Riverbend Youth Orchestra (a made-up organization)
One serious problem can send your mail to spam, get it rejected, or let others send mail in your name. It is quick to fix.
Grade D: One serious problem. 1 to fix now, 1 to fix soon, 2 worth doing, 4 working. Read from public DNS on Wednesday, October 28, 2026 at 4:15 pm Eastern.
Your domain’s DNS is managed at Wix. The records below are added or changed on its DNS settings page for riverbendyouth.example.
What is working
Mail for your domain is delivered to Google Workspace. 2 mail servers listed: aspmx.l.google.com and alt1.aspmx.l.google.com.
Email signature key found (DKIM). Key found at: google (Google Workspace), 1024-bit.
Your mail servers have matching reverse DNS names. Both mail server addresses point back to a name that points to them again.
Not on the spam blocklists we checked. 2 addresses checked against Mailspike, PSBL (Passive Spam Block List), SpamCop and UCEPROTECT level 1.
What to fix, in order
1Fix nowAnti-impersonation policy (DMARC)
No protection against people faking your address (DMARC)
DMARC tells receivers what to do with mail that fakes your address, and sends you reports of who is sending as you. Gmail and Yahoo have required it of bulk senders since February 2024, and Microsoft since May 2025. Without it, anyone can send convincing mail in your name, such as a fake donation request, and your real mail is treated with more suspicion.
Create the mailbox or alias dmarc@riverbendyouth.example first, or change it to an address you already read. After about two weeks of reports showing your own mail passes, change p=none to p=quarantine.
2Fix soonApproved senders (SPF)
Your SPF record ends in ?all, which protects nothing
The ending ?all tells receivers to treat unlisted servers as neutral, so mail faking your address is not flagged. Change it to ~all.
Change to: v=spf1 include:_spf.google.com include:servers.mcsv.net ~all
3Worth doingEmail signature (DKIM)
A signing key uses the older 1024-bit length
The key at google._domainkey.riverbendyouth.example is 1024 bits. It still works, but 2048 bits is the current advice, and the Google Admin console can make one under Authenticate email.
4Worth doingEncrypted delivery (MTA-STS)
No encrypted delivery policy (MTA-STS)
MTA-STS tells other mail servers to deliver to you only over an encrypted connection, so mail cannot be read or redirected on the way. Gmail and Microsoft both honor it. It needs one small file on a web address as well as a DNS record, so do it after the items above.
Do
Type
Host
Value
Add
TXT
_mta-sts
full name _mta-sts.riverbendyouth.example
v=STSv1; id=2026102801
Add this only after the file below is online at its address.
Put the file below online at the address shown (a subdomain called mta-sts on any web host that serves HTTPS). After two weeks of clean TLS reports, change mode: testing to mode: enforce and change the id in the DNS record.
File to put online at https://mta-sts.riverbendyouth.example/.well-known/mta-sts.txt
Create the mailbox or alias tls-reports@riverbendyouth.example first, or use an address you already read.
6Good to knowLogo in inboxes (BIMI)
Optional: your logo in inboxes (BIMI)
BIMI can show your logo beside your mail in Gmail, Apple Mail and Yahoo. It needs DMARC set to quarantine or reject first, and Gmail and Apple also need a paid mark certificate, so it is the last step, not the first.
We read only public DNS records, the same ones every mail server reads when your mail arrives, plus your public MTA-STS policy file if you have one. We did not send mail, sign in to anything, or test your servers. DKIM keys can only be found at names we know to try; 72 names were tried. A clean report means your setup follows the published rules; it cannot promise that every message reaches every inbox, which also depends on what you send and how readers respond. The rules come from these sources: