Public DNS · scanned 2026-11-06 21:09 UTC
well.ca
NOT ENFORCED
The policy is p=none: 100% of this domain's mail is exempt from any DMARC decision, and that has been the posture since before the bulk-sender rules took effect.
| Check | What the record says | |
|---|---|---|
| ! | SPF record | Present but ends in - — unauthorised senders are soft-failed, not refused. |
| ✓ | SPF under the lookup limit | 4 of 10 permitted lookups. |
| ✓ | DKIM keys discoverable | 2 of 18 standard selectors present. |
| ✓ | DMARC record | Present. |
| × | Policy is enforced | p=none. The record satisfies a checklist and protects nothing — anyone can still send as this domain. |
| ✓ | Aggregate reports collected | rua= present. Someone can see who is sending. |
| ! | Transport security published | No TLS-RPT. No MTA-STS. Inbound TLS failures are invisible to the sender. |
| ! | BIMI logo | No BIMI record, and the policy is not strict enough to be eligible. |
The records, as published
- SPF
v=spf1 mx include:ca._netblocks.mimecast.com include:spf.protection.outlook.com include:amazonses.com ip4:209.171.113.96/32 -all- DMARC
v=DMARC1; p=none; adkim=r; aspf=r; rua=mailto:dmarc@well.ca; ruf=mailto:dmarc@well.ca; fo=1- DKIM
s1rsa 256s2rsa 256- MX
ca-smtp-inbound-2.mimecast.comca-smtp-inbound-1.mimecast.com- Transport
- no TLS-RPT; no MTA-STS
- BIMI
- absent
- Lookups
- 4 of 10 permitted
What this scan cannot see
Alignment is not verifiable from DNS alone: whether a message is aligned depends on the From header at send time. Custom DKIM selectors cannot be enumerated either — only the 18 standard ones. That gap is why a report taken from aggregate reports, not DNS, is what an enforcement change should be based on.
Sender inventory and enforcement fix — CAD 1,250
Six files, delivered in two business days: the sender inventory, the verdict sheet, the copy-paste DNS change set for your provider, a dated enforcement plan, the fourteen-day aggregate-report read, and a day-30 attestation you can hand to a security questionnaire.
CAD 450 if you would rather apply the records yourself. There is no call — the report is the conversation. Full refund if the change set is not delivered in two business days.