Who handles email for mills-reeve.com?
  5 services handle email for mills-reeve.com. 2 things need fixing.

  Mimecast stands in front of the domain's mail as a security gateway, so the mailbox provider is   
  not visible from MX.                                                                              
  Four other services are set up to send as the domain: one commerce and apps (Docebo), one support 
  and CRM (Freshdesk), one mailbox (Microsoft 365), one transactional (SendGrid).                   
  DMARC reports go to Mimecast DMARC Analyzer.

Who handles your email
  Each service below receives or sends email for mills-reeve.com.
  Receives your mail: your MX records deliver the domain's mail there.
  Set up to send: its records for sending are in your DNS.

  ●  Mimecast       Security gateway   Receives your mail                    
  ●  Docebo         Commerce and apps  Set up to send                        
  ●  Freshdesk      Support and CRM    Set up to send                        
  ●  Microsoft 365  Mailbox            Set up to send      ⚠ setup incomplete
  ●  SendGrid       Transactional      Set up to send      ✓ setup complete  

What to fix
  Problems found in the setup, most serious first.

  1 ▲ The SendGrid key s2 at mills-reeve.com is 1024-bit                                            
      Some receivers already treat 1024-bit RSA keys as weak. Rotate to 2048-bit.                   
        s2._domainkey.mills-reeve.com TXT k=rsa; t=s (strict); p=MIGfMA0GCSqG..., 1024-bit, fp      
        1d0c1f3114d84753 via s2.domainkey.u10198980.wl231.sendgrid.net                              
  2 ▲ Microsoft 365 at mills-reeve.com has no DKIM                                                  
      Its documented setup needs it and the map shows it missing: no key at selector1._domainkey or 
      selector2._domainkey, names with no TXT record; this zone gives that answer for every name    
      that does not exist.                                                                          
        selector1._domainkey.mills-reeve.com TXT no record of this type                             
        selector2._domainkey.mills-reeve.com TXT no record of this type                             

Good to know
  Nothing to change here. These explain what the map shows.

  ·   MX at mills-reeve.com points at Mimecast, a security gateway                                  
      Inferred from the MX records: a security gateway filters incoming mail and hands it on to the 
      server that holds the mailboxes, and MX records do not say which server that is.              
        mills-reeve.com MX 10 eu-smtp-inbound-1.mimecast.com                                        
        mills-reeve.com MX 10 eu-smtp-inbound-2.mimecast.com                                        

The proof, service by service
  The DNS records behind each service above, for anyone who wants to check them.
  MX: where the domain's mail is delivered.
  SPF: the list of servers allowed to send as the domain.
  Verification token: proves the domain owner set up an account with the service.
  Autodiscover: lets mail apps find their settings.
  DKIM: a signature key that proves mail really came from the domain.

  Mimecast  ·  Security gateway  ·  receives your mail
    MX                   eu-smtp-inbound-1.mimecast.com, eu-smtp-inbound-2.mimecast.com             
                         mills-reeve.com MX 10 eu-smtp-inbound-1.mimecast.com                       
                         mills-reeve.com MX 10 eu-smtp-inbound-2.mimecast.com                       
    SPF                  include:eu._netblocks.mimecast.com, include:_netblocks.mimecast.com at     
                         mills-reeve.com and update.mills-reeve.com                                 
                         mills-reeve.com TXT include:eu._netblocks.mimecast.com                     
                         update.mills-reeve.com TXT include:_netblocks.mimecast.com                 

  Docebo  ·  Commerce and apps  ·  set up to send
    SPF                  include:docebosaas.com                    
                         mills-reeve.com TXT include:docebosaas.com

  Freshdesk  ·  Support and CRM  ·  set up to send
    SPF range            ip4:3.120.181.200/29                                                       
                         fsspfeuc.freshemail.io TXT ip4:3.120.181.200/29 via fdspfeuc.freshemail.io 
                         TXT ip4:3.120.181.192/28                                                   

  Microsoft 365  ·  Mailbox  ·  set up to send
    SPF                  include:spf.protection.outlook.com                                         
                         mills-reeve.com TXT include:spf.protection.outlook.com                     
    Verification token   MS=ms75548982                                                              
                         mills-reeve.com TXT MS=ms75548982                                          
    Autodiscover CNAME   autodiscover.mills-reeve.com                                               
                         autodiscover.mills-reeve.com CNAME autodiscover.outlook.com                
    Setup                incomplete: SPF present, DKIM missing, MX not used (optional, MX at        
                         mills-reeve.com), bounce CNAME not needed                                  

  SendGrid  ·  Transactional  ·  set up to send
    DKIM keys            s1 2048 bit, s2 1024 bit (by CNAME)                                        
                         s1._domainkey.mills-reeve.com TXT k=rsa; t=s (strict); p=MIIBIjANBgkq...,  
                         2048-bit, fp ae8406c18072b4fc via s1.domainkey.u10198980.wl231.sendgrid.net
                         s2._domainkey.mills-reeve.com TXT k=rsa; t=s (strict); p=MIGfMA0GCSqG...,  
                         1024-bit, fp 1d0c1f3114d84753 via s2.domainkey.u10198980.wl231.sendgrid.net
    Setup                complete: DKIM present, bounce CNAME not used (optional, CNAME at 25 labels
                         under mills-reeve.com), SPF not needed, tracking CNAME not used (optional, 
                         CNAME at 25 labels under mills-reeve.com)                                  

Not matched to a service
  These records point somewhere Sendermap does not recognise: a service it does not know yet, or    
  your own servers.                                                                                 

  SPF include: emaileuc.freshservice.com
    mills-reeve.com TXT include:emaileuc.freshservice.com
  SPF include: fsspfeuc.freshemail.io
    emaileuc.freshservice.com TXT include:fsspfeuc.freshemail.io
  SPF include: spf-uk.vx-email.com
    mills-reeve.com TXT include:spf-uk.vx-email.com
  IP address in SPF: 51.145.78.124 (AS8075, Microsoft)
    mills-reeve.com TXT ip4:51.145.78.124
  2 ranges in AS16509 (Amazon Web Services)
    35.159.219.224/28, 18.199.180.160/27
    fsspfeuc.freshemail.io TXT ip4:35.159.219.224/28
    fsspfeuc.freshemail.io TXT ip4:18.199.180.160/27
  IP range in SPF: 193.5.144.0/24 (AS14618, Amazon Web Services)
    spf-uk.vx-email.com TXT ip4:193.5.144.0/24
  4 addresses in AS2110 (AS-BTIRE - Enet Communications LIMITED, IE)
    193.120.143.138, 193.120.143.134, 193.120.143.70, 193.120.142.176
    mills-reeve.com TXT ip4:193.120.143.138
    mills-reeve.com TXT ip4:193.120.143.134
    mills-reeve.com TXT ip4:193.120.143.70
    mills-reeve.com TXT ip4:193.120.142.176
  SPF include: spf-uk.vx-email.com  at update.mills-reeve.com
    update.mills-reeve.com TXT include:spf-uk.vx-email.com
  mail server: mx01.mail.vx-email.com  at update.mills-reeve.com
    update.mills-reeve.com MX 10 mx01.mail.vx-email.com
  mail server: mx02.mail.vx-email.com  at update.mills-reeve.com
    update.mills-reeve.com MX 20 mx02.mail.vx-email.com
  IP range in SPF: 193.5.144.0/24 (AS14618, Amazon Web Services)  at update.mills-reeve.com
    spf-uk.vx-email.com TXT ip4:193.5.144.0/24
  SPF include: cecollect.com  at updates.mills-reeve.com
    updates.mills-reeve.com TXT include:cecollect.com
  mail server: mail.cecollect.com  at updates.mills-reeve.com
    updates.mills-reeve.com MX 10 mail.cecollect.com
  1 range and 11 addresses in AS2914 (NTT-DATA-2914 - NTT America, Inc., US)  at                    
  updates.mills-reeve.com                                                                           
    62.73.189.146, 83.231.138.176/28, 62.73.162.65, 62.73.162.66, 62.73.162.67, 62.73.162.68,       
    62.73.162.69, 62.73.162.70, 62.73.162.71, 62.73.162.72, 62.73.162.73, 62.73.162.74              
    cecollect.com TXT ip4:62.73.189.146
    cecollect.com TXT ip4:83.231.138.176/28
    cecollect.com TXT ip4:62.73.162.65
    cecollect.com TXT ip4:62.73.162.66
    cecollect.com TXT ip4:62.73.162.67
    cecollect.com TXT ip4:62.73.162.68
    cecollect.com TXT ip4:62.73.162.69
    cecollect.com TXT ip4:62.73.162.70
    cecollect.com TXT ip4:62.73.162.71
    cecollect.com TXT ip4:62.73.162.72
    cecollect.com TXT ip4:62.73.162.73
    cecollect.com TXT ip4:62.73.162.74

How this was checked
  Checked 2026-10-12 01:24 UTC: 644 DNS lookups in 0.0 s over Google DNS over HTTPS.
  At mills-reeve.com: 110 possible DKIM key names, 25 service record names, 1 web page.
    Pages:                                                                                          
    https://api.certspotter.com/v1/issuances?domain=mills-reeve.com&include_subdomains=true&expand=d
    ns_names                                                                                        
    CNAME labels: bounce, bounces, em, email, mail, send, mta, rp, pm-bounces, links, link, click,  
    track, tracking, url, go, autodiscover, cf-bounce, eversrv, fwdkim1, bnc3, bounces.cloud.em,    
    bounces.cloud2.em, outbound.intercom, atlassian-bounces                                         
    DKIM selectors: selector1, selector2, acdkim1, acdkim2, ses, aweber_key_a, aweber_key_b,        
    aweber_key_c, brevo, brevo1, brevo2, cm, cf2024-1, ctct1, ctct2, krs, e2ma-k1, e2ma-k2, e2ma-k3,
    everlytickey1, everlytickey2, fm2, fm1, fm3, mesmtp, secureserver1, secureserver2, google,      
    gapps, gor, strong1, strong2, hs1, hs2, intercom, s1-ionos, s42582890, s2-ionos, cka, kl, kl1,  
    kl2, km1, km2, k2, k1, k3, litesrv, mg, mailgun, mg1, pdk1, pdk2, mailjet, mailpoet2, mailpoet1,
    mandrill, mte1, mte2, marketo, mkto, mkto1, mimecast, mimecast20190719, pepipost, pp1,          
    protonmail, protonmail2, protonmail3, resend, sailthru, salesforce, salesforce2, salesforce1,   
    sf, sf1, sf2, sfdc, 200608, pardot, sfmc, s1, s2, smtpapi, scph0819, sparkpost, squarespace,    
    zendesk1, zendesk2, zoho, mail, mailru, api, default, dk, dkim, dkim1, dkim2, email, k, key,    
    key1, key2, mta, mx, pm, s, selector, smtp, sp                                                  
  At update.mills-reeve.com: 29 possible DKIM key names.
    DKIM selectors: acdkim1, acdkim2, ses, aweber_key_a, aweber_key_b, aweber_key_c, brevo, brevo1, 
    brevo2, cm, cf2024-1, ctct1, ctct2, krs, e2ma-k1, e2ma-k2, e2ma-k3, everlytickey1,              
    everlytickey2, fm2, fm1, fm3, mesmtp, secureserver1, secureserver2, google, gapps, mimecast,    
    mimecast20190719                                                                                
  At updates.mills-reeve.com: 27 possible DKIM key names.
    DKIM selectors: acdkim1, acdkim2, ses, aweber_key_a, aweber_key_b, aweber_key_c, brevo, brevo1, 
    brevo2, cm, cf2024-1, ctct1, ctct2, krs, e2ma-k1, e2ma-k2, e2ma-k3, everlytickey1,              
    everlytickey2, fm2, fm1, fm3, mesmtp, secureserver1, secureserver2, google, gapps               
  Not checked: DKIM selectors at update.mills-reeve.com: 81 of 110 not asked. The first 27 were     
  asked, plus any the name's own SPF, MX or delegation points to (cap 27).                          
  Not checked: DKIM selectors at updates.mills-reeve.com: 83 of 110 not asked. The first 27 were    
  asked, plus any the name's own SPF, MX or delegation points to (cap 27).                          
  Not run: the website. Web checks were turned off (--no-web).
  Not run: certificate transparency, crt.sh. Read only with --ct (it also holds expired             
  certificates).                                                                                    
