Monitor this domain

DNS & email auth

warnLast checked
Findings9 findings

  • 1 MX record found.

  • The record uses 8 of 10 allowed DNS lookups.

    Adding another sender could push it over the limit and break SPF entirely.

  • The record uses the ptr mechanism, which is deprecated, slow, and unreliable.

    Replace ptr with ip4/ip6 networks or an include.

  • DKIM selector google uses a 1024-bit RSA key.

    google (google._domainkey.zyber.co.nz); use at least 2048 bits.

  • DKIM selector k1 uses a 1024-bit RSA key.

    k1 (k1._domainkey.zyber.co.nz); use at least 2048 bits.

  • DKIM selector dkim has a healthy RSA key.

    dkim (dkim._domainkey.zyber.co.nz)

  • The policy only applies to 50% of failing mail (pct=50).

    The rest is treated one policy level weaker. Remove pct or set it to 100 once you trust the policy.

  • Subdomains use the weaker sp=none while the domain enforces p=quarantine.

    Spoofers can target any subdomain, e.g. invoices.yourdomain.com. Remove sp= or match it to p=.

  • DMARC policy is enforced with p=quarantine.

Raw evidence

MX

1 record
  • smtp.google.compriority 1

Root TXT

7 records
  • klaviyo-site-verification=TKH5hX
  • v=spf1 mx a ptr ip4:54.206.86.44/24 ip4:54.206.115.209/24 ip4:54.206.75.62/24 ip4:54.206.98.181/24 ip4:54.206.76.212/24 include:_spf.google.com include:sendgrid.net include:5470661.spf04.hubspotemail.net include:md02.com -all
  • MS=ms53557338
  • atlassian-domain-verification=rSGXun851B4J8720gpcubadaa7IFSTSyFOLODyQ8gFosXRRBuoFZqyKhOevb4slD
  • globalsign-domain-verification=zfCNvJt0iTcEchLrE0nrimsdl4h4m4zVTSJYOcrlcJ
  • google-site-verification=7Nz2E3Q4diJpz43jnC-cYeIgrD6siugm9T3TLvHr42Y
  • google-site-verification=siej40fio1xoktvptpqw73ilgbsrcinj2rgkjgpu0mo

DKIM selectors

3 records
  • selector1selector1._domainkey.zyber.co.nz

    No TXT records returned for this selector.

  • selector2selector2._domainkey.zyber.co.nz

    No TXT records returned for this selector.

  • googlegoogle._domainkey.zyber.co.nz
    • v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC4TWnDmUgQ2jup4LwV9VFMm9mIIWvZh8F/w/CBnINUX7pLkFYtBRQjIdE48ZWk3q7MaS9C9iFzKyPkaHNS4ozksRzbCKrZ2g3YCI5MGZwx3m9UY1BmGFSSb1PJ5QCmwTUze7PyWsevpHxDG8Du/vVNj/nXbrZi/8wbyl897NQlBwIDAQAB
  • 2023060120230601._domainkey.zyber.co.nz

    No TXT records returned for this selector.

  • 2021011220210112._domainkey.zyber.co.nz

    No TXT records returned for this selector.

  • k1k1._domainkey.zyber.co.nz
    CNAME dkim.mcsv.net
    • k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDbNrX2cY/GUKIFx2G/1I00ftdAj713WP9AQ1xir85i89sA2guU0ta4UX1Xzm06XIU6iBP41VwmPwBGRNofhBVR+e6WHUoNyIR4Bn84LVcfZE20rmDeXQblIupNWBqLXM1Q+VieI/eZu/7k9/vOkLSaQQdml4Cv8lb3PcnluMVIhQIDAQAB;
  • k2k2._domainkey.zyber.co.nz

    No TXT records returned for this selector.

  • s1s1._domainkey.zyber.co.nz
    CNAME sg1.v4689923.c308453563.e.marketingautomation.services

    No TXT records returned for this selector.

  • s2s2._domainkey.zyber.co.nz
    CNAME sg2.v4689923.c308453563.e.marketingautomation.services

    No TXT records returned for this selector.

  • defaultdefault._domainkey.zyber.co.nz

    No TXT records returned for this selector.

  • dkimdkim._domainkey.zyber.co.nz
    CNAME dkim._domainkey.md02.com
    • v=DKIM1;k=rsa;p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu2gAtnNzEfzNxLKMcfPJuuFoocS/mMTkSMoCz0ClygNC7Ojqc3aXw1GW+NAIGO9M62EX+lfWTt+/4Eksdn7NovdR0FbjfDOrTlVAeaePwXB1S/kNBpOEk/4vTDYW3oam2uSm2GTMiQRMlj1vYKx/wG5jAjHyWNMblyOTYXsSd3iz4vjGEDsZMZplaAZX+Tkx3eAsCoDAPLEmsOFhLIm570WCAYwtXErPMhR6XcDzKpleN7f9koc5zcupX/pHalnWsIHTdSEcrJ9NNkXE9ZOllTz/9cjkZJu28UN/XRczjfrF6zuuBm+QkY2qHxU9edT3YUM1CqX6terkmxGUxVOLtwIDAQAB
  • mailmail._domainkey.zyber.co.nz

    No TXT records returned for this selector.

DMARC TXT

1 record
  • v=DMARC1; p=quarantine; rua=mailto:webmaster@zyber.co.nz; pct=50; sp=none