SAMPLE · ILLUSTRATIVE · DNS-ONLY
DNS authentication snapshot: colourpop.com
A readable HTML companion to the Inboxpass sample report, based on public DNS records for colourpop.com.
What the sample covers
The audit queries public DNS for SPF, DMARC, common DKIM selectors, BIMI, MX, MTA-STS, and TLS-RPT. The underlying PDF is watermarked SAMPLE / NOT A PAID RUN.
SPF · present
v=spf1 mx include:_spf.google.com; 4 of 10 lookups, with no terminal -all or ~all.
DMARC · present
p=reject, pct=100, with aggregate and forensic reporting addresses.
DKIM · found
Google and k1 selectors answered. Other common selectors tried were not claimed missing.
BIMI · missing
No BIMI record was found. MX is present; MTA-STS and TLS-RPT are missing.
SPF never says -all
There is an SPF record, but it has no terminal all mechanism. Receivers treat unlisted senders as neutral. The sample suggests pairing -all with the ESPs actually used.
Five fixes, ranked
- HIGH · SPF has no terminal all mechanism
Add
-allat the end of the SPF TXT record. - HIGH · Mailchimp DKIM is live, but SPF does not include Mailchimp
Mail sent from Mailchimp will DKIM-sign, but SPF will fail unless the appropriate Mailchimp include is published. Recount lookups and stay under 10.
- HIGH · Shopify is not in SPF
The sample notes the storefront’s Shopify address, but not
shops.shopify.comin SPF. Check the current include in Shopify Admin before changing records. - LOW · Add BIMI once DMARC enforcement is live
BIMI requires an SVG and supporting inbox requirements; the sample says not to bother until enforcement is in place.
- LOW · Optional MTA-STS
MTA-STS protects inbound SMTP, not Klaviyo outbound mail. It may be worthwhile if this domain receives mail.
Read the original sample report
Open the existing watermarked PDF for the full lookup chain, DKIM selector table, and audit notes.
Open sample PDFBuy the real run
Get Snapshot or start Watch
This page is an illustrative sample — not a paid Inboxpass run and not an inbox-placement test. Snapshot is $129. Watch is $49/mo.