Remediation Guide

1. Log in to your DNS provider (Cloudflare, GoDaddy, Namecheap, etc.)
2. Add a TXT record at your domain root with your email provider's SPF include. Examples:

If you use multiple providers, combine them into one record: v=spf1 include:_spf.google.com include:sendgrid.net ~all

1. Open your DNS settings and find all TXT records starting with v=spf1
2. Merge all include: directives into a single TXT record
3. Delete the extra records — keep only one

1. Each include:, a:, mx:, and redirect= mechanism counts as 1 lookup (nested includes count too)
2. Remove unused includes for services you no longer use
3. If you can't reduce below 10, use an SPF flattening service (e.g., AutoSPF, SPF Wizard) which replaces includes with direct IP ranges

Change +all to ~all (soft fail) or -all (hard fail) in your SPF TXT record. Using +all provides no protection against spoofing.

Add the appropriate include: for your email provider. Check your provider's documentation for the correct SPF include domain.

Move any include: directives before the ~all or -all at the end. Remove any trailing content after the all mechanism.

Remove includes that point to domains with no DNS records. Each failed DNS lookup counts against a void lookup limit of 2.

Replace ptr with explicit ip4: or ip6: entries. The ptr mechanism is deprecated per RFC 7208 due to poor performance and reliability.

1. Log in to your email provider's admin console
2. Find the DKIM settings (usually under Authentication or Domain Settings)
3. Generate a DKIM key pair — your provider will give you a TXT record to add
4. Add the CNAME or TXT record to your DNS as instructed
5. Enable DKIM signing in your provider settings

Common selector names: google (Google Workspace), selector1/selector2 (Microsoft 365), s1/s2 (SendGrid)

1. Generate a new 2048-bit DKIM key in your email provider's admin console
2. Update the DNS TXT record with the new public key
3. Rotate out the old 1024-bit key after confirming the new one works

A revoked key (empty p=) is intentional if you've rotated to a new selector. Ensure at least one active DKIM selector exists. If this was unintentional, re-generate the key in your email provider.

1. Send a test email from the domain and inspect the DKIM-Signature header — it contains the actual selector name in the s= tag
2. Once you know the selector, verify it with a DNS query:

This warning is informational — domains behind security gateways almost certainly have DKIM configured. The score reflects partial credit (8/15) rather than treating DKIM as missing.

1. Add a TXT record at _dmarc.yourdomain.com
2. Start with monitoring mode:

Monitor reports for 2-4 weeks, then upgrade to p=quarantine, then p=reject.

1. Review your DMARC aggregate reports to confirm all legitimate senders pass SPF/DKIM
2. Upgrade to p=quarantine (failed emails go to spam)
3. After confirming no legitimate mail is affected, upgrade to p=reject

Add rua=mailto:dmarc@yourdomain.com to your DMARC record. This lets you receive reports about who is sending email as your domain. Free DMARC report analyzers: Postmark, EasyDMARC, Dmarcian.

If your rua points to reports@external.com, the external domain must publish:

Contact the external reporting service to add this authorization record, or use an email address on your own domain.

1. Set up an email provider (Google Workspace, Microsoft 365, Zoho, etc.)
2. Add the MX records they provide to your DNS

Check your MX record hostnames — they must resolve to valid IP addresses. Common causes: typo in MX hostname, or the pointed-to mail server has been decommissioned. Update the MX record to point to your current email provider's servers.

Most email providers give you multiple MX records with different priorities. Add all of them to your DNS. If your provider only offers one, this is informational — not a problem for most setups.

1. Identify the source of spam — compromised account, misconfigured mail server, or purchased lists
2. Fix the root cause before requesting delisting
3. Submit a delisting request at the blacklist's website:

• Barracuda — barracudacentral.org/lookups/lookup-reputation
• SpamCop — spamcop.net/bl.shtml (auto-delists after 24-48h if spam stops)
• SURBL — surbl.org/surbl-analysis
• Spamhaus — check.spamhaus.org (not checked from cloud but important to verify manually)

Tier 2 blacklists have limited adoption. Some auto-delist after a period of clean behavior. If multiple Tier 2 listings appear, investigate whether your sending IP is shared (common with cloud email providers) or if there's an actual issue. Focus on Tier 1 listings first.

1. Renew your SSL certificate through your hosting provider or certificate authority
2. If using Cloudflare, Let's Encrypt, or similar — certificates auto-renew; check that auto-renewal is enabled and DNS is correctly configured
3. If self-managing, set a calendar reminder 30 days before expiry

Set up HTTPS on your domain. Free options: Cloudflare (proxy mode), Let's Encrypt (certbot). Most hosting providers include free SSL. If the domain is email-only with no website, this is less critical.

Renew immediately. Check that auto-renewal is configured correctly — most providers support this. Verify DNS records haven't changed in a way that blocks validation.

Wait. Brand-new domains need time to build reputation. Do not send cold outreach for at least 2 weeks. During warmup:

1. Set up SPF, DKIM, and DMARC immediately
2. Send small volumes to engaged recipients who will open and reply
3. Gradually increase volume over 4-6 weeks

Continue warmup process. Keep volumes low and monitor deliverability. Domains under 90 days should avoid aggressive outreach volumes.

Consider renewing your domain for 2+ years. Longer registration is a minor positive trust signal. Not urgent — focus on SPF/DKIM/DMARC first.

PTR records are set by whoever controls the IP address — usually your hosting provider or ISP, not your DNS registrar. Contact your email/hosting provider to set up a PTR record for your mail server IP. If using a managed email service (Google, Microsoft), PTR is already configured.

Ensure the PTR record points to a hostname that, when resolved with an A record, returns the same IP address. This is called Forward-confirmed reverse DNS (FCrDNS). Contact your hosting provider if the PTR record is incorrect.

1. Add a TXT record at _mta-sts.yourdomain.com:

2. Host a policy file at https://mta-sts.yourdomain.com/.well-known/mta-sts.txt:

3. Start with mode: testing, then switch to mode: enforce after monitoring

Update the mx: lines in your MTA-STS policy file to match your current MX records. Wildcards are allowed (e.g., mx: *.google.com). Update the id in the DNS TXT record whenever you change the policy.

The policy file must include all four required fields: version, mode, mx, and max_age. Check that the file is served with content-type text/plain over HTTPS with a valid certificate.

Add a TXT record at _smtp._tls.yourdomain.com:

This is most useful when paired with MTA-STS. Reports help identify TLS delivery failures.

Ensure exactly one TXT record at _smtp._tls.yourdomain.com with format: v=TLSRPTv1; rua=mailto:address@domain.com. Remove any duplicate records.

BIMI logos only display when DMARC policy is p=quarantine or p=reject. Upgrade your DMARC policy first, then BIMI will work automatically.

A VMC is required for Gmail logo display. Purchase one from DigiCert or Entrust (the only accepted issuers). You'll need a trademarked logo in SVG Tiny PS format. Some providers (Apple Mail, Yahoo) show logos without a VMC.

Renew your VMC through DigiCert or Entrust. VMCs are typically valid for 1 year. Update the a= URL in your BIMI TXT record if the certificate URL changed.

This domain is used for throwaway signups. Emails sent here are never read and addresses expire quickly. Remove these from your outreach lists. This is a receiving-mode check — it applies to prospect domains, not your sending domain.

The domain does not exist in DNS. No website, no email, no services. Remove from your outreach list. If this is your own domain, check that your DNS records are properly configured and the domain registration hasn't expired.

Domains used for cold email should ideally have a website. A blank domain can look suspicious to recipients who click through to verify your company. Consider setting up a simple landing page.