Who handles your email

Each service below receives or sends email for cognifit.com.

Receives your mail: your MX records deliver the domain's mail there.
Set up to send: its records for sending are in your DNS.
Likely sends: one clue points to it, such as a key named for it.
Account only: an account exists, with nothing set up to send.

Service	Category	Status	Setup
Google Workspace	Mailbox	Receives your mail	✓ setup complete
Amazon SES	Transactional	Set up to send
Mailchimp	Marketing	Set up to send	✓ setup complete
Salesforce	Support and CRM	Set up to send
SendGrid	Transactional	Set up to send	✓ setup complete
Resend	Transactional	Likely sends	from: DKIM key
Microsoft 365	Mailbox	Account only	from: Verification token

What to fix

Problems found in the setup, most serious first.

SPF at cognifit.com includes ses.amazonaws.com, which publishes no SPF record

cognifit.com names ses.amazonaws.com, which publishes no SPF record. A receiver that reaches it returns an error (RFC 7208, section 5.2), so SPF fails for every message no term before it matches.
Records
- cognifit.com TXT include:ses.amazonaws.com
- ses.amazonaws.com TXT no such name
Four DKIM keys at cognifit.com are 1024-bit: google (Google Workspace), smtpapi (SendGrid), k1 (Mailchimp) and resend (Resend)

Some receivers already treat 1024-bit RSA keys as weak. Rotate to 2048-bit.
Records
- google._domainkey.cognifit.com TXT v=DKIM1; k=rsa; p=MIGfMA0GCSqG..., 1024-bit, fp 4e8ac6498dd9c824
- smtpapi._domainkey.cognifit.com TXT k=rsa; t=s (strict); p=MIGfMA0GCSqG..., 1024-bit, fp 303963420cfee1c6
- k1._domainkey.cognifit.com TXT k=rsa; p=MIGfMA0GCSqG..., 1024-bit, fp 53d7bb0466c8346d via dkim.mcsv.net
- resend._domainkey.cognifit.com TXT p=MIGfMA0GCSqG..., 1024-bit, fp 79fdb68489379af3

Good to know

Nothing to change here. These explain what the map shows.

DNS says _domainkey.cognifit.com does not exist, but a key sits under it. The domain's DNS servers answer no such name for _domainkey.cognifit.com, yet google._domainkey.cognifit.com has a key. Under RFC 8020 a no-such-name answer covers every name below it, so a resolver that applies the rule can fail to find the domain's DKIM keys. Most resolvers still look them up; the fault is in the DNS host and is theirs to fix. Every selector was asked.
Records
- _domainkey.cognifit.com TXT no such name
- google._domainkey.cognifit.com TXT v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCSK9vG9EwIOraIciyPJQmF+WQuM3ukHleazmVT6akMyGgYj/QMcQGBe2bbPkdNuQSloTvwGGDg3sTQnzsENpMYfflvfeg0XNk5jV3K0o3AuRQqiRM7UeOlIHGVJHGpTeQMJng22JWPs/ND6fbUZhZuv+FjwA9LgahKzVR8APnaQQIDAQAB
Microsoft 365 shows only an account at cognifit.com. The records name an account (a verification token, an autodiscover CNAME, or a revoked or dangling key) and nothing that sends or receives mail. Is the account still used? If not, remove its records.
Records
- cognifit.com TXT MS=ms53236047

The proof, service by service

The DNS records behind each service above, for anyone who wants to check them.

MX: where the domain's mail is delivered.
SPF: the list of servers allowed to send as the domain.
DKIM: a signature key that proves mail really came from the domain.
Verification token: proves the domain owner set up an account with the service.

Google Workspace

Mailbox

Receives your mail

MX: aspmx.l.google.com, alt1.aspmx.l.google.com and 5 more

SPF: include:_spf.google.com
DKIM key: google (1024 bit, named for it)

setup complete

All records

MX

cognifit.com MX 1 aspmx.l.google.com
cognifit.com MX 5 alt1.aspmx.l.google.com
cognifit.com MX 5 alt2.aspmx.l.google.com
cognifit.com MX 10 aspmx2.googlemail.com
cognifit.com MX 10 aspmx3.googlemail.com
cognifit.com MX 10 aspmx4.googlemail.com
cognifit.com MX 10 aspmx5.googlemail.com

SPF

cognifit.com TXT include:_spf.google.com

DKIM key

google._domainkey.cognifit.com TXT v=DKIM1; k=rsa; p=MIGfMA0GCSqG..., 1024-bit, fp 4e8ac6498dd9c824 via cognifit.com TXT include:_spf.google.com

setup complete: SPF present, DKIM present, MX present, bounce CNAME not needed

Amazon SES

Transactional

Set up to send

SPF: include:amazonses.com at cognifit.com, messages.cognifit.com and send.cognifit.com

MX for bounces: feedback-smtp.us-east-1.amazonses.com at messages.cognifit.com and send.cognifit.com

All records

SPF

cognifit.com TXT include:amazonses.com
messages.cognifit.com TXT include:amazonses.com
send.cognifit.com TXT include:amazonses.com

MX for bounces

messages.cognifit.com MX 10 feedback-smtp.us-east-1.amazonses.com
send.cognifit.com MX 10 feedback-smtp.us-east-1.amazonses.com

Mailchimp

Marketing

Set up to send

DKIM key: k1 (1024 bit, by CNAME)

setup complete

All records

DKIM key

k1._domainkey.cognifit.com TXT k=rsa; p=MIGfMA0GCSqG..., 1024-bit, fp 53d7bb0466c8346d via dkim.mcsv.net

setup complete: DKIM present (older setup: a key at k1; the current setup names k2), SPF not needed, bounce CNAME not needed

Salesforce

Support and CRM

Set up to send

SPF: include:_spf.salesforce.com

All records

SPF

cognifit.com TXT include:_spf.salesforce.com

SendGrid

Transactional

Set up to send

SPF: include:sendgrid.net

DKIM key: smtpapi (1024 bit, named for it)

setup complete

All records

SPF

cognifit.com TXT include:sendgrid.net

DKIM key

smtpapi._domainkey.cognifit.com TXT k=rsa; t=s (strict); p=MIGfMA0GCSqG..., 1024-bit, fp 303963420cfee1c6 via cognifit.com TXT include:sendgrid.net

setup complete: DKIM present (older setup: a key at smtpapi; the current setup names s1 and s2), bounce CNAME not used (optional, CNAME at 25 labels under cognifit.com), SPF not needed, tracking CNAME not used (optional, CNAME at 25 labels under cognifit.com)

Resend

Transactional

Likely sends

DKIM key: resend (1024 bit, named for it)

All records

DKIM key

resend._domainkey.cognifit.com TXT p=MIGfMA0GCSqG..., 1024-bit, fp 79fdb68489379af3

Microsoft 365

Mailbox

Account only

Verification token: MS=ms53236047

setup incomplete: SPF missing (the record does not authorize spf.protection.outlook.com), DKIM missing (no key at selector1._domainkey or selector2._domainkey, names that do not exist)

All records

Verification token

cognifit.com TXT MS=ms53236047

setup incomplete: SPF missing (the record does not authorize spf.protection.outlook.com), DKIM missing (no key at selector1._domainkey or selector2._domainkey, names that do not exist), MX not used (optional, MX at cognifit.com), bounce CNAME not needed

Not matched to a service

These records point somewhere Sendermap does not recognise: a service it does not know yet, or your own servers.

SPF include: ses.amazonaws.com cognifit.com TXT include:ses.amazonaws.com

Looked for and not found

Records Sendermap looked for and did not find.

DKIM keys at messages.cognifit.com: no selectors exist: _domainkey.messages.cognifit.com does not exist, so the 27-name sweep was skipped; the 8 names its MX, SPF and delegations point to were asked as a check, and none exists (RFC 8020 section 5)_domainkey.messages.cognifit.com TXT no such namesendermap-wildcard-check._domainkey.messages.cognifit.com TXT no such name
DKIM keys at send.cognifit.com: no selectors exist: _domainkey.send.cognifit.com does not exist, so the 27-name sweep was skipped; the 8 names its MX, SPF and delegations point to were asked as a check, and none exists (RFC 8020 section 5)_domainkey.send.cognifit.com TXT no such namesendermap-wildcard-check._domainkey.send.cognifit.com TXT no such name

How this was checked

414 lookups at 3 names · 2 things not checked

Not checked

the website. Web checks were turned off (--no-web).
certificate transparency, crt.sh. Read only with --ct (it also holds expired certificates).

What was asked

414 lookups at 3 names

At cognifit.com: 114 possible DKIM key names, 25 service record names, 1 web page.
At messages.cognifit.com: 8 possible DKIM key names.
At send.cognifit.com: 8 possible DKIM key names.

Names asked

cognifit.com

Pages (1): https://api.certspotter.com/v1/issuances?domain=cognifit.com&include_subdomains=true&expand=dns_names
CNAME labels (25): bounce, bounces, em, email, mail, send, mta, rp, pm-bounces, links, link, click, track, tracking, url, go, autodiscover, cf-bounce, eversrv, fwdkim1, bnc3, bounces.cloud.em, bounces.cloud2.em, outbound.intercom, atlassian-bounces
DKIM selectors (114): google, gapps, s1, s2, smtpapi, acdkim1, acdkim2, ses, aweber_key_a, aweber_key_b, aweber_key_c, brevo, brevo1, brevo2, cm, cf2024-1, ctct1, ctct2, krs, e2ma-k1, e2ma-k2, e2ma-k3, everlytickey1, everlytickey2, fm2, fm1, fm3, mesmtp, secureserver1, secureserver2, gor, strong1, strong2, hs1, hs2, intercom, s1-ionos, s42582890, s2-ionos, cka, kl, kl1, kl2, km1, km2, k2, k1, k3, litesrv, mg, mailgun, mg1, pdk1, pdk2, mailjet, mailpoet2, mailpoet1, mandrill, mte1, mte2, marketo, mkto, mkto1, selector1, selector2, mimecast, mimecast20190719, pepipost, pp1, protonmail, protonmail2, protonmail3, resend, sailthru, salesforce, salesforce2, salesforce1, sf, sf1, sf2, sfdc, 200608, pardot, sfmc, scph0819, sparkpost, squarespace, zendesk1, zendesk2, zoho, mail, mailru, api, default, dk, dkim, dkim1, dkim2, email, k, key, key1, key2, mta, mx, pm, s, selector, smtp, sp, 20161025, 20210112, 20221208, 20230601

messages.cognifit.com

DKIM selectors (8): acdkim1, acdkim2, ses, aweber_key_a, aweber_key_b, aweber_key_c, brevo, brevo1

send.cognifit.com

DKIM selectors (8): acdkim1, acdkim2, ses, aweber_key_a, aweber_key_b, aweber_key_c, brevo, brevo1

Who handles your email

What to fix

SPF at cognifit.com includes ses.amazonaws.com, which publishes no SPF record

Four DKIM keys at cognifit.com are 1024-bit: google (Google Workspace), smtpapi (SendGrid), k1 (Mailchimp) and resend (Resend)

Good to know

The proof, service by service

Google Workspace

Amazon SES

Mailchimp

Salesforce

SendGrid

Resend

Microsoft 365

Not matched to a service

Looked for and not found

How this was checked

Not checked

What was asked

cognifit.com

messages.cognifit.com

send.cognifit.com