Question 1

SPF uses softfail (~all)

Accepted Answer

Softfail is acceptable for many teams, but stricter -all is stronger once you are confident every sender is listed. Review includes (Google, Microsoft, CRM, etc.) then consider upgrading to -all.

Question 2

DKIM signing does not appear to be set up

Accepted Answer

DKIM adds a cryptographic signature so inbox providers can verify your messages were not tampered with in transit. Enable DKIM in your email provider (Google Workspace, Microsoft 365, etc.) and publish the TXT record they provide.

Question 3

Brand logo setup is missing

Accepted Answer

Your domain is not yet set up to show a verified brand logo in supporting inboxes. Publishing a BIMI record alone is not enough — you also need a valid BIMI SVG hosted over HTTPS. Add a BIMI TXT record at default._bimi with v=BIMI1 and l= pointing to your HTTPS SVG logo.

Question 4

HTTP does not consistently redirect to HTTPS

Accepted Answer

Visitors (and some checks) may hit an insecure version of your site first. Configure a 301 redirect from http:// to https:// at your host or CDN.

google.com

Will your emails land in the inbox instead of spam?

Can people tell a fake email isn't really from you?

Want your logo to show up next to your emails in Gmail and other inboxes?

Email health checker

google.com

Will your emails land in the inbox instead of spam?

Can people tell a fake email isn't really from you?

Want your logo to show up next to your emails in Gmail and other inboxes?