Sample audit: a Texas HVAC company
Domain checked: clientdomain.com (name changed for privacy) · Mail provider: Microsoft 365 · Checked: October 29, 2026
The verdict: good bones, no protection. The email setup itself is tidy — a correct SPF record on Microsoft 365 — but the domain has no DKIM signing and no DMARC record at all. Right now, anyone in the world can send email that looks like it comes from this company, and nothing would stop it or even report it.
How the score works: 100 points across six checks — SPF 20, DKIM 20, DMARC 25, alignment 15, blacklists 10, mail setup 10. This domain scored SPF 20, DKIM 0, DMARC 0, alignment 5, blacklists 10, mail setup 10.
What we checked
| Check | Result | What we found |
|---|---|---|
| Mail setup (MX) | Pass | Mail runs on Microsoft 365 — one MX record pointing at Microsoft's servers, set up the standard way. |
| SPF | Pass | A correct SPF record is published and it ends in -all (hard fail — the strong setting). It uses just 1 of the 10 DNS lookups SPF allows, so there is plenty of headroom. |
| DKIM | Fail | No DKIM key found at any of the six standard selectors we checked (google, default, selector1, selector2, k1, s1). For a Microsoft 365 domain, the selector1 and selector2 records are missing — which means DKIM signing is not switched on for this domain. |
| DMARC | Fail | No DMARC record published at all. There is no policy telling inbox providers what to do with fake mail using this domain, and no reporting address to see abuse. |
| Alignment | Warning | SPF is set up so genuine Microsoft 365 mail can align with the domain. But with no DKIM and no DMARC, nothing is actually checking or enforcing alignment — it is passing by setup, not by protection. |
| Blacklists | Pass | The sending IP we checked is not listed on Spamhaus ZEN, SpamCop, or Barracuda — the three lists that matter most for inbox placement. |
Findings, in plain English
Severity: High
1. No DMARC record — the domain can be impersonated
DMARC is the record that tells Gmail, Outlook, and Yahoo: "if an email claims to be from us but fails the checks, block it — and tell us about it." This domain doesn't have one.
What that means for the business: a scammer can send invoices, quote requests, or "updated bank details" emails that genuinely appear to come from this company. Customers can't tell the difference, the company never sees it happening, and one incident can burn years of trust. It also means the domain doesn't meet the sender requirements Google and Yahoo now apply to business senders.
Severity: High
2. DKIM is not switched on — email isn't being signed
DKIM adds a tamper-proof digital signature to every outgoing email. This domain sends through Microsoft 365, which supports DKIM — but the DNS records that turn it on were never published, so mail goes out unsigned.
What that means for the business: inbox providers trust signed mail more. Unsigned mail from a domain with no DMARC is the weakest possible combination — it looks exactly like the setup scammers use.
Severity: None — good news
3. SPF is done properly
The SPF record authorises Microsoft 365 and nothing else, ends in a hard fail (-all), and uses only 1 DNS lookup out of the 10 allowed. No changes needed here — this is the record most small businesses get wrong, and this one is right.
Severity: None — good news
4. No blacklist problems
The mail server IP is clean on Spamhaus ZEN, SpamCop, and Barracuda. Deliverability trouble for this domain is an authentication problem, not a reputation problem — which makes it fully fixable.
The fix plan
These are the exact records we would publish (shown with the sample domain). Fixing this domain takes two DNS records and one switch inside Microsoft 365 — this is precisely what the $149 full setup does for you, or you can hand this plan to whoever manages your DNS.
Step 1 — Turn on DKIM. Publish these two CNAME records, then enable DKIM for the domain in the Microsoft 365 admin portal (the portal shows the exact target hostnames for your account):
selector1._domainkey.clientdomain.com → selector1-clientdomain-com._domainkey.<your-tenant>.onmicrosoft.com selector2._domainkey.clientdomain.com → selector2-clientdomain-com._domainkey.<your-tenant>.onmicrosoft.com
Step 2 — Add DMARC in watch mode first. This changes nothing about delivery — it just starts sending you reports of who is sending mail using your domain:
_dmarc.clientdomain.com (TXT) v=DMARC1; p=none; rua=mailto:[email protected]; fo=1
Step 3 — Enforce, once the reports are clean (usually 2–4 weeks). Move the policy up in stages — quarantine, then reject — so fake mail gets blocked:
_dmarc.clientdomain.com (TXT) v=DMARC1; p=reject; rua=mailto:[email protected]; fo=1
SPF: no change. The existing record stays exactly as it is.
What "fixed" looks like
After these fixes and a re-check: DKIM signing every outgoing email, DMARC reports arriving daily, and a p=reject policy telling every major inbox provider to refuse impersonation attempts. A domain in that state would be expected to score in the 90s on this same audit — and, more importantly, its customers could trust that an email from the company really is from the company.
Honest limits
Authentication is the foundation of deliverability — it proves your email is really from you. It does not, by itself, guarantee inbox placement. Where your mail lands also depends on your sending reputation, your list quality, and your content. Any service that promises "100% inbox" is not telling you the truth. What this audit guarantees is a straight answer about your authentication, in plain English, with the exact fixes.
Get this audit for your own domain — $49
Same checks, same plain-English report, same fix plan — run on your domain. Written report delivered within 48 hours. If you then order the full setup, the $49 comes off the price. Ongoing monitoring is also available at $29/month.
Order the $49 audit on WhatsAppPrefer email? [email protected]
About this sample: the checks above are real. They were run on October 29, 2026 against the public DNS records of a real US business, exactly the way a paid audit is run. The business name and domain have been changed for privacy, and the records shown in the fix plan use the sample domain. DNS changes over time, so any audit — including this one — is a snapshot of public records on the day it was run.