{"schemaVersion":1,"domain":"microsoft.com","checkedAt":"2026-10-20T14:24:23.986Z","score":100,"grade":"A","categories":[{"check":"spf","labelEn":"Who may send","score":30,"max":30,"status":"pass","findings":[{"id":"spf-hardfail","check":"spf","severity":"pass","titleEn":"SPF uses hardfail (-all)","hintEn":"Unauthorized servers are explicitly rejected. When you add a sender, edit this record instead of publishing a second one."}]},{"check":"dkim","labelEn":"Signature key","score":25,"max":25,"status":"pass","findings":[{"id":"dkim-present","check":"dkim","severity":"pass","titleEn":"DKIM public key found","hintEn":"At least one common selector publishes a non-empty key: selector2. The signature s= must be one of these, and d= must be this domain."}]},{"check":"dmarc","labelEn":"Failure policy","score":30,"max":30,"status":"pass","findings":[{"id":"dmarc-reject","check":"dmarc","severity":"pass","titleEn":"DMARC policy is reject","hintEn":"Mail that fails alignment should be rejected. Before you change sending services, add them to SPF and sign with DKIM."}]},{"check":"mx","labelEn":"Where bounces go","score":15,"max":15,"status":"pass","findings":[{"id":"mx-present","check":"mx","severity":"pass","titleEn":"MX records look usable","hintEn":"The lowest preference is microsoft-com.mail.protection.outlook.com (10). Confirm that host actually accepts mail."}]}],"findings":[{"id":"spf-hardfail","check":"spf","severity":"pass","titleEn":"SPF uses hardfail (-all)","hintEn":"Unauthorized servers are explicitly rejected. When you add a sender, edit this record instead of publishing a second one."},{"id":"dkim-present","check":"dkim","severity":"pass","titleEn":"DKIM public key found","hintEn":"At least one common selector publishes a non-empty key: selector2. The signature s= must be one of these, and d= must be this domain."},{"id":"dmarc-reject","check":"dmarc","severity":"pass","titleEn":"DMARC policy is reject","hintEn":"Mail that fails alignment should be rejected. Before you change sending services, add them to SPF and sign with DKIM."},{"id":"mx-present","check":"mx","severity":"pass","titleEn":"MX records look usable","hintEn":"The lowest preference is microsoft-com.mail.protection.outlook.com (10). Confirm that host actually accepts mail."}],"records":{"spf":["v=spf1 include:_spf-a.microsoft.com include:_spf-b.microsoft.com include:_spf-c.microsoft.com include:_spf-ssg-a.msft.net include:_spf1-meo.microsoft.com -all"],"dmarc":["v=DMARC1; p=reject; pct=100; rua=mailto:itex-rua@microsoft.com; ruf=mailto:itex-ruf@microsoft.com; fo=1"],"mx":[{"priority":10,"exchange":"microsoft-com.mail.protection.outlook.com"}],"dkim":[{"selector":"selector2","record":"v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCPkb8bu8RGWeJGk3hJrouZXIdZ+HTp/azRp8IUOHp5wKvPUAi/54PwuLscUjRk4Rh3hjIkMpKRfJJXPxWbrT7eMLric7f/S0h+qF4aqIiQqHFCDAYfMnN6V3Wbke2U5EGm0H/cAUYkaf2AtuHJ/rdY/EXaldAm00PgT9QQMez66QIDAQAB;"}],"dkimSelectorsChecked":["google","selector1","selector2","k1","k2","k3","s1","s2","default","dkim","mail","cm","protonmail","zoho","mandrill","pic","fm1","fm2","fm3"]},"limitations":[{"en":"DKIM is limited to common selectors. A miss does not prove the domain never signs."},{"en":"SPF include chains are not expanded. The 10-lookup warning counts mechanisms on this record only."},{"en":"Public DNS reads only. No mail is sent, no mailbox is opened, and no registrar is contacted."}],"dnsProvider":"node"}