41 /100
SPF WARN
Present but soft-fail (~all).
Fix Move to -all once senders are enumerated.
DKIM FAIL
No selector found.
Fix Enable DKIM signing at your ESP and publish the key.
DMARC FAIL
p=none — monitoring only.
Fix Advance to p=quarantine after two weeks of clean reports.
MTA-STS FAIL
Not published.
Fix Publish and enforce MTA-STS.
TLS-RPT FAIL
Not published.
BIMI FAIL
Not published.
DNSSEC WARN
Not enabled.
Fix Sign the zone with your DNS provider.
Track posture across your market.
Subscribe to posture_weak and dmarc_hardened — the moment domains you watch fail or fix their setup.