Email security report card · 2026-11-07
facebook.com
facebook.com scores 75/100 (grade B). SPF passes; DKIM signing couldn’t be verified from public DNS alone. Forged mail “from” facebook.com is refused by the big inboxes. The most valuable next step: authorize dmarc.facebookmail.com to receive your DMARC reports.
B75/100
| Area | Check | Status | Points |
|---|---|---|---|
| Authentication | SPF and DKIMSPF passes; DKIM is unverified. SPF: SPF lists the servers allowed to send as you. DKIM: DKIM wasn’t found under common selector names; with DMARC enforced it very likely exists under a private one. Enter the selector to verify it. | Partly | 20/25 |
| Anti-spoofing | DMARC enforcementMail that fails your checks is refused. Reports to a@dmarc.facebookmail.com are probably never sent: dmarc.facebookmail.com hasn’t published the record that authorizes receiving reports for facebook.com. | Partly | 27/30 |
| Delivery | Google, Yahoo and Microsoft sender rulesMet if your DKIM signing (not found under common names) is in place. | Partly | 12/15 |
| Encryption | MTA-STSTesting mode: senders report problems (via TLS-RPT) but still deliver. Switch to enforce when reports are clean. | Pass | 8/8 |
| Encryption | TLS-RPTReports are requested. | Pass | 4/4 |
| DNS hardening | DNSSECNot signed. Turn on DNSSEC where your DNS is hosted; if the domain is registered elsewhere, add the DS record it gives you at your registrar. | Missing | 0/8 |
| DNS hardening | CAAOnly digicert.com may issue certificates. | Pass | 4/4 |
| Brand | BIMI logoYour DMARC already qualifies. Publish an SVG logo at default._bimi.facebook.com; Gmail and Apple also need a mark certificate. | Missing | 0/6 |
What if you fixed…
Today B 75/100
Fix next
- Authorize dmarc.facebookmail.com to receive your DMARC reports
- Confirm your DKIM selector
- Turn on DNSSEC
- Turn on BIMI logo
Exact records and where to click: full check for facebook.com.
Lookalike exposure
Not scanned this time (scan limit reached). Run the lookalike radar.