Email authentication
MX, MTA-STS, TLS-RPT and BIMI
Where your mail is delivered, the records that force encrypted delivery and report on failures, and the optional brand-logo record.
Updated · 2 min read
Beyond SPF, DKIM and DMARC, the email section reads four more records. None of them stop forgery; they protect delivery and, in BIMI's case, decorate it.
MX
The MX records say where mail sent to the domain is delivered. The scan lists them, resolves each host, and identifies the provider (Microsoft 365, Google Workspace, Proton, a self-hosted server, and others). That provider identification drives which DKIM selectors are tried and which fix steps are shown. A domain with no MX is "mail not configured", not a failure.
MTA-STS
MTA-STS tells sending servers to deliver to your MX hosts only over authenticated TLS. Two parts are read:
- The
_mta-sts.<domain>TXT record. - The policy file at
https://mta-sts.<domain>/.well-known/mta-sts.txt.
| Finding | Severity |
|---|---|
Record and policy present, mode: enforce |
Pass |
Policy in testing or none mode |
Low: published but not enforced, so downgrade attacks are not yet blocked |
| Record present but the policy file cannot be fetched | Low: sending servers cannot apply it |
An MX host missing from the policy's mx: lines |
Medium |
| Neither record nor policy, on a domain with MX | Low: "No MTA-STS policy", an optional improvement rather than a failure. A domain with no MX gets no finding |
TLS-RPT
The _smtp._tls.<domain> TXT record names an address that receives reports about TLS delivery failures. Presence is recorded; absence is a low-priority note. TLS-RPT reports are not ingested by DomainGuard; the record is checked so you know whether anyone would be told when encrypted delivery fails.
BIMI
BIMI publishes a logo that some receivers show beside authenticated mail. It requires DMARC at p=quarantine or p=reject. The record at default._bimi.<domain> is read and its logo URL noted. BIMI is optional and never produces a failure.
Where
iOS: the Email & DMARC module, below the three authentication cards. The web console's Email authentication table (Security, Overview) covers SPF, DKIM and DMARC only. In the security checkup, MTA-STS and TLS-RPT appear under Email Authentication. The API field is on GET /api/domains/:id/email-security.
Common questions
Should I set up MTA-STS? If your provider supports it (Microsoft 365 and Google Workspace both do), yes. Start in testing mode with a TLS-RPT address so you see failures before enforcing.
Why does the MX check say Review when mail works? Usually one MX host does not resolve or the set includes a legacy host. The page names it.
Keep reading
Related articles
- DMARC setup checklist and deliverability diagnosticsThe five-step setup status, the ranked diagnostic that answers why mail is going to spam, and the two-week / 95% rule before tightening policy.Email authentication ·Updated
- Local search report and autopilotWe read your website, find your Google listing, and report where you rank on Google Maps, in the 3-pack and in search, who ranks ahead of you and what to fix on the listing. Emailed each time, and on a weekly or monthly schedule if you want it.Local SEO ·Updated
- SPF, DKIM and DMARC checksHow each record is read and graded, what Pass / Review / Fail mean, the recommended record with a Copy button, and the two DMARC policies labelled honestly.Email authentication ·Updated