track it in a workspace

Badge and API docs

Put the grade where your team will see it. The badge updates at most every ten minutes.

README badge

Markdown

[![Email health for walgreens.com on Stamp](https://stamp-zeta-two.vercel.app/badge/walgreens.com.svg)](https://stamp-zeta-two.vercel.app/check/walgreens.com)

HTML

<a href="https://stamp-zeta-two.vercel.app/check/walgreens.com"><img src="https://stamp-zeta-two.vercel.app/badge/walgreens.com.svg" alt="Email health for walgreens.com on Stamp" height="56"></a>

Share card

Slack, LinkedIn and X show this when you paste the link.

Get this report as JSON

walgreens.com

Reading DNS records, live.

MX records and mail servers
SPF, following every include
DKIM on 36 common selectors
DMARC policy
MTA-STS and TLS reporting
Five public blocklists

Checking

What to fix, in order

3 changes, most damaging first, each with its record.

MediumA DKIM key is not validDKIM

"mandrill": the p= value is not a public key, usually because it was cut off or wrapped when it was pasted. Signatures using it fail. Publish the key again exactly as your provider gives it.

LowSubdomains are not protected (sp=none)DMARC

Anyone can spoof mail from made-up subdomains like billing.yourdomain. Remove sp= to inherit the main policy.

LowInbound mail can be downgraded to plain textEncryption

Without MTA-STS, an attacker on the network can strip TLS from mail sent to you. It needs one TXT record and a small policy file on https://mta-sts.walgreens.com.

Type: TXT
Host: _mta-sts
Value: v=STSv1; id=20261110

Then serve the policy at https://mta-sts.walgreens.com/.well-known/mta-sts.txt

2 notes that do not affect the score

NoteNo TLS reportingEncryption

TLS-RPT sends you a daily report of senders that failed to connect securely. Useful before turning on MTA-STS enforcement.

Type: TXT
Host: _smtp._tls
Value: v=TLSRPTv1; rua=mailto:tls-reports@walgreens.com

NoteReady for BIMIBrand logo

DMARC is enforced, so this domain qualifies to show its logo next to messages in Gmail, Yahoo and Apple Mail. It needs an SVG Tiny PS logo and, for Gmail and Apple Mail, a logo certificate: a Verified Mark Certificate, or for Gmail a Common Mark Certificate.

Sender	Type	IPv4 addresses
mim.ec5786991e._1.usb.2._d.mim.ec	Not recognised	1,042
Your own servers	Yours	Seen signing, not in SPF

Requirement	What Stamp found
SPF set upSet up SPF and DKIM email authentication for your domain. SourceA valid record is published. Whether a message passes depends on the server that sent it.	Seen in DNS
DKIM set upSet up SPF and DKIM email authentication for your domain. SourceStamp read a usable key at "s1", "s2". Whether messages are signed with it only shows in a real email.	Seen in DNS
DKIM key of 1024 bits or longerSending to personal Gmail accounts requires a DKIM key of 1024 bits or longer. SourceLongest key read: 2048 bits.	Seen in DNS
DMARC set up, at least p=noneSet up DMARC email authentication for your sending domain. Your DMARC enforcement policy can be set to none. SourcePublished with p=quarantine. Whether a message passes DMARC only shows in a real email.	Seen in DNS

Requirement

What Stamp found

SPF set upSet up SPF and DKIM email authentication for your domain. SourceA valid record is published. Whether a message passes depends on the server that sent it.

Seen in DNS

DKIM set upSet up SPF and DKIM email authentication for your domain. SourceStamp read a usable key at "s1", "s2". Whether messages are signed with it only shows in a real email.

Seen in DNS

DKIM key of 1024 bits or longerSending to personal Gmail accounts requires a DKIM key of 1024 bits or longer. SourceLongest key read: 2048 bits.

Seen in DNS

DMARC set up, at least p=noneSet up DMARC email authentication for your sending domain. Your DMARC enforcement policy can be set to none. SourcePublished with p=quarantine. Whether a message passes DMARC only shows in a real email.

Seen in DNS

Requirement	What Stamp found
From: domain alignedFor direct email, the domain in the sender's From: header must be aligned with either the SPF domain or the DKIM domain. SourcePaste the headers of a delivered message into Trace an email. It shows whether SPF or DKIM lined up with the From: domain. Open Trace an email	Stamp cannot see this from DNS
Forward and reverse DNS for the senderEnsure that sending domains or IPs have valid forward and reverse DNS records, also referred to as PTR records. SourceLook up the PTR record of the IP that sends your mail, then look up the name it returns. That name should lead back to the same IP.

Requirement

What Stamp found

From: domain alignedFor direct email, the domain in the sender's From: header must be aligned with either the SPF domain or the DKIM domain. SourcePaste the headers of a delivered message into Trace an email. It shows whether SPF or DKIM lined up with the From: domain. Open Trace an email

Stamp cannot see this from DNS

Forward and reverse DNS for the senderEnsure that sending domains or IPs have valid forward and reverse DNS records, also referred to as PTR records. SourceLook up the PTR record of the IP that sends your mail, then look up the name it returns. That name should lead back to the same IP.

Requirement	What Stamp found
SPF implementedImplement both SPF & DKIM SourceA valid record is published. Whether a message passes depends on the server that sent it.	Seen in DNS
DKIM implementedImplement both SPF & DKIM SourceStamp read a usable key at "s1", "s2". Whether messages are signed with it only shows in a real email.	Seen in DNS
DKIM key of 1024 bits or longer

Requirement

What Stamp found

SPF implementedImplement both SPF & DKIM SourceA valid record is published. Whether a message passes depends on the server that sent it.

Seen in DNS

DKIM implementedImplement both SPF & DKIM SourceStamp read a usable key at "s1", "s2". Whether messages are signed with it only shows in a real email.

Seen in DNS

DKIM key of 1024 bits or longer

Requirement	What Stamp found
SPF record publishedPublish SPF and DKIM records for the domain SourceA valid record is published. Whether a message passes depends on the server that sent it.	Seen in DNS
DKIM record publishedPublish SPF and DKIM records for the domain SourceStamp read a usable key at "s1", "s2". Whether messages are signed with it only shows in a real email.	Seen in DNS

Requirement

What Stamp found

SPF record publishedPublish SPF and DKIM records for the domain SourceA valid record is published. Whether a message passes depends on the server that sent it.

Seen in DNS

DKIM record publishedPublish SPF and DKIM records for the domain SourceStamp read a usable key at "s1", "s2". Whether messages are signed with it only shows in a real email.

Seen in DNS

Selector	Key	Strength	State
Selectors1	Keyrsa	Strength2048-bit	StateSigning
Selectors2	Keyrsa	Strength2048-bit	StateSigning
Selectormandrill	Keyrsa	StrengthNot a valid key	StateInvalid

Priority	Host	Addresses
Priority10	Hostusb-smtp-inbound-1.mimecast.com	Addresses170.10.152.242170.10.150.242
Priority10	Hostusb-smtp-inbound-2.mimecast.com	Addresses170.10.152.242170.10.150.242

Checked	Spamhaus ZEN	SpamCop	Barracuda	PSBL	Spamhaus DBL
Checked170.10.152.242	Spamhaus ZENClear	SpamCopClear	BarracudaClear	PSBLClear	Spamhaus DBLNot applicable
Checked170.10.150.242	Spamhaus ZENClear	SpamCopClear	BarracudaClear	PSBLClear	Spamhaus DBLNot applicable
Checkedwalgreens.com	Spamhaus ZENNot applicable	SpamCopNot applicable	BarracudaNot applicable	PSBLNot applicable	Spamhaus DBLClear

walgreens.com

walgreens.com

What to fix, in order

Could someone fake walgreens.com?

Forge your address

Make up a subdomain

Borrow a service you use

Buy a domain you trust

The forged letter

Domains your records trust

Who can send as you

Gmail, Yahoo and Outlook sender rules

Gmail

Yahoo

Outlook

SPF

DKIM

DMARC

Mail servers

Encryption in transit

Blocklists

Brand logo (BIMI)

Requirement	What Stamp found
From: domain aligned, and DMARC passesEnsure the domain in the From: header is aligned with either the SPF domain or the DKIM domain. SourcePaste the headers of a delivered message into Trace an email. It shows whether SPF or DKIM lined up with the From: domain. Open Trace an email	Stamp cannot see this from DNS
Forward and reverse DNS for the senderHave a valid forward and reverse DNS record for your sending IPs SourceLook up the PTR record of the IP that sends your mail, then look up the name it returns. That name should lead back to the same IP.	Stamp cannot see this from DNS
Spam rate below 0.3%Keep your spam rate below 0.3% SourceYahoo works this out from mail delivered to the inbox, so allow for that when you read its Complaint Feedback Loop data.	Stamp cannot see this from DNS
Mail follows RFC 5321 and RFC 5322Comply with RFCs 5321 and 5322 SourceAsk your sending service about RFC 5321, which covers how its servers talk to receivers. For RFC 5322, read the raw headers of a test message: one From: and one Date: are required.	Stamp cannot see this from DNS
One-click List-Unsubscribe headerImplement a functioning list-unsubscribe header, which supports one-click unsubscribe for marketing and subscribed messages SourceRead the raw headers of a marketing message. Yahoo highly recommends the RFC 8058 POST method and accepts mailto.	Stamp cannot see this from DNS
Visible unsubscribe linkHave a clearly visible unsubscribe link in the email body SourceOpen a marketing message and find the link. It may lead to a preference page.	Stamp cannot see this from DNS
Unsubscribes honored within 2 daysHonor unsubscribes within 2 days SourceUnsubscribe a test address, then watch whether it gets mail after 2 days.	Stamp cannot see this from DNS

Requirement	What Stamp found
Messages pass SPF and DKIMBoth SPF and DKIM checks must pass. SourcePaste the headers of a delivered message into Trace an email to read both results. Open Trace an email	Stamp cannot see this from DNS
Messages pass DMARC, with SPF or DKIM alignedMessages from senders in the domain must pass DMARC validation SourcePaste the headers of a delivered message into Trace an email. It shows whether SPF or DKIM lined up with the From: domain. Open Trace an email	Stamp cannot see this from DNS
Clear way to opt outRecommended, not requiredProvide an easy, clearly visible way for recipients to opt out of further messages, particularly for marketing or bulk mail. SourceOpen a marketing message and follow its unsubscribe link.	Stamp cannot see this from DNS
Invalid addresses removedRecommended, not requiredRemove invalid addresses regularly to reduce spam complaints, bounces, and wasted messages. SourceRead the bounce report in your sending service.	Stamp cannot see this from DNS
Accurate subjects and real consentRecommended, not requiredUse accurate subject lines, avoid deceptive headers, and ensure your recipients have consented to receive your messages. SourceReview your sign-up forms and recent subject lines.	Stamp cannot see this from DNS

Embed and share

README badge

Share card

Embed and share

README badge

Share card

What to fix, in order

Could someone fake walgreens.com?

Forge your address

Make up a subdomain

Borrow a service you use

Buy a domain you trust

The forged letter

Domains your records trust

Who can send as you

Gmail, Yahoo and Outlook sender rules

Gmail

Yahoo

Outlook

SPF

DKIM

DMARC

Mail servers

Encryption in transit

Blocklists

Brand logo (BIMI)