DNS & email auth

warnLast checked Jul 23, 2026, 6:41 PM

Findings6 findings

Recommended (2)

DKIM selector s2 uses a 1024-bit RSA key.
DKIM
s2 (s2._domainkey.1r.agency)
How to fix
Rotate to an RSA key of at least 2048 bits.
DMARC policy is p=none, so it monitors but does not enforce.
DMARC
How to fix
Once your legitimate senders pass, move to p=quarantine and then p=reject.

Healthy (4)

5 MX records found.
MX
SPF record is valid, using 2 of 10 DNS lookups.
SPF
DKIM selector google has a healthy RSA key.
DKIM
google (google._domainkey.1r.agency)
DKIM selector s1 has a healthy RSA key.
DKIM
s1 (s1._domainkey.1r.agency)

Evidence

MX

5 records

aspmx.l.google.compriority 1
alt1.aspmx.l.google.compriority 5
alt2.aspmx.l.google.compriority 5
alt3.aspmx.l.google.compriority 10
alt4.aspmx.l.google.compriority 10

SPF

2 of 10 lookups

DNS lookups2 / 10

1r.agency

v=spf1 include:_spf.google.com include:50732303.spf04.hubspotemail.net -all

include:_spf.google.com

v=spf1 ip4:74.125.0.0/16 ip4:209.85.128.0/17 ip6:2001:4860:4864::/56 ip6:2404:6800:4864::/56 ip6:2607:f8b0:4864::/56 ip6:2800:3f0:4864::/56 ip6:2a00:1450:4864::/56 ip6:2c0f:fb50:4864::/56 ~all

include:50732303.spf04.hubspotemail.net

v=spf1 ip4:3.93.157.0/24 ip4:3.210.190.0/24 ip4:18.208.124.128/25 ip4:54.174.52.0/24 ip4:54.174.57.0/24 ip4:54.174.59.0/24 ip4:54.174.60.0/23 ip4:54.174.63.0/24 ip4:108.179.144.0/20 ip4:139.180.17.0/24 ip4:141.193.184.32/27 ip4:141.193.184.64/26 ip4:141.193.184.128/25 ip4:141.193.185.32/27 ip4:141.193.185.64/26 ip4:141.193.185.128/25 ip4:143.244.80.0/20 ip4:158.247.16.0/20 ip4:216.139.64.0/19 -all

Root TXT

7 records

bw=2BnRUqDRyCQjHHXiTj56EaZtggjUXxJAcm1B9Z876HNl
google-site-verification=UOKPP8VZzsSfeUH28BAg5Te4Ah4l3CAsCRDM4hmILmI
google-site-verification=n-GG0u_4E7HRJt07xIwlnw2GuutC9VfQpvCxVDoCC10
hubspot-developer-verification=OWJkODM5YTMtYjZlNy00MzgyLWJjYjItZTFjY2QxYzNiYmRh
slack-domain-verification=NFp1k7JZpvUYSoJAGTajTP7ZZun9uusZ8nCOsI5Z
v=spf1 include:_spf.google.com include:50732303.spf04.hubspotemail.net -all
anthropic-domain-verification-0gt9vb=0Rip8DdZ1Ema0AMGlnBiKk0ey

DKIM selectors

3 records

selector1selector1._domainkey.1r.agency
No TXT records returned for this selector.
selector2selector2._domainkey.1r.agency
No TXT records returned for this selector.
googlegoogle._domainkey.1r.agency
- v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAmrleQw+v3cbewYI+y3ztqYY7eRDmdu26+mNymyKlgRcl4AHR5K+3MdbKnhZSire/dIfD/hfYrAX7wHvQe32XHxlRWXUzCU1NA8e8Iw1Q3+IXAqehaDjsbm6sJ6XMNt+wPr1IjvFddv18p2wbOEQpSkkLEl+Xr8wARd0+Z8HtkMwZE9z14cEl9Wkv6tuUWIB6pEnf7lPyPHFq4JtGFsDW7uZUD5kLmhyizy7syPpMjUCEW37LhvF7c1Ib7bK9BCuwwBGOXd/87HrXorqRMIAOmA/75DSlkQeCpo56DDwWssh2/ZKZSF05RWqH8fxDb7B+X7kV17dZzwpCZ+4weecSqwIDAQAB
2023060120230601._domainkey.1r.agency
No TXT records returned for this selector.
2021011220210112._domainkey.1r.agency
No TXT records returned for this selector.
k1k1._domainkey.1r.agency
No TXT records returned for this selector.
k2k2._domainkey.1r.agency
No TXT records returned for this selector.
s1s1._domainkey.1r.agency
CNAME s1.domainkey.u17408163.wl164.sendgrid.net
- k=rsa; t=s; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA11sXvtSLdB64WpSLwxEKXGhuBLtMqsLgqegxXzRYeAPMBmMbuwE8a41B+sNUAQPiXLZ46APhI7IfAKuUFW1EoHmQPbfZHy8Xk8q93vg7O/Hqmf4Ri7m9yoEavxUyS6ncR3pvjCOEGzZSXUD9KevWrsbaShhIe+j+EqUWiiFp1RisI0FCuKhu+b53TsKO2F22RAf66ij4/0fAHgiA/mxpO2vZi3/IOTl4cHKs3opkxOM5tyCfcuVD6S9jqwKtmhfPeiS4aQpHicnfpUw7bTwRRD5LC+YQOc1Hrz/Amz3EXos8ESJL46elGKDzHMjYcryQnS1zs3cVzQ0mMyJvrNwrIwIDAQAB
s2s2._domainkey.1r.agency
CNAME s2.domainkey.u17408163.wl164.sendgrid.net
- k=rsa; t=s; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDhYgJhn5mcnOTLgAZAQxg3+jzSp8d+KS0li4xiudeABhh6XR0cnAtDkrXXkRLgvAB/1Pw9Wx7lFOgFz/ELxrV8PonjQ424gdPzRYp9RnNaOgjEVMXLyRIc/w/Ho+FIN36bZ0pN3mwp752JdWfxoTTdhvx/0iZ0fg3al5VzyFhUOQIDAQAB
defaultdefault._domainkey.1r.agency
No TXT records returned for this selector.
dkimdkim._domainkey.1r.agency
No TXT records returned for this selector.
mailmail._domainkey.1r.agency
No TXT records returned for this selector.

DMARC

1 record

v=DMARC1;  p=none; sp=none; rua=mailto:95e715761b374b57939458670fc66a5b@dmarc-reports.cloudflare.net

v=DMARC1: Identifies this TXT record as a DMARC policy. Must be the first tag.
p=none: Monitoring only: receivers deliver failing mail normally and just send reports.
sp=none: Policy for subdomains, overriding p=. Monitoring only: receivers deliver failing mail normally and just send reports.
rua=mailto:95e715761b374b57939458670fc66a5b@dmarc-reports.cloudflare.net: Receivers send daily aggregate reports about passing and failing mail to 95e715761b374b57939458670fc66a5b@dmarc-reports.cloudflare.net.
pct=100default: No pct= tag is published, so the policy applies to all failing mail.
adkim=rdefault: No adkim= tag is published, so DKIM alignment is relaxed: any subdomain of the From domain may sign.
aspf=rdefault: No aspf= tag is published, so SPF alignment is relaxed: the envelope sender may be any subdomain of the From domain.

Raw JSON

{
  "mx": [
    {
      "type": "MX",
      "exchange": "aspmx.l.google.com",
      "priority": 1
    },
    {
      "type": "MX",
      "exchange": "alt1.aspmx.l.google.com",
      "priority": 5
    },
    {
      "type": "MX",
      "exchange": "alt2.aspmx.l.google.com",
      "priority": 5
    },
    {
      "type": "MX",
      "exchange": "alt3.aspmx.l.google.com",
      "priority": 10
    },
    {
      "type": "MX",
      "exchange": "alt4.aspmx.l.google.com",
      "priority": 10
    }
  ],
  "spf": {
    "tree": {
      "via": "root",
      "domain": "1r.agency",
      "issues": [],
      "records": [
        "v=spf1 include:_spf.google.com include:50732303.spf04.hubspotemail.net -all"
      ],
      "children": [
        {
          "via": "include",
          "domain": "_spf.google.com",
          "issues": [],
          "records": [
            "v=spf1 ip4:74.125.0.0/16 ip4:209.85.128.0/17 ip6:2001:4860:4864::/56 ip6:2404:6800:4864::/56 ip6:2607:f8b0:4864::/56 ip6:2800:3f0:4864::/56 ip6:2a00:1450:4864::/56 ip6:2c0f:fb50:4864::/56 ~all"
          ],
          "children": []
        },
        {
          "via": "include",
          "domain": "50732303.spf04.hubspotemail.net",
          "issues": [],
          "records": [
            "v=spf1 ip4:3.93.157.0/24 ip4:3.210.190.0/24 ip4:18.208.124.128/25 ip4:54.174.52.0/24 ip4:54.174.57.0/24 ip4:54.174.59.0/24 ip4:54.174.60.0/23 ip4:54.174.63.0/24 ip4:108.179.144.0/20 ip4:139.180.17.0/24 ip4:141.193.184.32/27 ip4:141.193.184.64/26 ip4:141.193.184.128/25 ip4:141.193.185.32/27 ip4:141.193.185.64/26 ip4:141.193.185.128/25 ip4:143.244.80.0/20 ip4:158.247.16.0/20 ip4:216.139.64.0/19 -all"
          ],
          "children": []
        }
      ]
    },
    "truncated": false,
    "lookupCount": 2,
    "voidLookupCount": 0
  },
  "dkim": [
    {
      "cname": [],
      "records": [],
      "selector": "selector1",
      "queryName": "selector1._domainkey.1r.agency"
    },
    {
      "cname": [],
      "records": [],
      "selector": "selector2",
      "queryName": "selector2._domainkey.1r.agency"
    },
    {
      "cname": [],
      "records": [
        "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAmrleQw+v3cbewYI+y3ztqYY7eRDmdu26+mNymyKlgRcl4AHR5K+3MdbKnhZSire/dIfD/hfYrAX7wHvQe32XHxlRWXUzCU1NA8e8Iw1Q3+IXAqehaDjsbm6sJ6XMNt+wPr1IjvFddv18p2wbOEQpSkkLEl+Xr8wARd0+Z8HtkMwZE9z14cEl9Wkv6tuUWIB6pEnf7lPyPHFq4JtGFsDW7uZUD5kLmhyizy7syPpMjUCEW37LhvF7c1Ib7bK9BCuwwBGOXd/87HrXorqRMIAOmA/75DSlkQeCpo56DDwWssh2/ZKZSF05RWqH8fxDb7B+X7kV17dZzwpCZ+4weecSqwIDAQAB"
      ],
      "selector": "google",
      "queryName": "google._domainkey.1r.agency"
    },
    {
      "cname": [],
      "records": [],
      "selector": "20230601",
      "queryName": "20230601._domainkey.1r.agency"
    },
    {
      "cname": [],
      "records": [],
      "selector": "20210112",
      "queryName": "20210112._domainkey.1r.agency"
    },
    {
      "cname": [],
      "records": [],
      "selector": "k1",
      "queryName": "k1._domainkey.1r.agency"
    },
    {
      "cname": [],
      "records": [],
      "selector": "k2",
      "queryName": "k2._domainkey.1r.agency"
    },
    {
      "cname": [
        "s1.domainkey.u17408163.wl164.sendgrid.net"
      ],
      "records": [
        "k=rsa; t=s; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA11sXvtSLdB64WpSLwxEKXGhuBLtMqsLgqegxXzRYeAPMBmMbuwE8a41B+sNUAQPiXLZ46APhI7IfAKuUFW1EoHmQPbfZHy8Xk8q93vg7O/Hqmf4Ri7m9yoEavxUyS6ncR3pvjCOEGzZSXUD9KevWrsbaShhIe+j+EqUWiiFp1RisI0FCuKhu+b53TsKO2F22RAf66ij4/0fAHgiA/mxpO2vZi3/IOTl4cHKs3opkxOM5tyCfcuVD6S9jqwKtmhfPeiS4aQpHicnfpUw7bTwRRD5LC+YQOc1Hrz/Amz3EXos8ESJL46elGKDzHMjYcryQnS1zs3cVzQ0mMyJvrNwrIwIDAQAB"
      ],
      "selector": "s1",
      "queryName": "s1._domainkey.1r.agency"
    },
    {
      "cname": [
        "s2.domainkey.u17408163.wl164.sendgrid.net"
      ],
      "records": [
        "k=rsa; t=s; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDhYgJhn5mcnOTLgAZAQxg3+jzSp8d+KS0li4xiudeABhh6XR0cnAtDkrXXkRLgvAB/1Pw9Wx7lFOgFz/ELxrV8PonjQ424gdPzRYp9RnNaOgjEVMXLyRIc/w/Ho+FIN36bZ0pN3mwp752JdWfxoTTdhvx/0iZ0fg3al5VzyFhUOQIDAQAB"
      ],
      "selector": "s2",
      "queryName": "s2._domainkey.1r.agency"
    },
    {
      "cname": [],
      "records": [],
      "selector": "default",
      "queryName": "default._domainkey.1r.agency"
    },
    {
      "cname": [],
      "records": [],
      "selector": "dkim",
      "queryName": "dkim._domainkey.1r.agency"
    },
    {
      "cname": [],
      "records": [],
      "selector": "mail",
      "queryName": "mail._domainkey.1r.agency"
    }
  ],
  "rootTxt": [
    "bw=2BnRUqDRyCQjHHXiTj56EaZtggjUXxJAcm1B9Z876HNl",
    "google-site-verification=UOKPP8VZzsSfeUH28BAg5Te4Ah4l3CAsCRDM4hmILmI",
    "google-site-verification=n-GG0u_4E7HRJt07xIwlnw2GuutC9VfQpvCxVDoCC10",
    "hubspot-developer-verification=OWJkODM5YTMtYjZlNy00MzgyLWJjYjItZTFjY2QxYzNiYmRh",
    "slack-domain-verification=NFp1k7JZpvUYSoJAGTajTP7ZZun9uusZ8nCOsI5Z",
    "v=spf1 include:_spf.google.com include:50732303.spf04.hubspotemail.net -all",
    "anthropic-domain-verification-0gt9vb=0Rip8DdZ1Ema0AMGlnBiKk0ey"
  ],
  "dmarcTxt": [
    "v=DMARC1;  p=none; sp=none; rua=mailto:95e715761b374b57939458670fc66a5b@dmarc-reports.cloudflare.net"
  ]
}

Recommended (2)

DKIM selector s2 uses a 1024-bit RSA key.

DMARC policy is p=none, so it monitors but does not enforce.

Healthy (4)

5 MX records found.

SPF record is valid, using 2 of 10 DNS lookups.

DKIM selector google has a healthy RSA key.

DKIM selector s1 has a healthy RSA key.

Evidence

MX

SPF

Root TXT

DKIM selectors

DMARC