BetaSPFWise is in beta, and every feature is free until it ends. More information after you sign up.
SPFWise
How it worksWhat we checkPricingFAQGuides

Email Authentication Report for apple.com

A live look at how apple.com configures SPF, DKIM, DMARC, and transport security, with the grade explained.

A

apple.com

85 out of 100

Scanned: Jul 6, 2026, 1:16 PM

Why this score

The score starts at 100. Every issue below subtracts points based on how much it hurts your deliverability or lets someone spoof you.

Starting score
100
SPFEnds with ~all (softfail).
-5
DKIMDKIM key is only 1024-bit.
-5
DMARCPolicy is p=quarantine.
-5
Your score
85

  • SPF

    -5Pass
    • -5

      Ends with ~all (softfail).

      A softfail asks receivers to accept mail from unlisted senders but flag it, so spoofed messages can still reach the inbox.

      How to fix: Move to -all after confirming that all of your senders are included, so unauthorized mail is rejected.

    DNS lookups2 / 10
    v=spf1 include:_spf.apple.com include:_spf-txn.apple.com ~all
    allQualifier
    ~

  • DKIM

    -5Warning
    • -5

      DKIM key is only 1024-bit.

      A 1024-bit RSA key is below the modern standard of 2048-bit and is easier to break. Some receivers already ignore keys this short.

      How to fix: Rotate to a 2048-bit key with your email provider and publish the new public key.

    selectors
    selector1, selector2
    keyType
    rsa
    keyBits
    1024
    Read the DKIM guide

  • DMARC

    -5Pass
    • -5

      Policy is p=quarantine.

      Quarantine sends failing mail to the spam folder rather than rejecting it. That is good protection, but not the strongest.

      How to fix: Advance to p=reject once you are confident that every legitimate source passes.

    • Aggregate reporting is enabled.

      A rua address is set, so you receive daily reports showing every source that sends as your domain.

    • DMARC is present and enforced.

      A valid DMARC record was found with an enforcing policy, so receivers act on mail that fails authentication.

    v=DMARC1; p=quarantine; sp=reject; rua=mailto:d@rua.agari.com; ruf=mailto:d@ruf.agari.com;
    policy
    quarantine
    subdomainPolicy
    reject
    pct
    100
    rua
    mailto:d@rua.agari.com
    adkim
    r
    aspf
    r

  • MX

    Pass

    • MX is configured (6 mail server(s)).

      Your domain has MX records and every listed mail server resolves to an IP address, so it can receive mail.

    mxHosts
    mx-in.g.apple.com (10), mx-in-rn.apple.com (20), mx-in-sg.apple.com (20), mx-in-hfd.apple.com (20), mx-in-vib.apple.com (20), mx-in-ma.apple.com (20)
    mxCount
    6

  • Blacklist

    Pass

    • Not on any checked blocklist.

      Your mail server IPs were not found on the public blocklists we checked. Reputation can change, so it is worth monitoring over time.

    ipsChecked
    17.56.176.6, 17.23.14.18, 17.57.165.2
    blocklists
    bl.spamcop.net, dnsbl.sorbs.net

Optional enhancements

Advanced, nice-to-have features. Setting these up (or not) does not change your grade.

  • DNSSEC

    Optional

    • DNSSEC is not enabled.

      DNSSEC is optional, but it protects against DNS spoofing by letting resolvers confirm your records are authentic. Most domains still do not use it.

      How to fix: If your DNS provider and registrar support it, enable DNSSEC to protect your domain from DNS tampering.

  • MTA-STS

    Optional

    • MTA-STS is not set up.

      MTA-STS is optional but recommended. It tells sending servers to require TLS when delivering mail to you, which blocks downgrade and man-in-the-middle attacks on your inbound mail.

      How to fix: Publish a _mta-sts TXT record and host a policy at https://mta-sts.<yourdomain>/.well-known/mta-sts.txt with mode enforce.

    Read the MTA-STS guide

  • TLS-RPT

    Optional

    • TLS reporting (TLS-RPT) is not set up.

      TLS-RPT is optional. It asks receivers to send you reports when TLS fails while delivering your mail, which is how you catch MTA-STS or certificate problems before they hurt delivery.

      How to fix: Publish a _smtp._tls TXT record with v=TLSRPTv1 and a rua address, for example rua=mailto:tlsrpt@yourdomain.

    Read the TLS-RPT guide

  • BIMI

    Pass

    • BIMI is set up.

      Your BIMI record is valid, DMARC is enforced, and a Verified Mark Certificate is present, so supporting inboxes can show your logo.

    v=BIMI1;l=https://www.apple.com/bimi/v2/apple.svg;a=https://www.apple.com/bimi/v2/apple.pem;
    logo
    https://www.apple.com/bimi/v2/apple.svg
    vmc
    https://www.apple.com/bimi/v2/apple.pem

This report examines how apple.com configures email authentication across its public DNS records. For a technology company whose services reach millions of inboxes, the records that authorize senders and sign outgoing mail are the difference between a message that lands and one that is quietly dropped.

The checks behind the grade

The score above reflects the public DNS records for apple.com at the time of the scan. SPF declares which servers may send mail for the domain, DKIM signs each message so tampering can be detected, and DMARC combines both with a published policy. Additional transport-security records raise the grade by securing the delivery path between mail servers.

About this report

This report is generated from publicly available DNS records for apple.com and is provided for informational and educational purposes only. SPFWise is not affiliated with, endorsed by, or connected to the owner of apple.com. The records shown are the same ones any mail server can query, and the grade updates automatically as they change.

Want the same breakdown for your own domain? Run a free scan to get an identical grade along with the exact records to fix anything that is weak.

Check your own domain

Run a free scan and get your grade with the exact records to fix.

Scan a domain

Guides to fix common issues

Email Compliance: CAN-SPAM, GDPR and CASL Basics

A plain-English guide to the three laws that govern commercial email: CAN-SPAM in the US, GDPR in the EU, and CASL in Canada, covering consent, identification, unsubscribe, penalties, and how compliance overlaps with deliverability.

Dedicated vs Shared IP for Sending Email

A practical guide to choosing between a dedicated and a shared sending IP, weighing volume, reputation control, warmup burden, and cost, with a clear decision path.

Phishing vs Spoofing: What Is the Difference?

Spoofing is the technique of forging a sender identity; phishing is the fraud it enables. This guide explains the difference, how they overlap, and which defenses stop each.