What Requires Attention
The BIG Questions
Domain Overview
Technical Findings
Email Authentication
Mail Transport Security
DNS Security
Brand & Certificate Controls
Priority Actions 5 total Achievable: Low Risk
Publish an MTA-STS DNS record and host a policy file at https://mta-sts.fbi.gov/.well-known/mta-sts.txt. This tells senders to require TLS when delivering mail to your domain.
DKIM selectors were not discoverable via common selector names. This does not confirm DKIM is absent — your provider may use custom or rotating selectors that cannot be enumerated through DNS (RFC 6376 §3.6.2.1). Check your email provider's DKIM settings to confirm signing is enabled.
TLS-RPT (TLS Reporting) sends you reports about TLS connection failures when other servers try to deliver mail to your domain. Helps diagnose MTA-STS and STARTTLS issues.
DNSSEC is already enabled — you can strengthen email transport security by publishing DANE TLSA records. DANE binds your mail server's TLS certificate to DNS, preventing man-in-the-middle attacks on SMTP connections.
Publish a BIMI DNS record pointing to your brand logo (SVG Tiny PS format). For full support in Gmail, you will also need a Verified Mark Certificate (VMC).
Appendix — Additional Resources
Full technical details including raw DNS records, DKIM public keys, IP/ASN mappings, resolver consensus evidence, and verification commands are available in the Engineer's DNS Intelligence Report.
Verify Report Integrity SHA-3-512 Has this report been tampered with? Verify below
Tamper-evident fingerprint binding this analysis to its data, domain, timestamp, and tool version.
458742d3abf489d2d33355640ec92c5a8d894c2bf5aa80ad001c4d96599c658b1ce0d4d28130ccd5084c84bb12231438eb5c0e6acc7ac172f12b16290e52ee3f