Scanning
Scanning your domain…
Checking SPF, DMARC, DKIM, MX, DNS, blacklists and domain & SSL expiry. A domain we haven't scanned before takes a few seconds — hang tight.
Checking SPF, DMARC, DKIM, MX, DNS, blacklists and domain & SSL expiry. A domain we haven't scanned before takes a few seconds — hang tight.
Scanned Oct 21, 2026 16:51 UTC · 7 checks · public report
Solid base — two policy steps remain.
groton-ct.gov publishes an enforcing DMARC policy, so mail that forges its domain is quarantined or rejected at the recipient.
Your SPF setup is almost at the DNS lookup limit, which means email checks are getting close to too complicated. This matters because if it goes over the limit, some receiving mail servers may treat your messages as untrusted or reject them. The fix is to simplify the SPF setup by reducing the number of included services or by consolidating mail sources so it stays under the limit.
v=spf1 ip4:64.251.55.37 ip4:64.251.55.41 include:_spf.createsend.com include:servers.mcsv.net include:mailgun.org include:spf.protection.outlook.com include:us._netblocks.mimecast.com -allThis means your email signing key for the DKIM selector named **selector2** is only 1024 bits, which is considered weak by modern standards. It matters because weaker keys are easier to attack and can reduce trust in your outgoing mail. The fix is to replace that DKIM key with a stronger one, usually 2048 bits, and then update your mail service to use the new key.
One send: the full report — every finding and fix — lands in your inbox, with a free account waiting. Opening it signs you in and starts a 14-day Monitor trial. No card, and you can unsubscribe in one click.
Domain owner? Re-scan any time — or email hello@dnsdoctor.dev to have this page removed.