Who handles email for mills-reeve.com?
  5 services handle email for mills-reeve.com. 2 things need fixing.

  Mimecast stands in front of the domain's mail as a security gateway, so the mailbox provider is   
  not visible from MX.                                                                              
  Four other services are set up to send as the domain: one commerce and apps (Docebo), one support 
  and CRM (Freshdesk), one mailbox (Microsoft 365), one transactional (SendGrid).                   
  DMARC reports go to Mimecast DMARC Analyzer.

Who handles your email
  Each service below receives or sends email for mills-reeve.com.
  Receives your mail: your MX records deliver the domain's mail there.
  Set up to send: its records for sending are in your DNS.

  ●  Mimecast       Security gateway   Receives your mail                    
  ●  Docebo         Commerce and apps  Set up to send                        
  ●  Freshdesk      Support and CRM    Set up to send                        
  ●  Microsoft 365  Mailbox            Set up to send      ⚠ setup incomplete
  ●  SendGrid       Transactional      Set up to send      ✓ setup complete  

What to fix
  Problems found in the setup, most serious first.

  1 ▲ The SendGrid key s2 at mills-reeve.com is 1024-bit                         
      Some receivers already treat 1024-bit RSA keys as weak. Rotate to 2048-bit.
  2 ▲ Microsoft 365 at mills-reeve.com has no DKIM                                                  
      Its documented setup needs it and the map shows it missing: no key at selector1._domainkey or 
      selector2._domainkey, names with no TXT record; this zone gives that answer for every name    
      that does not exist.                                                                          

Good to know
  Nothing to change here. These explain what the map shows.

  ·   MX at mills-reeve.com points at Mimecast, a security gateway                                  
      Inferred from the MX records: a security gateway filters incoming mail and hands it on to the 
      server that holds the mailboxes, and MX records do not say which server that is.              

The proof, service by service
  The DNS records behind each service above, for anyone who wants to check them.
  MX: where the domain's mail is delivered.
  SPF: the list of servers allowed to send as the domain.
  Verification token: proves the domain owner set up an account with the service.
  Autodiscover: lets mail apps find their settings.
  DKIM: a signature key that proves mail really came from the domain.

  Mimecast  ·  Security gateway  ·  receives your mail
    MX                   eu-smtp-inbound-1.mimecast.com, eu-smtp-inbound-2.mimecast.com             
    SPF                  include:eu._netblocks.mimecast.com, include:_netblocks.mimecast.com at     
                         mills-reeve.com and update.mills-reeve.com                                 

  Docebo  ·  Commerce and apps  ·  set up to send
    SPF                  include:docebosaas.com

  Freshdesk  ·  Support and CRM  ·  set up to send
    SPF range            ip4:3.120.181.200/29

  Microsoft 365  ·  Mailbox  ·  set up to send
    SPF                  include:spf.protection.outlook.com
    Verification token   MS=ms75548982                     
    Autodiscover CNAME   autodiscover.mills-reeve.com      
    Setup                incomplete: DKIM missing          

  SendGrid  ·  Transactional  ·  set up to send
    DKIM keys            s1 2048 bit, s2 1024 bit (by CNAME)
    Setup                complete                           

Not matched to a service
  These records point somewhere Sendermap does not recognise: a service it does not know yet, or    
  your own servers.                                                                                 

  SPF include: emaileuc.freshservice.com
  SPF include: fsspfeuc.freshemail.io
  SPF include: spf-uk.vx-email.com
  IP address in SPF: 51.145.78.124 (AS8075, Microsoft)
  2 ranges in AS16509 (Amazon Web Services)
    35.159.219.224/28, 18.199.180.160/27
    fsspfeuc.freshemail.io TXT ip4:35.159.219.224/28
    + 1 more
  IP range in SPF: 193.5.144.0/24 (AS14618, Amazon Web Services)
  4 addresses in AS2110 (AS-BTIRE - Enet Communications LIMITED, IE)
    193.120.143.138, 193.120.143.134, 193.120.143.70, 193.120.142.176
    mills-reeve.com TXT ip4:193.120.143.138
    + 3 more
  SPF include: spf-uk.vx-email.com  at update.mills-reeve.com
  mail server: mx01.mail.vx-email.com  at update.mills-reeve.com
  mail server: mx02.mail.vx-email.com  at update.mills-reeve.com
  IP range in SPF: 193.5.144.0/24 (AS14618, Amazon Web Services)  at update.mills-reeve.com
  SPF include: cecollect.com  at updates.mills-reeve.com
  mail server: mail.cecollect.com  at updates.mills-reeve.com
  1 range and 11 addresses in AS2914 (NTT-DATA-2914 - NTT America, Inc., US)  at                    
  updates.mills-reeve.com                                                                           
    62.73.189.146, 83.231.138.176/28, 62.73.162.65, 62.73.162.66, 62.73.162.67, 62.73.162.68,       
    62.73.162.69, 62.73.162.70, 62.73.162.71, 62.73.162.72, 62.73.162.73, 62.73.162.74              
    cecollect.com TXT ip4:62.73.189.146
    + 11 more

How this was checked
  Checked 2026-10-12 01:24 UTC: 646 DNS lookups in 0.0 s over Google DNS over HTTPS.
  At mills-reeve.com: 110 possible DKIM key names, 25 service record names, 1 web page.
  At update.mills-reeve.com: 29 possible DKIM key names.
  At updates.mills-reeve.com: 27 possible DKIM key names.
  Not checked: DKIM selectors at update.mills-reeve.com: 81 of 110 not asked. The first 27 were     
  asked, plus any the name's own SPF, MX or delegation points to (cap 27).                          
  Not checked: DKIM selectors at updates.mills-reeve.com: 83 of 110 not asked. The first 27 were    
  asked, plus any the name's own SPF, MX or delegation points to (cap 27).                          
  Not run: the website. Web checks were turned off (--no-web).
  Not run: certificate transparency, crt.sh. Read only with --ct (it also holds expired             
  certificates).                                                                                    
  Add --evidence to see every record behind each line.
