CHECK RESULT
microsoft.com
The four records are largely in place. Tighten any remaining soft spot.
100
/ 100
30 + 25 + 30 + 15 = 100
2026-10-20T13:19:38.720Z · Node DNS (1.1.1.1 / 8.8.8.8)
Fix first
Nothing urgent. Details for each category are below.
spfWho may send
30/30 · Pass
SPF uses hardfail (-all)
Unauthorized servers are explicitly rejected. When you add a sender, edit this record instead of publishing a second one.
dkimSignature key
25/25 · Pass
DKIM public key found
At least one common selector publishes a non-empty key: selector2. The signature s= must be one of these, and d= must be this domain.
dmarcFailure policy
30/30 · Pass
DMARC policy is reject
Mail that fails alignment should be rejected. Before you change sending services, add them to SPF and sign with DKIM.
mxWhere bounces go
15/15 · Pass
MX records look usable
The lowest preference is microsoft-com.mail.protection.outlook.com (10). Confirm that host actually accepts mail.
Records we saw
- SPF
- v=spf1 include:_spf-a.microsoft.com include:_spf-b.microsoft.com include:_spf-c.microsoft.com include:_spf-ssg-a.msft.net include:_spf1-meo.microsoft.com -all
- DMARC
- v=DMARC1; p=reject; pct=100; rua=mailto:itex-rua@microsoft.com; ruf=mailto:itex-ruf@microsoft.com; fo=1
- MX
- 10 microsoft-com.mail.protection.outlook.com
- DKIM
- selector2: v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCPkb8bu8RGWeJGk3hJrouZXIdZ+HTp/azRp8IUOHp5wKvPUAi/54PwuLscUjRk4Rh3hjIkMpKRfJJXPxWbrT7eMLric7f/S0h+qF4aqIiQqHFCDAYfMnN6V3Wbke2U5EGm0H/cAUYkaf2AtuHJ/rdY/EXaldAm00PgT9QQMez66QIDAQAB;
What this check does not do
- DKIM is limited to common selectors. A miss does not prove the domain never signs.
- SPF include chains are not expanded. The 10-lookup warning counts mechanisms on this record only.
- Public DNS reads only. No mail is sent, no mailbox is opened, and no registrar is contacted.