Email Compliance

{
  "domain": "example.com",
  "status": "warn",
  "score": 82,
  "grade": "B",
  "provider_readiness": {
    "google": {
      "provider": "google",
      "display_name": "Google/Gmail bulk sender readiness",
      "status": "pass",
      "dns_visible_status": "pass",
      "requirements": [
        {
          "id": "google_spf",
          "label": "SPF must be configured for bulk senders",
          "status": "pass",
          "severity": "critical",
          "category": "dns",
          "evidence": "SPF policy: softfail",
          "recommendation": "Publish one valid SPF record that covers every approved sending platform."
        },
        {
          "id": "google_alignment",
          "label": "From domain must align with either SPF or DKIM on live messages",
          "status": "unknown",
          "severity": "high",
          "category": "message",
          "evidence": "Alignment requires Authentication-Results from a real sent message",
          "recommendation": "Send a test message and verify SPF or DKIM alignment."
        }
      ],
      "verification_required": [
        "From domain must align with either SPF or DKIM on live messages",
        "Outbound mail must be transmitted over TLS"
      ],
      "notes": [
        "Status is based on DNS-visible controls. Live sending requirements still need message-header and sender-platform verification."
      ]
    },
    "microsoft": {
      "provider": "microsoft",
      "display_name": "Microsoft Outlook.com high-volume sender readiness",
      "status": "pass",
      "dns_visible_status": "pass",
      "requirements": [],
      "verification_required": [
        "DMARC must align with either SPF or DKIM"
      ],
      "notes": [
        "Status is based on DNS-visible controls. Live sending requirements still need message-header and sender-platform verification."
      ]
    }
  },
  "summary": {
    "authentication": {
      "spf": {
        "status": "pass",
        "record": "v=spf1 include:_spf.example.com ~all",
        "policy": "softfail",
        "lookup_count": 3,
        "lookup_limit_exceeded": false
      },
      "dkim": {
        "status": "pass",
        "selectors_checked": [
          "google",
          "selector1",
          "sendgrid"
        ],
        "selectors_found": [
          "google"
        ],
        "valid_selector_count": 1,
        "weak_selector_count": 0,
        "revoked_selector_count": 0,
        "providers_detected": [
          "Google Workspace"
        ]
      },
      "dmarc": {
        "status": "warn",
        "record": "v=DMARC1; p=none; rua=mailto:dmarc@example.com",
        "policy": "none",
        "subdomain_policy": null,
        "percentage": 100,
        "rua": [
          "mailto:dmarc@example.com"
        ],
        "alignment_mode": {
          "spf": null,
          "dkim": null
        }
      }
    },
    "transport": {
      "mta_sts": {
        "status": "pass",
        "mode": "enforce",
        "policy_fetch_ok": true,
        "policy_matches_mx": true
      },
      "tls_rpt": {
        "status": "pass",
        "rua": [
          "mailto:tls@example.com"
        ]
      },
      "mx_records": [
        "aspmx.l.google.com"
      ],
      "client_access_secure_services": 1
    },
    "dns_security": {
      "dnssec": "pass",
      "caa": "pass",
      "zone_transfer": "pass",
      "authoritative_consistency": "pass",
      "blacklist": "pass"
    },
    "brand_trust": {
      "bimi": "unknown",
      "vmc": "unknown"
    }
  },
  "action_items": [
    {
      "priority": "medium",
      "category": "authentication",
      "title": "Move DMARC beyond monitoring mode",
      "detail": "DMARC is valid but still uses p=none.",
      "fix": "After reviewing aggregate reports, move to p=quarantine or p=reject."
    }
  ],
  "evidence": {
    "email_auth": {
      "spf": {
        "record": "v=spf1 include:_spf.example.com ~all"
      },
      "dmarc": {
        "record": "v=DMARC1; p=none; rua=mailto:dmarc@example.com"
      }
    },
    "dns_security": {
      "security_score": 86,
      "security_grade": "B"
    }
  },
  "proxy": {
    "configured": true,
    "enriched": true,
    "checks": [
      "spf_walk",
      "mail_policies",
      "dkim_audit",
      "bimi_audit"
    ]
  },
  "limitations": [
    "DNS-visible checks cannot prove live message-level SPF, DKIM, DMARC alignment, RFC 5322 formatting, spam rate, or one-click unsubscribe behavior."
  ],
  "checked_at": "2026-04-26T12:00:00Z",
  "check_duration_ms": 642
}