Monitor types
Email security monitors (SPF, DKIM, DMARC)
How FastPing grades your SPF, DKIM, DMARC, MTA-STS and TLS-RPT records, warns below your minimum score and alerts you when the records change.
- API type
email- You enter
- Hostname or IP
- Runs at most every
- 6 hours
- Needs
- None
FastPing reads these DNS records for your domain:
- MX records, and the TXT records at the domain itself (SPF);
_dmarc.example.com(DMARC),_mta-sts.example.com(MTA-STS),_smtp._tls.example.com(TLS-RPT) anddefault._bimi.example.com(BIMI);- DKIM keys at
<selector>._domainkey.example.comfor common selectors (default,google,selector1,selector2,k1,k2,mail,dkim,s1,s2,smtp,mandrill,mxvault,zoho,protonmail,fm1,sig1) plus the selector you enter.
It starts from 100 points, deducts points for each problem and turns the score into a grade. The monitor is up while the score is at or above your minimum score (60 unless you change it) and in warning below it. It sends a change alert when your SPF record, your DMARC record or the set of DKIM selectors found changes. The check runs at most every 6 hours.
| Finding | Points |
|---|---|
| No SPF record | −25 |
| More than one SPF record (SPF is then invalid) | −20 |
SPF ends with +all (authorises every server) | −20 |
SPF uses ?all (neutral) | −8 |
SPF has no ~all or -all | −6 |
| SPF has more than 10 lookup-causing terms | −10 |
| No DMARC record | −25 |
DMARC record without a valid p= policy | −15 |
DMARC policy p=none (monitoring only) | −10 |
DMARC without rua= (no aggregate reports) | −4 |
DMARC pct= below 100 | −4 |
| No DKIM key found on the checked selectors (domains with MX records only) | −10 |
| No MTA-STS policy (domains with MX records only) | −3 |
| No TLS-RPT record (domains with MX records only) | −2 |
Grades: A from 90, B from 75, C from 60, D from 40, F below 40. A BIMI record is reported but does not change the score. The SPF lookup count is estimated from the terms in your record (include:, a, mx, ptr, exists:, redirect=); includes inside included records are not expanded.
| Field | API option | Default | Notes |
|---|---|---|---|
| Hostname, domain or IP | host | Required | Public hostname or IP address |
| DKIM selector (optional) | dkimSelector | None | Up to 63 characters |
| Warn below score | minScore | 60 | 0 to 100 |
| Check interval | interval | Your plan's minimum | Never more often than every 6 hours |
To find your DKIM selector, open the headers of an email sent from your domain and look for the DKIM-Signature header: the selector is the value of s=.
A domain that sends mail through one provider
example.com. TXT "v=spf1 include:_spf.mail-provider.example -all"
_dmarc.example.com. TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com"Start DMARC with p=none while you read the aggregate reports, then move to quarantine and reject once every legitimate source passes.
A domain that never sends mail
example.org. TXT "v=spf1 -all"
_dmarc.example.org. TXT "v=DMARC1; p=reject"This tells receivers to reject anything that claims to come from the domain. Without MX records, the DKIM, MTA-STS and TLS-RPT findings do not apply.
The free SPF & DMARC checker runs the same analysis and lists every finding with the records it found.