5.2
of 10
Anti-Spoofing Audit · gmail.com
Risk: Medium
Some protections are in place, but spoofers can still slip through.
Reporting only — spoofers are observed but not blocked. Move p to quarantine/reject.
SPF (weight 3) Must end with -all
WARN · 1/2
v=spf1 redirect=_spf.google.com
- SPF record is present.
- No "all" mechanism — SPF is incomplete.
Fix:End your SPF with "-all" and keep DNS lookups ≤ 10.
DMARC (weight 5) Must enforce p=reject
WARN · 2.2/3
v=DMARC1; p=none; sp=quarantine; rua=mailto:[email protected]
| v | DMARC1 |
|---|---|
| p | none |
| sp | quarantine |
| rua | mailto:[email protected] |
- DMARC record is present.
- Policy p=none — monitoring only, no enforcement.
- Aggregate reporting (rua) configured.
- Explicit subdomain policy sp=quarantine.
Fix:Move from p=none to p=quarantine (and later p=reject) once aligned.
DKIM (weight 2) Active signing key
FAIL · 0/2
- No DKIM record found from common selectors. Outgoing mail cannot be cryptographically signed.
- Note: DKIM uses custom selectors — your provider may use a non-standard name.
Fix:Ask your mail provider for the DKIM selector and public key, then publish it as TXT <selector>._domainkey.gmail.com
