Public DNS · scanned 2026-11-06 21:09 UTC

shopify.com

ENFORCED

8 checks · 0 failed · 2 advisory · MX: Google Workspace

Policy is p=reject at pct=100. The remaining work is verifying every sender survives enforcement, which 5 selector(s) do not enumerate.

	Check	What the record says
!	SPF record	Present but ends in ~ — unauthorised senders are soft-failed, not refused.
✓	SPF under the lookup limit	4 of 10 permitted lookups.
✓	DKIM keys discoverable	5 of 18 standard selectors present.
✓	DMARC record	Present (delegated via dmarcreject.shopify.com).
✓	Policy is enforced	p=reject; pct=100.
✓	Aggregate reports collected	rua= present. Someone can see who is sending.
!	Transport security published	MTA-STS published in unknown mode.
✓	BIMI logo	BIMI record present.

The records, as published

SPF: v=spf1 include:_spf.google.com include:mail.zendesk.com include:sendgrid.net ~all
DMARC: v=DMARC1; p=reject; pct=100; fo=1; rua=mailto:dmarc-aggregate@shopify.com;ruf=mailto:dmarc-reports@shopify.com delegated via dmarcreject.shopify.com
DKIM: google rsa 128 mail rsa 128 zendesk1 rsa 256 zendesk2 rsa 256 pm rsa 128
MX: aspmx.l.google.com alt3.aspmx.l.google.com alt4.aspmx.l.google.com alt1.aspmx.l.google.com alt2.aspmx.l.google.com
Transport: TLS-RPT published; MTA-STS unreachable
BIMI: present
Lookups: 4 of 10 permitted

What this scan cannot see

Alignment is not verifiable from DNS alone: whether a message is aligned depends on the From header at send time. Custom DKIM selectors cannot be enumerated either — only the 18 standard ones. That gap is why a report taken from aggregate reports, not DNS, is what an enforcement change should be based on.

Sender inventory and enforcement fix — CAD 1,250

Six files, delivered in two business days: the sender inventory, the verdict sheet, the copy-paste DNS change set for your provider, a dated enforcement plan, the fourteen-day aggregate-report read, and a day-30 attestation you can hand to a security questionnaire.

CAD 450 if you would rather apply the records yourself. There is no call — the report is the conversation. Full refund if the change set is not delivered in two business days.

Scan another domain