{
    "preset": "antispoof",
    "tool": "",
    "host": "gmail.com",
    "error": null,
    "result": {
        "preset": "antispoof",
        "title": "Anti-Spoofing Audit",
        "domain": "gmail.com",
        "score": 5.2,
        "max": 10,
        "risk": "Medium",
        "risk_msg": "Some protections are in place, but spoofers can still slip through.",
        "verdict": "Reporting only \u2014 spoofers are observed but not blocked. Move p to quarantine/reject.",
        "checks": [
            {
                "key": "spf",
                "label": "SPF (weight 3)",
                "desc": "Must end with -all",
                "data": {
                    "status": "warn",
                    "score": 1,
                    "max": 2,
                    "record": "v=spf1 redirect=_spf.google.com",
                    "notes": [
                        "SPF record is present.",
                        "No \"all\" mechanism \u2014 SPF is incomplete."
                    ],
                    "lookups": 1,
                    "fix": "End your SPF with \"-all\" and keep DNS lookups \u2264 10."
                },
                "weighted": 1.5,
                "weight_max": 3
            },
            {
                "key": "dmarc",
                "label": "DMARC (weight 5)",
                "desc": "Must enforce p=reject",
                "data": {
                    "status": "warn",
                    "score": 2.2,
                    "max": 3,
                    "record": "v=DMARC1; p=none; sp=quarantine; rua=mailto:mailauth-reports@google.com",
                    "tags": {
                        "v": "DMARC1",
                        "p": "none",
                        "sp": "quarantine",
                        "rua": "mailto:mailauth-reports@google.com"
                    },
                    "notes": [
                        "DMARC record is present.",
                        "Policy p=none \u2014 monitoring only, no enforcement.",
                        "Aggregate reporting (rua) configured.",
                        "Explicit subdomain policy sp=quarantine."
                    ],
                    "fix": "Move from p=none to p=quarantine (and later p=reject) once aligned."
                },
                "weighted": 3.7,
                "weight_max": 5
            },
            {
                "key": "dkim",
                "label": "DKIM (weight 2)",
                "desc": "Active signing key",
                "data": {
                    "status": "fail",
                    "score": 0,
                    "max": 2,
                    "record": null,
                    "selectors": [],
                    "notes": [
                        "No DKIM record found from common selectors. Outgoing mail cannot be cryptographically signed.",
                        "Note: DKIM uses custom selectors \u2014 your provider may use a non-standard name."
                    ],
                    "fix": "Ask your mail provider for the DKIM selector and public key, then publish it as TXT <selector>._domainkey.gmail.com"
                },
                "weighted": 0,
                "weight_max": 2
            }
        ]
    }
}