Who handles email for casper.com?
  14 services handle email for casper.com. 4 things need fixing.

  Google Workspace receives the domain's mail and has a DKIM key in place to sign it.
  Eleven other services are set up to send as the domain: four marketing (Campaign Monitor,         
  Iterable, Mailchimp, Salesforce Marketing Cloud Engagement), two commerce and apps (Docebo, Q4),  
  four transactional (Mailgun, Mandrill, Postmark, SendGrid), one support and CRM (Salesforce); one 
  more is likely from a DKIM key name alone (Customer.io).                                          
  One service shows an account and nothing set up to send (Microsoft 365); DMARC reports go to      
  DMARCian.                                                                                         

Who handles your email
  Each service below receives or sends email for casper.com.
  Receives your mail: your MX records deliver the domain's mail there.
  Set up to send: its records for sending are in your DNS.
  Likely sends: one clue points to it, such as a key named for it.
  Account only: an account exists, with nothing set up to send.

  ●  Google Workspace                Mailbox            Receives your mail  ⚠ setup incomplete      
  ●  Campaign Monitor                Marketing          Set up to send      ✓ setup complete        
  ●  Docebo                          Commerce and apps  Set up to send                              
  ●  Iterable                        Marketing          Set up to send                              
  ●  Mailchimp                       Marketing          Set up to send      ✓ setup complete        
  ●  Mailgun                         Transactional      Set up to send      ✓ setup complete        
  ●  Mandrill                        Transactional      Set up to send      ✓ setup complete        
  ●  Postmark                        Transactional      Set up to send      ✓ setup complete        
  ●  Q4                              Commerce and apps  Set up to send                              
  ●  Salesforce                      Support and CRM    Set up to send                              
  ●  Salesforce Marketing Cloud      Marketing          Set up to send                              
     Engagement (mail.casper.com)                                                                   
  ●  SendGrid                        Transactional      Set up to send      ✓ setup complete        
  ◐  Customer.io (e.casper.com)      Marketing          Likely sends        from: DKIM key          
  ○  Microsoft 365                   Mailbox            Account only        from: Verification token

What to fix
  Problems found in the setup, most serious first.

  1 ▲ Eight DKIM keys at casper.com are 1024-bit: google (Google Workspace), cm (Campaign Monitor), 
      k1 (Mailchimp), mandrill (Mandrill), salesforce (Salesforce), s2 (SendGrid), smtpapi          
      (SendGrid) and mx                                                                             
      Some receivers already treat 1024-bit RSA keys as weak. Rotate to 2048-bit.                   
        google._domainkey.casper.com TXT v=DKIM1; k=rsa; p=MIGfMA0GCSqG..., 1024-bit, fp            
        e6d74f2ed99fdbb5                                                                            
        cm._domainkey.casper.com TXT k=rsa; p=MIGfMA0GCSqG..., 1024-bit, fp 9347c624a5a8cd6f        
        k1._domainkey.casper.com TXT k=rsa; p=MIGfMA0GCSqG..., 1024-bit, fp 53d7bb0466c8346d via    
        dkim.mcsv.net                                                                               
        mandrill._domainkey.casper.com TXT v=DKIM1; k=rsa; p=MIGfMA0GCSqG..., 1024-bit, fp          
        9cee89b6f986543a                                                                            
        salesforce._domainkey.casper.com TXT v=DKIM1; k=rsa; p=MIGfMA0GCSqG..., 1024-bit, fp        
        2b895d381a879705                                                                            
        s2._domainkey.casper.com TXT k=rsa; t=s (strict); p=MIGfMA0GCSqG..., 1024-bit, fp           
        ea13ef38e66c6769 via s2.domainkey.u895984.wl235.sendgrid.net                                
        smtpapi._domainkey.casper.com TXT k=rsa; t=s (strict); p=MIGfMA0GCSqG..., 1024-bit, fp      
        303963420cfee1c6                                                                            
        mx._domainkey.casper.com TXT v=DKIM1; k=rsa; p=MIGfMA0GCSqG..., 1024-bit, fp                
        273e0630e2eb6478                                                                            
  2 ▲ Google Workspace at e.casper.com and mail.casper.com has no SPF                               
      Its documented setup needs it and the map shows it missing: the record does not authorize     
      _spf.google.com.                                                                              
        e.casper.com TXT v=spf1 include:mailgun.org ~all                                            
        mail.casper.com TXT v=spf1 include:cust-spf.exacttarget.com -all                            
  3 ▲ Google Workspace at e.casper.com and mail.casper.com has no DKIM                              
      Its documented setup needs it and the map shows it missing: no key at google._domainkey, a    
      name that does not exist.                                                                     
        google._domainkey.e.casper.com TXT no such name                                             
        google._domainkey.mail.casper.com TXT no such name                                          
  4 ▲ Google Workspace at orders.casper.com has no SPF                          
      Its documented setup needs it and the map shows it missing: no SPF record.
        orders.casper.com TXT no record of this type                            

Good to know
  Nothing to change here. These explain what the map shows.

  ·   The mte1 key at casper.com and the mte1 key at email.casper.com are the same key              
      They publish one public key, fp 402b5aebde0f1c9f, so one private key signs for all of them,   
      and replacing the key at one selector leaves it live at the others.                           
        mte1._domainkey.casper.com TXT v=DKIM1; k=rsa; p=MIIBIjANBgkq..., 2048-bit, fp              
        402b5aebde0f1c9f via dkim1.mandrillapp.com                                                  
        mte1._domainkey.email.casper.com TXT v=DKIM1; k=rsa; p=MIIBIjANBgkq..., 2048-bit, fp        
        402b5aebde0f1c9f via dkim1.mandrillapp.com                                                  
  ·   The mte2 key at casper.com and the mte2 key at email.casper.com are the same key              
      They publish one public key, fp bd970c8868f21f9b, so one private key signs for all of them,   
      and replacing the key at one selector leaves it live at the others.                           
        mte2._domainkey.casper.com TXT v=DKIM1; k=rsa; p=MIIBIjANBgkq..., 2048-bit, fp              
        bd970c8868f21f9b via dkim2.mandrillapp.com                                                  
        mte2._domainkey.email.casper.com TXT v=DKIM1; k=rsa; p=MIIBIjANBgkq..., 2048-bit, fp        
        bd970c8868f21f9b via dkim2.mandrillapp.com                                                  
  ·   Microsoft 365 shows only an account at casper.com                                             
      The records name an account (a verification token, an autodiscover CNAME, or a revoked or     
      dangling key) and nothing that sends or receives mail. Is the account still used? If not,     
      remove its records.                                                                           
        casper.com TXT MS=ms55520198                                                                

The proof, service by service
  The DNS records behind each service above, for anyone who wants to check them.
  MX: where the domain's mail is delivered.
  SPF: the list of servers allowed to send as the domain.
  DKIM: a signature key that proves mail really came from the domain.
  Tracking CNAME: links in a service's emails point here.
  Bounce CNAME: lets a service handle bounced mail under the domain's name.
  Delegated by NS: the service runs DNS for a sending subdomain.
  Verification token: proves the domain owner set up an account with the service.

  Google Workspace  ·  Mailbox  ·  receives your mail
    MX                          aspmx.l.google.com, alt1.aspmx.l.google.com and 3 more              
                                casper.com MX 1 aspmx.l.google.com                                  
                                casper.com MX 5 alt1.aspmx.l.google.com                             
                                casper.com MX 5 alt2.aspmx.l.google.com                             
                                casper.com MX 10 aspmx2.googlemail.com                              
                                casper.com MX 10 aspmx3.googlemail.com                              
    SPF                         include:_spf.google.com                                             
                                casper.com TXT include:_spf.google.com                              
    MX for a subdomain's mail   aspmx.l.google.com, alt1.aspmx.l.google.com and 5 more at           
                                e.casper.com, mail.casper.com and orders.casper.com                 
                                e.casper.com MX 1 aspmx.l.google.com                                
                                e.casper.com MX 5 alt1.aspmx.l.google.com                           
                                e.casper.com MX 5 alt2.aspmx.l.google.com                           
                                e.casper.com MX 10 alt3.aspmx.l.google.com                          
                                e.casper.com MX 10 alt4.aspmx.l.google.com                          
                                mail.casper.com MX 1 aspmx.l.google.com                             
                                mail.casper.com MX 5 alt1.aspmx.l.google.com                        
                                mail.casper.com MX 5 alt2.aspmx.l.google.com                        
                                mail.casper.com MX 10 alt3.aspmx.l.google.com                       
                                mail.casper.com MX 10 alt4.aspmx.l.google.com                       
                                orders.casper.com MX 25 aspmx.l.google.com                          
                                orders.casper.com MX 30 alt1.aspmx.l.google.com                     
                                orders.casper.com MX 30 alt2.aspmx.l.google.com                     
                                orders.casper.com MX 35 aspmx2.googlemail.com                       
                                orders.casper.com MX 35 aspmx3.googlemail.com                       
    DKIM keys                   google (1024 and 2048 bit, named for it) at casper.com and          
                                orders.casper.com                                                   
                                google._domainkey.casper.com TXT v=DKIM1; k=rsa; p=MIGfMA0GCSqG..., 
                                1024-bit, fp e6d74f2ed99fdbb5 via casper.com TXT                    
                                include:_spf.google.com                                             
                                google._domainkey.orders.casper.com TXT v=DKIM1; k=rsa;             
                                p=MIIBIjANBgkq..., 2048-bit, fp 66efacf170b65970 via                
                                orders.casper.com MX 25 aspmx.l.google.com                          
    Setup                       incomplete: SPF present at casper.com, DKIM present at casper.com   
                                and orders.casper.com, MX present at casper.com, e.casper.com,      
                                mail.casper.com and orders.casper.com, bounce CNAME not needed at   
                                casper.com, e.casper.com, mail.casper.com and orders.casper.com, SPF
                                missing at e.casper.com, mail.casper.com and orders.casper.com, DKIM
                                missing at e.casper.com and mail.casper.com                         

  Campaign Monitor  ·  Marketing  ·  set up to send
    SPF                         include:_spf.createsend.com                                         
                                casper.com TXT include:_spf.createsend.com                          
    DKIM key                    cm (1024 bit, named for it)                                         
                                cm._domainkey.casper.com TXT k=rsa; p=MIGfMA0GCSqG..., 1024-bit, fp 
                                9347c624a5a8cd6f via casper.com TXT include:_spf.createsend.com     
    Setup                       complete: DKIM present                                              

  Docebo  ·  Commerce and apps  ·  set up to send
    SPF                         include:docebosaas.com               
                                casper.com TXT include:docebosaas.com

  Iterable  ·  Marketing  ·  set up to send
    Tracking CNAME              links.casper.com                         
                                links.casper.com CNAME links.iterable.com

  Mailchimp  ·  Marketing  ·  set up to send
    DKIM key                    k1 (1024 bit, by CNAME)                                             
                                k1._domainkey.casper.com TXT k=rsa; p=MIGfMA0GCSqG..., 1024-bit, fp 
                                53d7bb0466c8346d via dkim.mcsv.net                                  
    Setup                       complete: DKIM present (older setup: a key at k1; the current setup 
                                names k2), SPF not needed, bounce CNAME not needed                  

  Mailgun  ·  Transactional  ·  set up to send
    MX for bounces              mxa.mailgun.org, mxb.mailgun.org at e.casper.com and t.casper.com   
                                e.casper.com MX 10 mxa.mailgun.org                                  
                                e.casper.com MX 10 mxb.mailgun.org                                  
                                t.casper.com MX 10 mxa.mailgun.org                                  
                                t.casper.com MX 10 mxb.mailgun.org                                  
    SPF                         include:mailgun.org at e.casper.com and t.casper.com                
                                e.casper.com TXT include:mailgun.org                                
                                t.casper.com TXT include:mailgun.org                                
    Setup                       complete: SPF present at e.casper.com and t.casper.com, MX present  
                                at e.casper.com and t.casper.com, tracking CNAME not checked (no    
                                label was asked at e.casper.com) at e.casper.com, tracking CNAME not
                                checked (no label was asked at t.casper.com) at t.casper.com        

  Mandrill  ·  Transactional  ·  set up to send
    DKIM keys                   mte1, mte2 (all 2048 bit, by CNAME) at casper.com and               
                                email.casper.com                                                    
                                mte1._domainkey.casper.com TXT v=DKIM1; k=rsa; p=MIIBIjANBgkq...,   
                                2048-bit, fp 402b5aebde0f1c9f via dkim1.mandrillapp.com             
                                mte2._domainkey.casper.com TXT v=DKIM1; k=rsa; p=MIIBIjANBgkq...,   
                                2048-bit, fp bd970c8868f21f9b via dkim2.mandrillapp.com             
                                mte1._domainkey.email.casper.com TXT v=DKIM1; k=rsa;                
                                p=MIIBIjANBgkq..., 2048-bit, fp 402b5aebde0f1c9f via                
                                dkim1.mandrillapp.com                                               
                                mte2._domainkey.email.casper.com TXT v=DKIM1; k=rsa;                
                                p=MIIBIjANBgkq..., 2048-bit, fp bd970c8868f21f9b via                
                                dkim2.mandrillapp.com                                               
    SPF                         include:spf.mandrillapp.com at email.casper.com                     
                                email.casper.com TXT include:spf.mandrillapp.com                    
    DKIM key                    mandrill (1024 bit, named for it)                                   
                                mandrill._domainkey.casper.com TXT v=DKIM1; k=rsa;                  
                                p=MIGfMA0GCSqG..., 1024-bit, fp 9cee89b6f986543a                    
    Setup                       complete: DKIM present at casper.com and email.casper.com, bounce   
                                CNAME not used (optional, CNAME at 25 labels under casper.com) at   
                                casper.com, tracking CNAME not used (optional, CNAME at 25 labels   
                                under casper.com) at casper.com, bounce CNAME not checked (no label 
                                was asked at email.casper.com) at email.casper.com, tracking CNAME  
                                not checked (no label was asked at email.casper.com) at             
                                email.casper.com                                                    

  Postmark  ·  Transactional  ·  set up to send
    Bounce CNAME                pm-bounces.casper.com                         
                                pm-bounces.casper.com CNAME pm.mtasv.net      
    Setup                       complete: SPF not needed, bounce CNAME present

  Q4  ·  Commerce and apps  ·  set up to send
    SPF                         include:_spf.q4press.com               
                                casper.com TXT include:_spf.q4press.com

  Salesforce  ·  Support and CRM  ·  set up to send
    SPF                         include:_spf.salesforce.com                                         
                                casper.com TXT include:_spf.salesforce.com                          
    DKIM key                    salesforce (1024 bit, named for it)                                 
                                salesforce._domainkey.casper.com TXT v=DKIM1; k=rsa;                
                                p=MIGfMA0GCSqG..., 1024-bit, fp 2b895d381a879705 via casper.com TXT 
                                include:_spf.salesforce.com                                         

  Salesforce Marketing Cloud Engagement  ·  Marketing  ·  set up to send  at mail.casper.com
    SPF                         include:cust-spf.exacttarget.com                    
                                mail.casper.com TXT include:cust-spf.exacttarget.com
    Delegated by NS             mail.casper.com                                     
                                mail.casper.com NS ns1.exacttarget.com              

  SendGrid  ·  Transactional  ·  set up to send
    DKIM keys                   s1 2048 bit, s2 1024 bit (by CNAME)                                 
                                s1._domainkey.casper.com TXT k=rsa; t=s (strict); p=MIIBIjANBgkq...,
                                2048-bit, fp fdc0f9d77c779856 via                                   
                                s1.domainkey.u895984.wl235.sendgrid.net                             
                                s2._domainkey.casper.com TXT k=rsa; t=s (strict); p=MIGfMA0GCSqG...,
                                1024-bit, fp ea13ef38e66c6769 via                                   
                                s2.domainkey.u895984.wl235.sendgrid.net                             
    DKIM key                    smtpapi (1024 bit, named for it)                                    
                                smtpapi._domainkey.casper.com TXT k=rsa; t=s (strict);              
                                p=MIGfMA0GCSqG..., 1024-bit, fp 303963420cfee1c6                    
    Setup                       complete: DKIM present, bounce CNAME not used (optional, CNAME at 25
                                labels under casper.com), SPF not needed, tracking CNAME not used   
                                (optional, CNAME at 25 labels under casper.com)                     

  Customer.io  ·  Marketing  ·  likely sends  at e.casper.com
    DKIM key                    krs (2048 bit, named for it)                                        
                                krs._domainkey.e.casper.com TXT k=rsa; p=MIIBIjANBgkq..., 2048-bit, 
                                fp 1eb1e97f362ad520                                                 
    Setup                       complete: tracking CNAME not checked (no label was asked at         
                                e.casper.com)                                                       

  Microsoft 365  ·  Mailbox  ·  account only
    Verification token          MS=ms55520198                                                       
                                casper.com TXT MS=ms55520198                                        
    Setup                       incomplete: SPF missing (the record does not authorize              
                                spf.protection.outlook.com), DKIM missing (no key at                
                                selector1._domainkey or selector2._domainkey, names with no TXT     
                                record; this zone gives that answer for every name that does not    
                                exist), MX not used (optional, MX at casper.com), bounce CNAME not  
                                needed                                                              

Not matched to a service
  These records point somewhere Sendermap does not recognise: a service it does not know yet, or    
  your own servers.                                                                                 

  DKIM key: mx
    mx._domainkey.casper.com TXT v=DKIM1; k=rsa; p=MIGfMA0GCSqG..., 1024-bit, fp 273e0630e2eb6478
  IP address in SPF: 208.89.14.209 (AS11054, LIVEPERSON - LivePerson, Inc., US)
    casper.com TXT ip4:208.89.14.209
  mail server: incoming.bm23.com  at email.casper.com
    email.casper.com MX 20 incoming.bm23.com

Looked for and not found
  Records Sendermap looked for and did not find.

  DKIM keys at t.casper.com: selectors exist but none of the 32 names asked is one
    _domainkey.t.casper.com TXT no record of this type

How this was checked
  Checked 2026-10-12 01:25 UTC: 757 DNS lookups in 0.0 s over Google DNS over HTTPS.
  At casper.com: 114 possible DKIM key names, 25 service record names, 1 web page.
    Pages:                                                                                          
    https://api.certspotter.com/v1/issuances?domain=casper.com&include_subdomains=true&expand=dns_na
    mes                                                                                             
    CNAME labels: bounce, bounces, em, email, mail, send, mta, rp, pm-bounces, links, link, click,  
    track, tracking, url, go, autodiscover, cf-bounce, eversrv, fwdkim1, bnc3, bounces.cloud.em,    
    bounces.cloud2.em, outbound.intercom, atlassian-bounces                                         
    DKIM selectors: google, gapps, acdkim1, acdkim2, ses, aweber_key_a, aweber_key_b, aweber_key_c, 
    brevo, brevo1, brevo2, cm, cf2024-1, ctct1, ctct2, krs, e2ma-k1, e2ma-k2, e2ma-k3,              
    everlytickey1, everlytickey2, fm2, fm1, fm3, mesmtp, secureserver1, secureserver2, gor, strong1,
    strong2, hs1, hs2, intercom, s1-ionos, s42582890, s2-ionos, cka, kl, kl1, kl2, km1, km2, k2, k1,
    k3, litesrv, mg, mailgun, mg1, pdk1, pdk2, mailjet, mailpoet2, mailpoet1, mandrill, mte1, mte2, 
    marketo, mkto, mkto1, selector1, selector2, mimecast, mimecast20190719, pepipost, pp1,          
    protonmail, protonmail2, protonmail3, resend, sailthru, salesforce, salesforce2, salesforce1,   
    sf, sf1, sf2, sfdc, 200608, pardot, sfmc, s1, s2, smtpapi, scph0819, sparkpost, squarespace,    
    zendesk1, zendesk2, zoho, mail, mailru, api, default, dk, dkim, dkim1, dkim2, email, k, key,    
    key1, key2, mta, mx, pm, s, selector, smtp, sp, 20161025, 20210112, 20221208, 20230601          
  At e.casper.com: 36 possible DKIM key names.
    DKIM selectors: acdkim1, acdkim2, ses, aweber_key_a, aweber_key_b, aweber_key_c, brevo, brevo1, 
    brevo2, cm, cf2024-1, ctct1, ctct2, krs, e2ma-k1, e2ma-k2, e2ma-k3, everlytickey1,              
    everlytickey2, fm2, fm1, fm3, mesmtp, secureserver1, secureserver2, google, gapps, mailgun, mg, 
    mg1, pdk1, pdk2, 20161025, 20210112, 20221208, 20230601                                         
  At email.casper.com: 30 possible DKIM key names.
    DKIM selectors: acdkim1, acdkim2, ses, aweber_key_a, aweber_key_b, aweber_key_c, brevo, brevo1, 
    brevo2, cm, cf2024-1, ctct1, ctct2, krs, e2ma-k1, e2ma-k2, e2ma-k3, everlytickey1,              
    everlytickey2, fm2, fm1, fm3, mesmtp, secureserver1, secureserver2, google, gapps, mandrill,    
    mte1, mte2                                                                                      
  At mail.casper.com: 32 possible DKIM key names.
    DKIM selectors: acdkim1, acdkim2, ses, aweber_key_a, aweber_key_b, aweber_key_c, brevo, brevo1, 
    brevo2, cm, cf2024-1, ctct1, ctct2, krs, e2ma-k1, e2ma-k2, e2ma-k3, everlytickey1,              
    everlytickey2, fm2, fm1, fm3, mesmtp, secureserver1, secureserver2, google, gapps, sfmc,        
    20161025, 20210112, 20221208, 20230601                                                          
  At orders.casper.com: 31 possible DKIM key names.
    DKIM selectors: acdkim1, acdkim2, ses, aweber_key_a, aweber_key_b, aweber_key_c, brevo, brevo1, 
    brevo2, cm, cf2024-1, ctct1, ctct2, krs, e2ma-k1, e2ma-k2, e2ma-k3, everlytickey1,              
    everlytickey2, fm2, fm1, fm3, mesmtp, secureserver1, secureserver2, google, gapps, 20161025,    
    20210112, 20221208, 20230601                                                                    
  At t.casper.com: 32 possible DKIM key names.
    DKIM selectors: acdkim1, acdkim2, ses, aweber_key_a, aweber_key_b, aweber_key_c, brevo, brevo1, 
    brevo2, cm, cf2024-1, ctct1, ctct2, krs, e2ma-k1, e2ma-k2, e2ma-k3, everlytickey1,              
    everlytickey2, fm2, fm1, fm3, mesmtp, secureserver1, secureserver2, google, gapps, mailgun, mg, 
    mg1, pdk1, pdk2                                                                                 
  Not checked: DKIM selectors at e.casper.com: 78 of 114 not asked. The first 27 were asked, plus   
  any the name's own SPF, MX or delegation points to (cap 27).                                      
  Not checked: DKIM selectors at email.casper.com: 80 of 110 not asked. The first 27 were asked,    
  plus any the name's own SPF, MX or delegation points to (cap 27).                                 
  Not checked: DKIM selectors at mail.casper.com: 82 of 114 not asked. The first 27 were asked, plus
  any the name's own SPF, MX or delegation points to (cap 27).                                      
  Not checked: DKIM selectors at orders.casper.com: 83 of 114 not asked. The first 27 were asked,   
  plus any the name's own SPF, MX or delegation points to (cap 27).                                 
  Not checked: DKIM selectors at t.casper.com: 78 of 110 not asked. The first 27 were asked, plus   
  any the name's own SPF, MX or delegation points to (cap 27).                                      
  Not run: the website. Web checks were turned off (--no-web).
  Not run: certificate transparency, crt.sh. Read only with --ct (it also holds expired             
  certificates).                                                                                    
