Check the DMARC record of any domain
Results for
paypal.com
Email authentication
2 warnings
Warning- SPF
- Warning:~all (soft fail), 9 of 10 lookups
- DMARC
- Pass:p=reject
- DKIM
- Warning:2 keys: s1, s2
- MTA-STS
- Note:Not set up
- TLS reporting
- Note:Not set up
- BIMI
- Pass:Published
- Mail servers
- mx1.paypalcorp.com, mx2.paypalcorp.com
DMARC record
_dmarc.paypal.com
Passv=DMARC1; p=reject; rua=mailto:d@rua.agari.com,mailto:dmarc_agg@vali.email; ruf=mailto:d@ruf.agari.com,mailto:MTc4Mzcw@ruf.vali.email
- Policy p=reject: receivers refuse mail that fails DMARC.
- Aggregate reports go to d@rua.agari.com, dmarc_agg@vali.email.
- Policy
- reject (refuse)
- Subdomain policy
- reject (refuse)
- Percentage
- 100%
- Aggregate reports
- d@rua.agari.com, dmarc_agg@vali.email
- Failure reports
- d@ruf.agari.com, MTc4Mzcw@ruf.vali.email
- DKIM alignment
- Relaxed
- SPF alignment
- Relaxed
SPF record
9 of 10 DNS lookups
Warningv=spf1 include:pp._spf.paypal.com include:3ph1._spf.paypal.com include:3ph2._spf.paypal.com include:3ph3._spf.paypal.com include:3ph4._spf.paypal.com include:sendgrid.net include:aspmx.pardot.com ~all
- Uses 9 of 10 DNS lookups. One more include can break SPF.
- Ends in ~all (soft fail), so receivers accept mail from unlisted servers but mark it as suspicious.
Includes
9 domains
- include:pp._spf.paypal.com1 lookup
- include:3ph1._spf.paypal.com1 lookup
- include:3ph2._spf.paypal.com1 lookup
- include:3ph3._spf.paypal.com1 lookup
- include:3ph4._spf.paypal.com1 lookup
- include:sendgrid.net2 lookups
- include:ab.sendgrid.net1 lookup
- include:aspmx.pardot.com2 lookups
- include:et._spf.pardot.com1 lookup
DKIM keys
24 selectors checked
Warning- s1._domainkey.paypal.comPass:2048-bit RSA
Show record
k=rsa; t=s; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxbgrZ8NI+r1z/S4RHUWdMmwmN+JGEY9Blcd1cqhocyKq+4qzU5TDXX4gKIZ2Apq3tTdA/a5hNEE4bPyhJAHFA0/x7Xhg//F4+iLwAB766QJ10Yjv7nQIqvzMmMpLctr5FjgnclGvPUgow3ofUpnmxyr1s9fR2JdvrRzXtwvuvbDV8j98iuIGYgcTcmQwJHH3HcGuxYOc57YZBNPUQbd5fcR5hcpbi+rWeT/SlNCCLNLP4gmXVg7lPc37Yo3CG5gpAsTAf/4RIxb22aL2xW596h/Hi1EebekpqF1dWogRs7x2JK1JYQaVIJEYNSuv5nqLR6FA1SUmB1375JL4pTXS6QIDAQAB
- s2._domainkey.paypal.comWarning:1024-bit RSA
- 1024-bit RSA key. 2048 bits is the current recommendation.
Show record
k=rsa; t=s; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDMTLst9tYk0BVG2VmtfH+pSW9SYaffk4Z3wx361Z2P8Knyh+UNT6EWgdLfhz35K2hD04HMNy+wQqNiN7EFDmUUiqoJ69Z2d4JKNfNWXoKubJFrTRHdKVl7o17yN/Pw6N/O5wqxqe0pISJjglebwjwX4JpTQZ6wHzQhGu5++JDP2QIDAQAB
Selectors we checked (24)
- selector1
- selector2
- default
- dkim
- k1
- k2
- k3
- s1
- s2
- smtp
- mx
- mandrill
- mxvault
- protonmail
- protonmail2
- fm1
- fm2
- sig1
- zmail
- kl
- s1024
- s2048
To check another selector, enter it as selector._domainkey.paypal.com.
MTA-STS, TLS reporting and BIMI
Optional records
MTA-STS
- No MTA-STS record. Sending servers may deliver mail to this domain without TLS when an attacker strips it.
TLS reporting
- No TLS-RPT record, so nobody hears about failed TLS connections to your mail servers.
BIMI
v=BIMI1; l=https://www.paypalobjects.com/marketing/web/logos/paypal_ppe.svg; a=https://www.paypalobjects.com/marketing/web/logos/PPE_UK_DE_paypal_inc.pem
- Brand logo at https://www.paypalobjects.com/marketing/web/logos/paypal_ppe.svg, with a mark certificate.
Inboxes that support BIMI show this logo next to your mail.
Run this lookup from code
The API returns this result as JSON. The free plan includes 100 API calls per month.
curl "https://hostingchecker.online/api/v1/email-auth?query=paypal.com" \
-H "Authorization: Bearer YOUR_API_KEY"How it works
How DMARC works
DMARC builds on SPF and DKIM. A message passes DMARC when SPF passes for a Return-Path domain that matches the visible From domain, or when a DKIM signature verifies for a matching domain. Matching is called alignment: relaxed alignment accepts a subdomain, strict alignment needs the exact domain.
The record also asks receivers for reports. Aggregate reports show every server that sent mail as your domain, so you can find forgotten senders before you tighten the policy to quarantine or reject.
- p
- Policy for failing mail: none, quarantine or reject
- sp
- Policy for subdomains, defaults to p
- pct
- Share of failing mail the policy applies to
- rua
- Where receivers send aggregate reports
- adkim / aspf
- Relaxed (r) or strict (s) alignment
FAQ
DMARC checker FAQ
Common questions about DMARC policies and reports.
Related guides
Learn more from the blog
Step-by-step guides on reading and using these results.
MX Record Check: How to Find a Domain's Mail Servers
Run an MX record check with a DNS lookup tool, dig or nslookup. See the current MX values for Google Workspace, Microsoft 365, Zoho, Proton and Fastmail, what a null MX means, and how to fix common email delivery problems.
DNS Records Explained: Every Record Type With Real Examples
DNS records explained: what A, AAAA, CNAME, MX, TXT, NS, SOA, SRV, PTR, CAA and HTTPS/SVCB records do, with real dig output from live domains and the fields of each record.
How to Check DNS Records for Any Domain (Online and Command Line)
Check DNS records for any domain with an online DNS record lookup, dig, nslookup, PowerShell or DNS over HTTPS. Real output for every command, plus how to query a specific resolver or the authoritative nameserver.
Related tools
More free tools
Explore our other free lookup and analysis tools.
Free lookup tool
Check the DMARC record of any domain
Look up the DMARC record of any domain. See the policy, subdomain policy, percentage, report addresses and alignment, with a check of SPF and DKIM.