Scanning
Scanning your domain…
Checking SPF, DMARC, DKIM, MX, DNS, blacklists and domain & SSL expiry. A domain we haven't scanned before takes a few seconds — hang tight.
Checking SPF, DMARC, DKIM, MX, DNS, blacklists and domain & SSL expiry. A domain we haven't scanned before takes a few seconds — hang tight.
Scanned Oct 21, 2026 15:17 UTC · 7 checks · public report
Solid base — two policy steps remain.
givenchy.com publishes an enforcing DMARC policy, so mail that forges its domain is quarantined or rejected at the recipient.
Your SPF setup is working, but it is right at the DNS lookup limit, which means it is close to becoming too complex for some mail systems to evaluate reliably. This matters because if it goes over the limit, legitimate emails may start failing SPF checks and land in spam or be rejected. The fix is to simplify the list of services covered by SPF, usually by removing anything no longer needed or flattening the setup so it uses fewer lookups.
v=spf1 include:_spf.mlsend.com a:production.store.givenchy.demandware.net include:spf1.givenchy.com include:spf.protection.outlook.com include:spf-0024c501.pphosted.com include:email-od.com include:_spf.salesforce.com include:spf.mailjet.com a:c.spf.service-now.com -allThis means your email signature key is smaller than recommended, so it is easier to break than a modern one. If an attacker can forge that signature, your messages may be more likely to be spoofed or tampered with. The fix is to replace this DKIM selector with a stronger, modern key size and then update the DNS entry for that selector.
One send: the full report — every finding and fix — lands in your inbox, with a free account waiting. Opening it signs you in and starts a 14-day Monitor trial. No card, and you can unsubscribe in one click.
Domain owner? Re-scan any time — or email hello@dnsdoctor.dev to have this page removed.