# emailauthpulse report: demo-bakery.example

> Demo report on a fictional sample site.

**Score:** 45/100 · Scanned 2026-10-26T19:46:20.726Z

6 of 10 checks need attention (2 high priority).

- [x] **Mail servers (MX) published** (high): mx1.mailhost.example
- [x] **SPF record present** (high): v=spf1 include:_spf.mailhost.example ?all
- [x] **Exactly one SPF record** (medium): OK
- [ ] **SPF ends with ~all or -all** (medium): Ends with: ?all
- [x] **SPF stays within 10 DNS lookups** (medium): 1 lookup mechanisms at the top level (includes add more).
- [ ] **DMARC record present** (high): No DMARC record at _dmarc.
- [ ] **DMARC policy enforces (quarantine or reject)** (medium): No policy.
- [ ] **DMARC aggregate reports (rua) configured** (low): No rua: you get no visibility into who sends as you.
- [ ] **DKIM key found on a common selector** (high): No DKIM key found on common selectors.
- [ ] **BIMI logo record (optional)** (low): Not published (optional; needs DMARC enforcement).

---
Read-only public DNS lookups. DKIM is checked on common selectors only; a missing result can mean a custom selector.