Skip to content
Signet
Start free

github.com

Receivers are told to send to spam mail that fails authentication for this domain.

Partial enforcement

Forged mail is being filtered to spam rather than rejected, or the policy applies to only a share of messages. Most of the protection is there; the last step is not.

Score held up: DMARC is enforcing at p=quarantine, so nobody else can send as this domain. That is the hard part, and it is done. What is left below is about your own mail arriving, not about anyone spoofing you.

137 DNS queries · 1093 ms

Fix these first
  1. 1
    Could not verify DKIM signing for Adobe Marketo
    Confirm DKIM is switched on in Adobe Marketo, then add your selector here so every future scan can verify it directly.
  2. 2
    Could not verify DKIM signing for Salesforce Marketing Cloud
    Confirm DKIM is switched on in Salesforce Marketing Cloud, then add your selector here so every future scan can verify it directly.
  3. 3
    Selector 'k1' uses a 1024-bit RSA key
    Rotate to 2048-bit at your next key rotation.
  4. 4
    Selector 'selector1' uses a 1024-bit RSA key
    Rotate to 2048-bit at your next key rotation.

Identity ·Sending services detected

Read from your SPF includes and MX hosts, then checked for a published DKIM key.

Adobe MarketoSPF include:mktomail.comno DKIM key at its selectors
Google WorkspaceSPF include:_netblocks.google.com · SPF include:_netblocks2.google.comkey published · google
MailchimpSPF include:servers.mcsv.netkey published · k1, k2, k3
Microsoft 365SPF include:spf.protection.outlook.com · MX github-com.mail.protection.outlook.comkey published · selector1
Salesforce Marketing CloudSPF include:_spf.salesforce.comno DKIM key at its selectors
Twilio SendGridSPF include:sendgrid.netkey published · s1, s2, smtpapi
ZendeskSPF include:mail.zendesk.comkey published · zendesk1, zendesk2

Identity ·DMARC

v=DMARC1; p=quarantine; sp=reject; pct=100; rua=mailto:[email protected]; ruf=mailto:[email protected]; fo=1
Policy
quarantine
Coverage
100%
Alignment
dkim=r spf=r

Identity ·DKIM

111 selectors probed

googleGoogle WorkspaceRSA 2048
k1Mailchimp / MailgunRSA 1024
k2MailchimpRSA 2048
k3MailchimpRSA 2048
selector1Microsoft 365RSA 1024
s1SendGridRSA 2048
s2SendGridRSA 2048
smtpapiSendGridRSA 1024
zendesk1ZendeskRSA 2048
zendesk2ZendeskRSA 2048
mailoMailgunRSA 1024

Identity ·SPF

Worst-case evaluation across every include.

v=spf1 ip4:192.30.252.0/22 include:spf.protection.outlook.com include:_netblocks.google.com include:_netblocks2.google.com include:mail.zendesk.com include:_spf.salesforce.com include:servers.mcsv.net include:mktomail.com include:sendgrid.net ip4:62.253.227.114 ip4:166.78.69.169 ip4:166.78.69.170 ip4:166.78.71.131 ~all
DNS lookup budget10 / 10
  • include:spf.protection.outlook.com
  • include:_netblocks.google.com
  • include:_netblocks2.google.com
  • include:mail.zendesk.com
  • include:_spf.salesforce.com
  • include:servers.mcsv.net
  • include:mktomail.com
  • include:sendgrid.net
  • include:ab.sendgrid.net

Findings (14)

MediumDMARC policy is p=quarantine›

Failing mail is delivered to spam rather than rejected. A meaningful improvement over none, but spoofed mail still reaches the recipient's mailbox.

What to do

Move to p=reject once reports show no legitimate mail failing.

MediumSPF uses exactly the full lookup budget (10/10)›

The record is legal but has zero headroom. If any provider in your include tree adds a single lookup on their side, your SPF silently starts returning permerror and stops authorising your mail.

What to do

Reclaim headroom now by removing unused includes or replacing one with the ip4/ip6 ranges it resolves to.

RFC 7208 s4.6.4

MediumCould not verify DKIM signing for Adobe Marketo›

Adobe Marketo was detected via SPF include:mktomail.com, so it is authorised to send mail as github.com. We checked the selectors it uses by default (m1, mktomail) and found no key. Adobe Marketo lets you choose your own selector name, so this may simply mean yours is custom. If signing genuinely is not enabled, mail through this service will fail DMARC once forwarded.

What to do

Confirm DKIM is switched on in Adobe Marketo, then add your selector here so every future scan can verify it directly.

RFC 6376

MediumCould not verify DKIM signing for Salesforce Marketing Cloud›

Salesforce Marketing Cloud was detected via SPF include:_spf.salesforce.com, so it is authorised to send mail as github.com. We checked the selectors it uses by default (sfmc1, sfmc2, exacttarget) and found no key. Salesforce Marketing Cloud lets you choose your own selector name, so this may simply mean yours is custom. If signing genuinely is not enabled, mail through this service will fail DMARC once forwarded.

What to do

Confirm DKIM is switched on in Salesforce Marketing Cloud, then add your selector here so every future scan can verify it directly.

RFC 6376

MediumSelector 'k1' uses a 1024-bit RSA key›

1024-bit is the RFC 8301 floor, not a good target. 2048-bit is the current recommendation and is universally supported.

What to do

Rotate to 2048-bit at your next key rotation.

RFC 8301

MediumSelector 'selector1' uses a 1024-bit RSA key›

1024-bit is the RFC 8301 floor, not a good target. 2048-bit is the current recommendation and is universally supported.

What to do

Rotate to 2048-bit at your next key rotation.

RFC 8301

MediumSelector 'smtpapi' uses a 1024-bit RSA key›

1024-bit is the RFC 8301 floor, not a good target. 2048-bit is the current recommendation and is universally supported.

What to do

Rotate to 2048-bit at your next key rotation.

RFC 8301

MediumSelector 'mailo' uses a 1024-bit RSA key›

1024-bit is the RFC 8301 floor, not a good target. 2048-bit is the current recommendation and is universally supported.

What to do

Rotate to 2048-bit at your next key rotation.

RFC 8301

LowSPF ends in '~all' (softfail)›

Softfail is the correct setting while you are still discovering senders, but it asks receivers to accept unauthorised mail and merely note it.

What to do

Once your aggregate reports show no unexplained legitimate sources, tighten to '-all'.

LowNo MTA-STS policy›

Without MTA-STS, mail to your domain can be downgraded to plaintext by an active network attacker, because SMTP's STARTTLS is opportunistic by default.

What to do

Publish a TXT record at _mta-sts.github.com and a policy file at https://mta-sts.github.com/.well-known/mta-sts.txt.

RFC 8461

LowNo TLS-RPT record›

Sending servers have no address to report TLS failures on mail to your domain, so transport problems stay invisible to you until someone complains.

What to do

Publish 'v=TLSRPTv1; rua=mailto:<address>' at _smtp._tls.github.com.

RFC 8460

LowCAA has no reporting address›

You have restricted which authorities may issue certificates, but nobody is told when one refuses a request. An iodef address turns an attempted mis-issuance into an alert instead of a silent event.

What to do

Add a record such as: 0 iodef "mailto:[email protected]"

RFC 8659

InfoEligible for BIMI›

Your DMARC policy is already enforcing, which is the hard prerequisite for BIMI. Publishing a logo is now largely a branding exercise.

What to do

Publish an SVG Tiny PS logo plus a VMC, then add a default._bimi record.

InfoZone is not signed with DNSSEC›

This is the common case and not a misconfiguration -- most working mail domains are unsigned. It is worth knowing because your authentication records are only as trustworthy as the DNS answers carrying them, and because DNSSEC is the prerequisite for DANE.

What to do

If your DNS provider supports one-click DNSSEC, enabling it is low risk. If it does not, this is not worth changing providers over.

RFC 4033

Show 15 passing checks
PassAggregate reporting is configured›

Aggregate reports are requested at: [email protected].

PassGoogle Workspace's DKIM key is published at google._domainkey›

Detected via SPF include:_netblocks.google.com, SPF include:_netblocks2.google.com. A valid public key for this service is published at google._domainkey.github.com.

PassMailchimp's DKIM keys are published at k1._domainkey, k2._domainkey, k3._domainkey›

Detected via SPF include:servers.mcsv.net. A valid public key for this service is published at k1._domainkey.github.com, k2._domainkey.github.com, k3._domainkey.github.com.

PassMicrosoft 365's DKIM key is published at selector1._domainkey›

Detected via SPF include:spf.protection.outlook.com, MX github-com.mail.protection.outlook.com. A valid public key for this service is published at selector1._domainkey.github.com.

PassTwilio SendGrid's DKIM keys are published at s1._domainkey, s2._domainkey, smtpapi._domainkey›

Detected via SPF include:sendgrid.net. A valid public key for this service is published at s1._domainkey.github.com, s2._domainkey.github.com, smtpapi._domainkey.github.com.

PassZendesk's DKIM keys are published at zendesk1._domainkey, zendesk2._domainkey›

Detected via SPF include:mail.zendesk.com. A valid public key for this service is published at zendesk1._domainkey.github.com, zendesk2._domainkey.github.com.

Pass11 DKIM key(s) published›

Found at: google, k1, k2, k3, mailo, s1, s2, selector1, smtpapi, zendesk1, zendesk2.

PassSelector 'google' uses a 2048-bit RSA key›

Key length meets current guidance.

PassSelector 'k2' uses a 2048-bit RSA key›

Key length meets current guidance.

PassSelector 'k3' uses a 2048-bit RSA key›

Key length meets current guidance.

PassSelector 's1' uses a 2048-bit RSA key›

Key length meets current guidance.

PassSelector 's2' uses a 2048-bit RSA key›

Key length meets current guidance.

PassSelector 'zendesk1' uses a 2048-bit RSA key›

Key length meets current guidance.

PassSelector 'zendesk2' uses a 2048-bit RSA key›

Key length meets current guidance.

PassCertificate issuance is restricted by CAA›

Only digicert.com, globalsign.com, letsencrypt.org, sectigo.com may issue certificates for this domain, so a certificate for your mail hosts or your MTA-STS policy endpoint from any other authority would be a mis-issuance. Wildcard certificates are limited separately, to digicert.com, letsencrypt.org, sectigo.com.

RFC 8659

Transport and zone

Where your mail lands, and whether the DNS carrying your records can be trusted.

MXgithub-com.mail.protection.outlook.com
Reverse DNSforward-confirmed on every host
MTA-STSnot published
TLS-RPTnot published
BIMInot published
DNSSECzone not signedCommon and not a misconfiguration.
CAAdigicert.com, globalsign.com, letsencrypt.org, sectigo.com · wildcard: digicert.com, letsencrypt.org, sectigo.com
DANEno TLSA records

This is the configuration. It is not the whole picture.

A DNS scan cannot tell you whether github.com’s mail actually aligns, because alignment is decided per message at the receiver. Collect DMARC aggregate reports to see every source sending as this domain.

Watch this domain, freeCheck another domain
github.com scores B for SPF, DKIM and DMARC · Signet