wordpress.com
Receivers are told to reject mail that fails authentication for this domain.
Receivers are told to reject mail that fails authentication for this domain. Keep watching aggregate reports so a new sending service does not silently start failing.
Score held up: DMARC is enforcing at p=reject, so nobody else can send as this domain. That is the hard part, and it is done. What is left below is about your own mail arriving, not about anyone spoofing you -- and some of it may be costing you delivery.
143 DNS queries · 1180 ms
- 1Twilio SendGrid can send as your domain but publishes no DKIM keyEnable DKIM signing in Twilio SendGrid and publish the public key it gives you. Setup guide: https://www.twilio.com/docs/sendgrid/ui/account-and-settings/dkim-records
- 2p=reject may be costing you mail from 1 of your own sendersBest: turn DKIM signing on at Twilio SendGrid and publish the key -- that fixes it without weakening anything, and the findings above link each provider's own guide. If it will take weeks and mail is already going missing, moving to p=none while you fix it is not a defeat: an enforcing policy you cannot support is worse than an honest monitoring one. Either way you are guessing until aggregate reports tell you which senders are actually affected and how much mail is involved.
- 3SPF is close to the lookup limit (8/10)Trim unused senders now, before a provider's change pushes you over.
- 4Selector 'k1' uses a 1024-bit RSA keyRotate to 2048-bit at your next key rotation.
Identity ·Sending services detected
Read from your SPF includes and MX hosts, then checked for a published DKIM key.
Identity ·DMARC
- Policy
- reject
- Coverage
- 100%
- Alignment
- dkim=r spf=r
Identity ·DKIM
113 selectors probed
k1Mailchimp / MailgunRSA 1024k2MailchimpRSA 2048k3MailchimpRSA 2048zendesk1ZendeskRSA 2048zendesk2ZendeskRSA 2048mandrillMailchimp TransactionalRSA 1024m1MarketoRSA 1024Identity ·SPF
Worst-case evaluation across every include.
- include:_spf.automattic.com
- include:servers.mcsv.net
- include:_spf-wwd.automattic.com
- include:mail.zendesk.com
- include:sendgrid.net
- include:ab.sendgrid.net
- include:145630858.spf04.hubspotemail.net
- include:amazonses.com
Findings (13)
HighTwilio SendGrid can send as your domain but publishes no DKIM key›
Twilio SendGrid was detected via SPF include:sendgrid.net, so it is authorised to send mail as wordpress.com. It always publishes DKIM at fixed selectors (s1, s2, smtpapi), and none of them has a key published. Without one, no DKIM signature it adds for your domain can verify, so its mail has only SPF to align on -- and SPF does not survive forwarding.
Enable DKIM signing in Twilio SendGrid and publish the public key it gives you. Setup guide: https://www.twilio.com/docs/sendgrid/ui/account-and-settings/dkim-records
RFC 6376
Highp=reject may be costing you mail from 1 of your own senders›
Being at p=reject is the right place to be, and reaching it is the hard part -- nobody else can send as wordpress.com. The problem is that Twilio SendGrid is authorised to send as this domain and publishes no DKIM key, so that mail has only SPF behind it. SPF does not survive forwarding, and a receiver honouring your policy will have it rejected. Nothing here lets anyone else in; it is your own mail at risk.
Best: turn DKIM signing on at Twilio SendGrid and publish the key -- that fixes it without weakening anything, and the findings above link each provider's own guide. If it will take weeks and mail is already going missing, moving to p=none while you fix it is not a defeat: an enforcing policy you cannot support is worse than an honest monitoring one. Either way you are guessing until aggregate reports tell you which senders are actually affected and how much mail is involved.
MediumSPF is close to the lookup limit (8/10)›
You have little headroom. Providers change their own include trees without notice, so a record at 8 or 9 lookups can break without you touching it.
Trim unused senders now, before a provider's change pushes you over.
RFC 7208 s4.6.4
MediumSelector 'k1' uses a 1024-bit RSA key›
1024-bit is the RFC 8301 floor, not a good target. 2048-bit is the current recommendation and is universally supported.
Rotate to 2048-bit at your next key rotation.
RFC 8301
MediumSelector 'mandrill' uses a 1024-bit RSA key›
1024-bit is the RFC 8301 floor, not a good target. 2048-bit is the current recommendation and is universally supported.
Rotate to 2048-bit at your next key rotation.
RFC 8301
MediumSelector 'm1' uses a 1024-bit RSA key›
1024-bit is the RFC 8301 floor, not a good target. 2048-bit is the current recommendation and is universally supported.
Rotate to 2048-bit at your next key rotation.
RFC 8301
LowNo explicit subdomain policy (sp=)›
Subdomains inherit p=, which is usually what you want. Setting 'sp=reject' explicitly protects unused subdomains even while the parent is still at p=none.
Consider adding 'sp=reject' if no subdomain sends mail.
LowNo MTA-STS policy›
Without MTA-STS, mail to your domain can be downgraded to plaintext by an active network attacker, because SMTP's STARTTLS is opportunistic by default.
Publish a TXT record at _mta-sts.wordpress.com and a policy file at https://mta-sts.wordpress.com/.well-known/mta-sts.txt.
RFC 8461
LowNo TLS-RPT record›
Sending servers have no address to report TLS failures on mail to your domain, so transport problems stay invisible to you until someone complains.
Publish 'v=TLSRPTv1; rua=mailto:<address>' at _smtp._tls.wordpress.com.
RFC 8460
LowBIMI has no Verified Mark Certificate›
Gmail requires a VMC (the a= tag) before it will display a BIMI logo. Without one, only a handful of receivers will show it.
Obtain a VMC from an authorised issuer and add it as the a= tag.
InfoAmazon SES uses selectors we cannot discover›
Detected via SPF include:amazonses.com. SES generates a random per-identity selector when Easy DKIM is enabled, so it cannot be discovered from DNS. Check the SES console for your selector. We cannot confirm or rule out DKIM signing for this service from DNS alone.
Add your Amazon SES selector so we can verify it on every scan.
InfoHubSpot uses selectors we cannot discover›
Detected via SPF include:145630858.spf04.hubspotemail.net. HubSpot selectors include a per-portal id (hs1-12345678._domainkey), so they cannot be guessed. Copy yours from the HubSpot DNS setup screen. We cannot confirm or rule out DKIM signing for this service from DNS alone.
Add your HubSpot selector so we can verify it on every scan.
InfoZone is not signed with DNSSEC›
This is the common case and not a misconfiguration -- most working mail domains are unsigned. It is worth knowing because your authentication records are only as trustworthy as the DNS answers carrying them, and because DNSSEC is the prerequisite for DANE.
If your DNS provider supports one-click DNSSEC, enabling it is low risk. If it does not, this is not worth changing providers over.
RFC 4033
Show 13 passing checks
PassAggregate reporting is configured›
Aggregate reports are requested at: [email protected].
PassExternal report destination ag.dmarcian.com is correctly authorised›
Authorised by wordpress.com._report._dmarc.ag.dmarcian.com
PassExternal report destination fr.dmarcian.com is correctly authorised›
Authorised by wordpress.com._report._dmarc.fr.dmarcian.com
PassDMARC policy is p=reject›
Mail failing authentication is rejected outright. This is the correct end state.
PassSPF ends in '-all' (hard fail)›
Unauthorised hosts are explicitly rejected. This is the correct end state.
PassMailchimp's DKIM keys are published at k1._domainkey, k2._domainkey, k3._domainkey›
Detected via SPF include:servers.mcsv.net. A valid public key for this service is published at k1._domainkey.wordpress.com, k2._domainkey.wordpress.com, k3._domainkey.wordpress.com.
PassZendesk's DKIM keys are published at zendesk1._domainkey, zendesk2._domainkey›
Detected via SPF include:mail.zendesk.com. A valid public key for this service is published at zendesk1._domainkey.wordpress.com, zendesk2._domainkey.wordpress.com.
Pass7 DKIM key(s) published›
Found at: k1, k2, k3, m1, mandrill, zendesk1, zendesk2.
PassSelector 'k2' uses a 2048-bit RSA key›
Key length meets current guidance.
PassSelector 'k3' uses a 2048-bit RSA key›
Key length meets current guidance.
PassSelector 'zendesk1' uses a 2048-bit RSA key›
Key length meets current guidance.
PassSelector 'zendesk2' uses a 2048-bit RSA key›
Key length meets current guidance.
PassCertificate issuance is restricted by CAA›
Only letsencrypt.org may issue certificates for this domain, so a certificate for your mail hosts or your MTA-STS policy endpoint from any other authority would be a mis-issuance. Wildcard certificates are limited separately, to letsencrypt.org.
RFC 8659
Transport and zone
Where your mail lands, and whether the DNS carrying your records can be trusted.
This is the configuration. It is not the whole picture.
A DNS scan cannot tell you whether wordpress.com’s mail actually aligns, because alignment is decided per message at the receiver. Collect DMARC aggregate reports to see every source sending as this domain.