Who handles email for glossier.com?

9 services handle email for glossier.com. 3 things need fixing.

Checked 2026-10-12 01:25 UTC: 758 DNS lookups in 0.0 s over Google DNS over HTTPS.

Google Workspace receives the domain's mail and has a DKIM key in place to sign it.

Six other services are set up to send as the domain: three support and CRM (Help Scout, Salesforce, Zendesk), one marketing (Klaviyo), two transactional (Postmark, SendGrid); one more is likely from a DKIM key name alone (Mandrill).

One service shows an account and nothing set up to send (Amazon SES); DMARC reports go to Valimail.

Not checked: the website (turned off), DKIM selectors past the first 27 on three subdomains, and the crt.sh certificate log (read only with --ct).

Who handles your email

Each service below receives or sends email for glossier.com.

ServiceCategoryStatusSetup
Google Workspace Mailbox Receives your mail ⚠ setup incomplete
Help Scout Support and CRM Set up to send
Klaviyo Marketing Set up to send ✓ setup complete
Postmark Transactional Set up to send ✓ setup complete
Salesforce Support and CRM Set up to send
SendGrid Transactional Set up to send ✓ setup complete
Zendesk Support and CRM Set up to send ✓ setup complete
Mandrill Transactional Likely sends from: DKIM key
Amazon SES Transactional from: Verification token

What to fix

Problems found in the setup, most serious first.

  1. Two DKIM keys at glossier.com are 1024-bit: mandrill (Mandrill) and s2 (SendGrid)

    Some receivers already treat 1024-bit RSA keys as weak. Rotate to 2048-bit.

    Records
    • mandrill._domainkey.glossier.com TXT v=DKIM1; k=rsa; p=MIGfMA0GCSqG..., 1024-bit, fp 9cee89b6f986543a
    • s2._domainkey.glossier.com TXT k=rsa; t=s (strict); p=MIGfMA0GCSqG..., 1024-bit, fp 493ef754cca287c6 via s2.domainkey.u246655.wl156.sendgrid.net

  2. Google Workspace at receipts.glossier.com has no SPF

    Its documented setup needs it and the map shows it missing: 209.85.220.41, one of Google Workspace's addresses, gets softfail at ~all.

    Records
    • receipts.glossier.com TXT ~all

  3. Google Workspace at receipts.glossier.com has no DKIM

    Its documented setup needs it and the map shows it missing: no key at google._domainkey, a name with no TXT record; this zone gives that answer for every name that does not exist.

    Records
    • google._domainkey.receipts.glossier.com TXT no record of this type

Good to know

Nothing to change here. These explain what the map shows.

The proof, service by service

The DNS records behind each service above, for anyone who wants to check them.

Google Workspace

Mailbox

Receives your mail

MX: aspmx.l.google.com, alt1.aspmx.l.google.com and 3 more

  • SPF passes its address: ip4:209.85.128.0/17
  • MX for a subdomain's mail: aspmx.l.google.com, alt1.aspmx.l.google.com and 3 more at receipts.glossier.com
  • DKIM key: google (2048 bit, named for it)

setup incomplete: SPF missing at receipts.glossier.com, DKIM missing at receipts.glossier.com

All records

MX

  • glossier.com MX 10 aspmx.l.google.com
  • glossier.com MX 20 alt1.aspmx.l.google.com
  • glossier.com MX 20 alt2.aspmx.l.google.com
  • glossier.com MX 30 aspmx2.googlemail.com
  • glossier.com MX 30 aspmx3.googlemail.com

SPF passes its address

  • _spf.google.com TXT ip4:209.85.128.0/17 via 209.85.220.41._ip.mail-sor-f41.google.com._ehlo.glossier.com._spf.vali.email TXT v=spf1 include:_spf.google.com -all via _spf.google.com TXT v=spf1 ip4:74.125.0.0/16 ip4:209.85.128.0/17 ip6:2001:4860:4864::/56 ip6:2404:6800:4864::/56 ip6:2607:f8b0:4864::/56 ip6:2800:3f0:4864::/56 ip6:2a00:1450:4864::/56 ip6:2c0f:fb50:4864::/56 ~all

MX for a subdomain's mail

  • receipts.glossier.com MX 1 aspmx.l.google.com
  • receipts.glossier.com MX 5 alt1.aspmx.l.google.com
  • receipts.glossier.com MX 5 alt2.aspmx.l.google.com
  • receipts.glossier.com MX 10 alt3.aspmx.l.google.com
  • receipts.glossier.com MX 10 alt4.aspmx.l.google.com

DKIM key

  • google._domainkey.glossier.com TXT v=DKIM1; k=rsa; p=MIIBIjANBgkq..., 2048-bit, fp 40785b4787f0f30f via glossier.com MX 10 aspmx.l.google.com

setup incomplete: SPF present at glossier.com, DKIM present at glossier.com, MX present at glossier.com and receipts.glossier.com, bounce CNAME not needed at glossier.com and receipts.glossier.com, SPF missing at receipts.glossier.com, DKIM missing at receipts.glossier.com

Help Scout

Support and CRM

Set up to send

SPF passes its address: ip4:52.0.20.102

  • DKIM keys: strong1, strong2 (both 2048 bit, by CNAME)
All records

SPF passes its address

  • helpscoutemail.com TXT ip4:52.0.20.102 via 52.0.20.102._ip.mail4.helpscout.net._ehlo.glossier.com._spf.vali.email TXT v=spf1 include:helpscoutemail.com -all via helpscoutemail.com TXT v=spf1 ip4:54.173.229.38 ip4:52.0.20.102 ip4:54.174.116.32 ip4:52.2.238.96 ip4:52.20.146.34 ip4:34.198.122.65 ~all

DKIM keys

  • strong1._domainkey.glossier.com TXT v=DKIM1; k=rsa; p=MIIBIjANBgkq..., 2048-bit, fp bdaef67ee0bd9b30 via strong1._domainkey.helpscout.net
  • strong2._domainkey.glossier.com TXT v=DKIM1; k=rsa; p=MIIBIjANBgkq..., 2048-bit, fp 6d999cc9f7fe9631 via strong2._domainkey.helpscout.net

Klaviyo

Marketing

Set up to send

DKIM keys: kl, kl2 (both 2048 bit, by CNAME)

  • Bounce CNAME: send.glossier.com
  • Verification token: klaviyo-site-verification=Sn6eFZ

setup complete

All records

DKIM keys

  • kl._domainkey.glossier.com TXT k=rsa; t=s (strict); p=MIIBIjANBgkq..., 2048-bit, fp 8f7c4abc32a3149e via kl.domainkey.u161779.wl030.sendgrid.net
  • kl2._domainkey.glossier.com TXT k=rsa; t=s (strict); p=MIIBIjANBgkq..., 2048-bit, fp a8e9604b93b01972 via kl2.domainkey.u161779.wl030.sendgrid.net

Bounce CNAME

  • send.glossier.com CNAME u161779.wl030.sendgrid.net

Verification token

  • glossier.com TXT klaviyo-site-verification=Sn6eFZ

setup complete: DKIM present, bounce CNAME present, SPF not needed

Postmark

Transactional

Set up to send

Bounce CNAME: pm-bounces.glossier.com

setup complete

All records

Bounce CNAME

  • pm-bounces.glossier.com CNAME pm.mtasv.net

setup complete: SPF not needed, bounce CNAME present

Salesforce

Support and CRM

Set up to send

DKIM keys: salesforce2, salesforce1 (both 2048 bit, by CNAME)

All records

DKIM keys

  • salesforce2._domainkey.glossier.com TXT v=DKIM1; p=MIIBIjANBgkq..., 2048-bit, fp 487730d4106fc223 via salesforce2.h8cv4t.custdkim.salesforce.com
  • salesforce1._domainkey.glossier.com TXT v=DKIM1; p=MIIBIjANBgkq..., 2048-bit, fp b89c6f4a80bb10de via salesforce1.6nkqhl.custdkim.salesforce.com

SendGrid

Transactional

Set up to send

DKIM keys: s1 2048 bit, s2 1024 bit (by CNAME)

  • Tracking CNAME: link.glossier.com
  • MX for bounces: mx.sendgrid.net, mx2.sendgrid.net at marketing.glossier.com and send.glossier.com
  • SPF: include:ab.sendgrid.net, include:sendgrid.net at marketing.glossier.com and send.glossier.com
  • SPF ranges: ip4:208.117.48.0/20, ip4:50.31.32.0/19 and 9 more at marketing.glossier.com

setup complete

All records

DKIM keys

  • s1._domainkey.glossier.com TXT k=rsa; t=s (strict); p=MIIBIjANBgkq..., 2048-bit, fp 3d0654c2b22f63e6 via s1.domainkey.u246655.wl156.sendgrid.net
  • s2._domainkey.glossier.com TXT k=rsa; t=s (strict); p=MIGfMA0GCSqG..., 1024-bit, fp 493ef754cca287c6 via s2.domainkey.u246655.wl156.sendgrid.net

Tracking CNAME

  • link.glossier.com CNAME sendgrid.net

MX for bounces

  • marketing.glossier.com MX 10 mx.sendgrid.net
  • marketing.glossier.com MX 20 mx2.sendgrid.net
  • send.glossier.com MX 20 mx.sendgrid.net

SPF

  • marketing.glossier.com TXT include:ab.sendgrid.net
  • send.glossier.com TXT include:sendgrid.net

SPF ranges

  • marketing.glossier.com TXT ip4:208.117.48.0/20 via sendgrid.net TXT ip4:208.117.48.0/20
  • marketing.glossier.com TXT ip4:50.31.32.0/19 via sendgrid.net TXT ip4:50.31.32.0/19
  • marketing.glossier.com TXT ip4:198.37.144.0/20 via sendgrid.net TXT ip4:198.37.144.0/20
  • marketing.glossier.com TXT ip4:198.21.0.0/21 via sendgrid.net TXT ip4:198.21.0.0/21
  • marketing.glossier.com TXT ip4:192.254.112.0/20 via sendgrid.net TXT ip4:192.254.112.0/20
  • marketing.glossier.com TXT ip4:149.72.0.0/16 via sendgrid.net TXT ip4:149.72.0.0/16
  • marketing.glossier.com TXT ip4:159.183.0.0/16 via sendgrid.net TXT ip4:159.183.0.0/16
  • marketing.glossier.com TXT ip4:134.128.64.0/18 via sendgrid.net TXT ip4:134.128.64.0/18
  • marketing.glossier.com TXT ip4:159.26.176.0/20 via sendgrid.net TXT ip4:159.26.176.0/20
  • marketing.glossier.com TXT ip4:167.89.0.0/17 via 1.0.89.167.origin.asn.cymru.com TXT 11377 | 167.89.0.0/18 | US | arin | 2013-10-31 via as11377.asn.cymru.com TXT 11377 | US | arin | 2012-06-28 | SENDGRID - SendGrid, Inc., US via 1.64.89.167.origin.asn.cymru.com TXT 11377 | 167.89.64.0/19 | US | arin | 2013-10-31 via 1.96.89.167.origin.asn.cymru.com TXT 11377 | 167.89.96.0/20 | US | arin | 2013-10-31
  • marketing.glossier.com TXT ip4:168.245.0.0/17 via 1.0.245.168.origin.asn.cymru.com TXT 11377 | 168.245.0.0/18 | US | arin | 2016-11-10 via as11377.asn.cymru.com TXT 11377 | US | arin | 2012-06-28 | SENDGRID - SendGrid, Inc., US via 1.64.245.168.origin.asn.cymru.com TXT 11377 | 168.245.64.0/20 | US | arin | 2016-11-10 via 1.96.245.168.origin.asn.cymru.com TXT 11377 | 168.245.96.0/19 | US | arin | 2016-11-10

setup complete: DKIM present, bounce CNAME present, SPF not needed, tracking CNAME present

Zendesk

Support and CRM

Set up to send

SPF passes its address: ip4:103.151.192.0/23

  • DKIM keys: zendesk1, zendesk2 (both 2048 bit, by CNAME)

setup complete

All records

SPF passes its address

  • mail.zendesk.com TXT ip4:103.151.192.0/23 via 103.151.192.1._ip.mta-out1.pod25.apne1.zdsys.com._ehlo.glossier.com._spf.vali.email TXT v=spf1 include:mail.zendesk.com -all via mail.zendesk.com TXT v=spf1 ip4:103.151.192.0/23 ip4:185.12.80.0/22 ip4:188.172.128.0/20 ip4:192.161.144.0/20 ip4:216.198.0.0/18 ~all

DKIM keys

  • zendesk1._domainkey.glossier.com TXT v=DKIM1; t=s (strict); n=core; k=rsa; p=MIIBIjANBgkq..., 2048-bit, fp 45ce096f162d5ec4 via zendesk1._domainkey.zendesk.com
  • zendesk2._domainkey.glossier.com TXT v=DKIM1; t=s (strict); n=core; k=rsa; p=MIIBIjANBgkq..., 2048-bit, fp c5fa8a017cd8c5a5 via zendesk2._domainkey.zendesk.com

setup complete: SPF present, DKIM present

Mandrill

Transactional

Likely sends

DKIM key: mandrill (1024 bit, named for it)

setup complete

All records

DKIM key

  • mandrill._domainkey.glossier.com TXT v=DKIM1; k=rsa; p=MIGfMA0GCSqG..., 1024-bit, fp 9cee89b6f986543a

setup complete: DKIM present (older setup: a key at mandrill; the current setup names mte1 and mte2), bounce CNAME not used (optional, CNAME at 25 labels under glossier.com), tracking CNAME not used (optional, CNAME at 25 labels under glossier.com)

Amazon SES

Transactional

Verification token: amazonses:awBV5EM6W53p2/Xbg80uJ29zurZnGsMMJcLLLp6vUcY=

All records

Verification token

  • glossier.com TXT amazonses:awBV5EM6W53p2/Xbg80uJ29zurZnGsMMJcLLLp6vUcY=

Not matched to a service

These records point somewhere Sendermap does not recognise: a service it does not know yet, or your own servers.

How this was checked

758 lookups at 4 names · 4 things not checked

Not checked

What was asked

758 lookups at 4 names

Names asked

glossier.com

  • Pages (1): https://api.certspotter.com/v1/issuances?domain=glossier.com&include_subdomains=true&expand=dns_names
  • CNAME labels (25): bounce, bounces, em, email, mail, send, mta, rp, pm-bounces, links, link, click, track, tracking, url, go, autodiscover, cf-bounce, eversrv, fwdkim1, bnc3, bounces.cloud.em, bounces.cloud2.em, outbound.intercom, atlassian-bounces
  • DKIM selectors (114): acdkim1, acdkim2, ses, aweber_key_a, aweber_key_b, aweber_key_c, brevo, brevo1, brevo2, cm, cf2024-1, ctct1, ctct2, krs, e2ma-k1, e2ma-k2, e2ma-k3, everlytickey1, everlytickey2, fm2, fm1, fm3, mesmtp, secureserver1, secureserver2, google, gapps, gor, strong1, strong2, hs1, hs2, intercom, s1-ionos, s42582890, s2-ionos, cka, kl, kl1, kl2, km1, km2, k2, k1, k3, litesrv, mg, mailgun, mg1, pdk1, pdk2, mailjet, mailpoet2, mailpoet1, mandrill, mte1, mte2, marketo, mkto, mkto1, selector1, selector2, mimecast, mimecast20190719, pepipost, pp1, protonmail, protonmail2, protonmail3, resend, sailthru, salesforce, salesforce2, salesforce1, sf, sf1, sf2, sfdc, 200608, pardot, sfmc, s1, s2, smtpapi, scph0819, sparkpost, squarespace, zendesk1, zendesk2, zoho, mail, mailru, api, default, dk, dkim, dkim1, dkim2, email, k, key, key1, key2, mta, mx, pm, s, selector, smtp, sp, 20161025, 20210112, 20221208, 20230601

marketing.glossier.com

  • DKIM selectors (27): s1, s2, smtpapi, acdkim1, acdkim2, ses, aweber_key_a, aweber_key_b, aweber_key_c, brevo, brevo1, brevo2, cm, cf2024-1, ctct1, ctct2, krs, e2ma-k1, e2ma-k2, e2ma-k3, everlytickey1, everlytickey2, fm2, fm1, fm3, mesmtp, secureserver1

receipts.glossier.com

  • DKIM selectors (31): acdkim1, acdkim2, ses, aweber_key_a, aweber_key_b, aweber_key_c, brevo, brevo1, brevo2, cm, cf2024-1, ctct1, ctct2, krs, e2ma-k1, e2ma-k2, e2ma-k3, everlytickey1, everlytickey2, fm2, fm1, fm3, mesmtp, secureserver1, secureserver2, google, gapps, 20161025, 20210112, 20221208, 20230601

send.glossier.com

  • DKIM selectors (27): s1, s2, smtpapi, acdkim1, acdkim2, ses, aweber_key_a, aweber_key_b, aweber_key_c, brevo, brevo1, brevo2, cm, cf2024-1, ctct1, ctct2, krs, e2ma-k1, e2ma-k2, e2ma-k3, everlytickey1, everlytickey2, fm2, fm1, fm3, mesmtp, secureserver1