krackedretention.com

warnScanned · Sep 6, 2026, 12:38 AM

Summary

krackedretention.com has warnings

0To fix now

3Recommended

4Healthy

DNS & email auth

warnLast checked Sep 6, 2026, 12:38 AM

Findings5 findings

Recommended (3)

The record uses softfail (~all), which is weaker than fail (-all).
SPF
How to fix
Move to -all once you're confident every legitimate sender is listed.
DMARC policy is p=none, so it monitors but does not enforce.
DMARC
How to fix
Once your legitimate senders pass, move to p=quarantine and then p=reject.
The record has no rua= aggregate reporting address, so no one is told when DMARC fails.
DMARC
How to fix
Add rua=mailto:you@example.com to the record to receive daily aggregate reports from receivers.

Healthy (2)

5 MX records found.
MX
DKIM selector google has a healthy RSA key.
DKIM
google (google._domainkey.krackedretention.com)

Evidence

MX

5 records

aspmx.l.google.compriority 1
alt1.aspmx.l.google.compriority 5
alt2.aspmx.l.google.compriority 5
alt3.aspmx.l.google.compriority 10
alt4.aspmx.l.google.compriority 10

SPF

1 of 10 lookups

DNS lookups1 / 10

krackedretention.com

v=spf1 include:_spf.google.com ~all

include:_spf.google.com

v=spf1 ip4:74.125.0.0/16 ip4:209.85.128.0/17 ip6:2001:4860:4864::/56 ip6:2404:6800:4864::/56 ip6:2607:f8b0:4864::/56 ip6:2800:3f0:4864::/56 ip6:2a00:1450:4864::/56 ip6:2c0f:fb50:4864::/56 ~all

Root TXT

1 record

v=spf1 include:_spf.google.com ~all

DKIM selectors

1 record

googlegoogle._domainkey.krackedretention.com
- v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAmBE9TLpByaXMT0tVSeGgqBswbVOiLuawiG/5HSF3dedQEkzGnsF/Ec/8kl3O0acMTaZqDsH1e2q8RoGyusPsh0YoDutc2bNGF4yozwnOqJU2UlEXohn03nEP/Dyf0cDcQsM0Ntx/JsjTE+4YLIrGLwPE0gb5Cmz7HxrGoDGBrnQJLLZ0GnN05CVCXL3XWO9zRrWtA26dsqdTBo5lrs50/3E9yjbolIkTM7hrzTF3ZAl2Az7ZhuquDz/49cD1Ky+QwCyqoZQh8gOT+BEQVW0i52d0pogvyRVEm7gBxLYQ4L/EQ8luIrYdIFcr4ZUXSqYuvn2ivqZzyBzy2WvKcfR8VwIDAQAB

Probed with no records: selector1, selector2, 20230601, 20210112, k1, k2, s1, s2, default, dkim, mail

DMARC

1 record

v=DMARC1; p=none;

v=DMARC1: Identifies this TXT record as a DMARC policy. Must be the first tag.
p=none: Monitoring only: receivers deliver failing mail normally and just send reports.
sp=nonedefault: No sp= tag is published, so subdomains inherit the domain's p= policy.
pct=100default: No pct= tag is published, so the policy applies to all failing mail.
adkim=rdefault: No adkim= tag is published, so DKIM alignment is relaxed: any subdomain of the From domain may sign.
aspf=rdefault: No aspf= tag is published, so SPF alignment is relaxed: the envelope sender may be any subdomain of the From domain.

Raw JSON

{
  "mx": [
    {
      "type": "MX",
      "exchange": "aspmx.l.google.com",
      "priority": 1
    },
    {
      "type": "MX",
      "exchange": "alt1.aspmx.l.google.com",
      "priority": 5
    },
    {
      "type": "MX",
      "exchange": "alt2.aspmx.l.google.com",
      "priority": 5
    },
    {
      "type": "MX",
      "exchange": "alt3.aspmx.l.google.com",
      "priority": 10
    },
    {
      "type": "MX",
      "exchange": "alt4.aspmx.l.google.com",
      "priority": 10
    }
  ],
  "spf": {
    "tree": {
      "via": "root",
      "domain": "krackedretention.com",
      "issues": [],
      "records": [
        "v=spf1 include:_spf.google.com ~all"
      ],
      "children": [
        {
          "via": "include",
          "domain": "_spf.google.com",
          "issues": [],
          "records": [
            "v=spf1 ip4:74.125.0.0/16 ip4:209.85.128.0/17 ip6:2001:4860:4864::/56 ip6:2404:6800:4864::/56 ip6:2607:f8b0:4864::/56 ip6:2800:3f0:4864::/56 ip6:2a00:1450:4864::/56 ip6:2c0f:fb50:4864::/56 ~all"
          ],
          "children": []
        }
      ]
    },
    "truncated": false,
    "lookupCount": 1,
    "voidLookupCount": 0
  },
  "dkim": [
    {
      "cname": [],
      "records": [],
      "selector": "selector1",
      "queryName": "selector1._domainkey.krackedretention.com"
    },
    {
      "cname": [],
      "records": [],
      "selector": "selector2",
      "queryName": "selector2._domainkey.krackedretention.com"
    },
    {
      "cname": [],
      "records": [
        "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAmBE9TLpByaXMT0tVSeGgqBswbVOiLuawiG/5HSF3dedQEkzGnsF/Ec/8kl3O0acMTaZqDsH1e2q8RoGyusPsh0YoDutc2bNGF4yozwnOqJU2UlEXohn03nEP/Dyf0cDcQsM0Ntx/JsjTE+4YLIrGLwPE0gb5Cmz7HxrGoDGBrnQJLLZ0GnN05CVCXL3XWO9zRrWtA26dsqdTBo5lrs50/3E9yjbolIkTM7hrzTF3ZAl2Az7ZhuquDz/49cD1Ky+QwCyqoZQh8gOT+BEQVW0i52d0pogvyRVEm7gBxLYQ4L/EQ8luIrYdIFcr4ZUXSqYuvn2ivqZzyBzy2WvKcfR8VwIDAQAB"
      ],
      "selector": "google",
      "queryName": "google._domainkey.krackedretention.com"
    },
    {
      "cname": [],
      "records": [],
      "selector": "20230601",
      "queryName": "20230601._domainkey.krackedretention.com"
    },
    {
      "cname": [],
      "records": [],
      "selector": "20210112",
      "queryName": "20210112._domainkey.krackedretention.com"
    },
    {
      "cname": [],
      "records": [],
      "selector": "k1",
      "queryName": "k1._domainkey.krackedretention.com"
    },
    {
      "cname": [],
      "records": [],
      "selector": "k2",
      "queryName": "k2._domainkey.krackedretention.com"
    },
    {
      "cname": [],
      "records": [],
      "selector": "s1",
      "queryName": "s1._domainkey.krackedretention.com"
    },
    {
      "cname": [],
      "records": [],
      "selector": "s2",
      "queryName": "s2._domainkey.krackedretention.com"
    },
    {
      "cname": [],
      "records": [],
      "selector": "default",
      "queryName": "default._domainkey.krackedretention.com"
    },
    {
      "cname": [],
      "records": [],
      "selector": "dkim",
      "queryName": "dkim._domainkey.krackedretention.com"
    },
    {
      "cname": [],
      "records": [],
      "selector": "mail",
      "queryName": "mail._domainkey.krackedretention.com"
    }
  ],
  "rootTxt": [
    "v=spf1 include:_spf.google.com ~all"
  ],
  "dmarcTxt": [
    "v=DMARC1; p=none;"
  ]
}

SSL & domain expiry

passLast checked Sep 6, 2026, 12:38 AM

Findings2 findings

Healthy (2)

The TLS certificate is valid until Nov 4, 2026.
TLS certificate
Issued by Google Trust Services.
Registration expiry is not published for this domain.
Domain expiry
The registry does not expose expiry data over RDAP.

Evidence

TLS certificate

port 443

Issued to: krackedretention.com
Issued by: Google Trust Services
Valid from: Aug 6, 2026
Valid until: Nov 4, 2026
Days remaining: 59 days
Verification: trusted

Registration

unpublished

The registry does not expose expiry data over RDAP.

Raw JSON

{
  "tls": {
    "ok": true,
    "issuer": "Google Trust Services",
    "subject": "krackedretention.com",
    "validTo": "2026-11-04T07:19:54.000Z",
    "validFrom": "2026-08-06T06:19:57.000Z",
    "authorized": true,
    "authorizationError": null
  },
  "domainExpiry": {
    "known": false
  },
  "registration": null
}

Generated by Internet Posture · internetposture.com