Who handles email for glossier.com?
  9 services handle email for glossier.com. 3 things need fixing.

  Google Workspace receives the domain's mail and has a DKIM key in place to sign it.
  Six other services are set up to send as the domain: three support and CRM (Help Scout,           
  Salesforce, Zendesk), one marketing (Klaviyo), two transactional (Postmark, SendGrid); one more is
  likely from a DKIM key name alone (Mandrill).                                                     
  One service shows an account and nothing set up to send (Amazon SES); DMARC reports go to         
  Valimail.                                                                                         

Who handles your email
  Each service below receives or sends email for glossier.com.
  Receives your mail: your MX records deliver the domain's mail there.
  Set up to send: its records for sending are in your DNS.
  Likely sends: one clue points to it, such as a key named for it.
  Account only: an account exists, with nothing set up to send.

  ●  Google Workspace  Mailbox          Receives your mail  ⚠ setup incomplete      
  ●  Help Scout        Support and CRM  Set up to send                              
  ●  Klaviyo           Marketing        Set up to send      ✓ setup complete        
  ●  Postmark          Transactional    Set up to send      ✓ setup complete        
  ●  Salesforce        Support and CRM  Set up to send                              
  ●  SendGrid          Transactional    Set up to send      ✓ setup complete        
  ●  Zendesk           Support and CRM  Set up to send      ✓ setup complete        
  ◐  Mandrill          Transactional    Likely sends        from: DKIM key          
  ○  Amazon SES        Transactional    Account only        from: Verification token

What to fix
  Problems found in the setup, most serious first.

  1 ▲ Two DKIM keys at glossier.com are 1024-bit: mandrill (Mandrill) and s2 (SendGrid)             
      Some receivers already treat 1024-bit RSA keys as weak. Rotate to 2048-bit.                   
        mandrill._domainkey.glossier.com TXT v=DKIM1; k=rsa; p=MIGfMA0GCSqG..., 1024-bit, fp        
        9cee89b6f986543a                                                                            
        s2._domainkey.glossier.com TXT k=rsa; t=s (strict); p=MIGfMA0GCSqG..., 1024-bit, fp         
        493ef754cca287c6 via s2.domainkey.u246655.wl156.sendgrid.net                                
  2 ▲ Google Workspace at receipts.glossier.com has no SPF                                          
      Its documented setup needs it and the map shows it missing: 209.85.220.41, one of Google      
      Workspace's addresses, gets softfail at ~all.                                                 
        receipts.glossier.com TXT ~all                                                              
  3 ▲ Google Workspace at receipts.glossier.com has no DKIM                                         
      Its documented setup needs it and the map shows it missing: no key at google._domainkey, a    
      name with no TXT record; this zone gives that answer for every name that does not exist.      
        google._domainkey.receipts.glossier.com TXT no record of this type                          

Good to know
  Nothing to change here. These explain what the map shows.

  ·   SPF at glossier.com and receipts.glossier.com is managed through Valimail                     
      A hosted or macro record can authorize services without naming them, so the services it covers
      do not show in the record itself.                                                             
        glossier.com TXT v=spf1 include:%{i}._ip.%{h}._ehlo.%{d}._spf.vali.email ~all               
        receipts.glossier.com TXT v=spf1 include:receipts.glossier.com._nspf.vali.email             
        include:%{i}._ip.%{h}._ehlo.%{d}._spf.vali.email ~all                                       

The proof, service by service
  The DNS records behind each service above, for anyone who wants to check them.
  MX: where the domain's mail is delivered.
  SPF: the list of servers allowed to send as the domain.
  DKIM: a signature key that proves mail really came from the domain.
  Bounce CNAME: lets a service handle bounced mail under the domain's name.
  Verification token: proves the domain owner set up an account with the service.
  Tracking CNAME: links in a service's emails point here.

  Google Workspace  ·  Mailbox  ·  receives your mail
    MX                          aspmx.l.google.com, alt1.aspmx.l.google.com and 3 more              
                                glossier.com MX 10 aspmx.l.google.com                               
                                glossier.com MX 20 alt1.aspmx.l.google.com                          
                                glossier.com MX 20 alt2.aspmx.l.google.com                          
                                glossier.com MX 30 aspmx2.googlemail.com                            
                                glossier.com MX 30 aspmx3.googlemail.com                            
    SPF passes its address      ip4:209.85.128.0/17                                                 
                                _spf.google.com TXT ip4:209.85.128.0/17 via                         
                                209.85.220.41._ip.mail-sor-f41.google.com._ehlo.glossier.com._spf.va
                                li.email TXT v=spf1 include:_spf.google.com -all via _spf.google.com
                                TXT v=spf1 ip4:74.125.0.0/16 ip4:209.85.128.0/17                    
                                ip6:2001:4860:4864::/56 ip6:2404:6800:4864::/56                     
                                ip6:2607:f8b0:4864::/56 ip6:2800:3f0:4864::/56                      
                                ip6:2a00:1450:4864::/56 ip6:2c0f:fb50:4864::/56 ~all                
    MX for a subdomain's mail   aspmx.l.google.com, alt1.aspmx.l.google.com and 3 more at           
                                receipts.glossier.com                                               
                                receipts.glossier.com MX 1 aspmx.l.google.com                       
                                receipts.glossier.com MX 5 alt1.aspmx.l.google.com                  
                                receipts.glossier.com MX 5 alt2.aspmx.l.google.com                  
                                receipts.glossier.com MX 10 alt3.aspmx.l.google.com                 
                                receipts.glossier.com MX 10 alt4.aspmx.l.google.com                 
    DKIM key                    google (2048 bit, named for it)                                     
                                google._domainkey.glossier.com TXT v=DKIM1; k=rsa;                  
                                p=MIIBIjANBgkq..., 2048-bit, fp 40785b4787f0f30f via glossier.com MX
                                10 aspmx.l.google.com                                               
    Setup                       incomplete: SPF present at glossier.com, DKIM present at            
                                glossier.com, MX present at glossier.com and receipts.glossier.com, 
                                bounce CNAME not needed at glossier.com and receipts.glossier.com,  
                                SPF missing at receipts.glossier.com, DKIM missing at               
                                receipts.glossier.com                                               

  Help Scout  ·  Support and CRM  ·  set up to send
    SPF passes its address      ip4:52.0.20.102                                                     
                                helpscoutemail.com TXT ip4:52.0.20.102 via                          
                                52.0.20.102._ip.mail4.helpscout.net._ehlo.glossier.com._spf.vali.ema
                                il TXT v=spf1 include:helpscoutemail.com -all via helpscoutemail.com
                                TXT v=spf1 ip4:54.173.229.38 ip4:52.0.20.102 ip4:54.174.116.32      
                                ip4:52.2.238.96 ip4:52.20.146.34 ip4:34.198.122.65 ~all             
    DKIM keys                   strong1, strong2 (both 2048 bit, by CNAME)                          
                                strong1._domainkey.glossier.com TXT v=DKIM1; k=rsa;                 
                                p=MIIBIjANBgkq..., 2048-bit, fp bdaef67ee0bd9b30 via                
                                strong1._domainkey.helpscout.net                                    
                                strong2._domainkey.glossier.com TXT v=DKIM1; k=rsa;                 
                                p=MIIBIjANBgkq..., 2048-bit, fp 6d999cc9f7fe9631 via                
                                strong2._domainkey.helpscout.net                                    

  Klaviyo  ·  Marketing  ·  set up to send
    DKIM keys                   kl, kl2 (both 2048 bit, by CNAME)                                   
                                kl._domainkey.glossier.com TXT k=rsa; t=s (strict);                 
                                p=MIIBIjANBgkq..., 2048-bit, fp 8f7c4abc32a3149e via                
                                kl.domainkey.u161779.wl030.sendgrid.net                             
                                kl2._domainkey.glossier.com TXT k=rsa; t=s (strict);                
                                p=MIIBIjANBgkq..., 2048-bit, fp a8e9604b93b01972 via                
                                kl2.domainkey.u161779.wl030.sendgrid.net                            
    Bounce CNAME                send.glossier.com                                                   
                                send.glossier.com CNAME u161779.wl030.sendgrid.net                  
    Verification token          klaviyo-site-verification=Sn6eFZ                                    
                                glossier.com TXT klaviyo-site-verification=Sn6eFZ                   
    Setup                       complete: DKIM present, bounce CNAME present, SPF not needed        

  Postmark  ·  Transactional  ·  set up to send
    Bounce CNAME                pm-bounces.glossier.com                       
                                pm-bounces.glossier.com CNAME pm.mtasv.net    
    Setup                       complete: SPF not needed, bounce CNAME present

  Salesforce  ·  Support and CRM  ·  set up to send
    DKIM keys                   salesforce2, salesforce1 (both 2048 bit, by CNAME)                  
                                salesforce2._domainkey.glossier.com TXT v=DKIM1; p=MIIBIjANBgkq..., 
                                2048-bit, fp 487730d4106fc223 via                                   
                                salesforce2.h8cv4t.custdkim.salesforce.com                          
                                salesforce1._domainkey.glossier.com TXT v=DKIM1; p=MIIBIjANBgkq..., 
                                2048-bit, fp b89c6f4a80bb10de via                                   
                                salesforce1.6nkqhl.custdkim.salesforce.com                          

  SendGrid  ·  Transactional  ·  set up to send
    DKIM keys                   s1 2048 bit, s2 1024 bit (by CNAME)                                 
                                s1._domainkey.glossier.com TXT k=rsa; t=s (strict);                 
                                p=MIIBIjANBgkq..., 2048-bit, fp 3d0654c2b22f63e6 via                
                                s1.domainkey.u246655.wl156.sendgrid.net                             
                                s2._domainkey.glossier.com TXT k=rsa; t=s (strict);                 
                                p=MIGfMA0GCSqG..., 1024-bit, fp 493ef754cca287c6 via                
                                s2.domainkey.u246655.wl156.sendgrid.net                             
    Tracking CNAME              link.glossier.com                                                   
                                link.glossier.com CNAME sendgrid.net                                
    MX for bounces              mx.sendgrid.net, mx2.sendgrid.net at marketing.glossier.com and     
                                send.glossier.com                                                   
                                marketing.glossier.com MX 10 mx.sendgrid.net                        
                                marketing.glossier.com MX 20 mx2.sendgrid.net                       
                                send.glossier.com MX 20 mx.sendgrid.net                             
    SPF                         include:ab.sendgrid.net, include:sendgrid.net at                    
                                marketing.glossier.com and send.glossier.com                        
                                marketing.glossier.com TXT include:ab.sendgrid.net                  
                                send.glossier.com TXT include:sendgrid.net                          
    SPF ranges                  ip4:208.117.48.0/20, ip4:50.31.32.0/19 and 9 more at                
                                marketing.glossier.com                                              
                                marketing.glossier.com TXT ip4:208.117.48.0/20 via sendgrid.net TXT 
                                ip4:208.117.48.0/20                                                 
                                marketing.glossier.com TXT ip4:50.31.32.0/19 via sendgrid.net TXT   
                                ip4:50.31.32.0/19                                                   
                                marketing.glossier.com TXT ip4:198.37.144.0/20 via sendgrid.net TXT 
                                ip4:198.37.144.0/20                                                 
                                marketing.glossier.com TXT ip4:198.21.0.0/21 via sendgrid.net TXT   
                                ip4:198.21.0.0/21                                                   
                                marketing.glossier.com TXT ip4:192.254.112.0/20 via sendgrid.net TXT
                                ip4:192.254.112.0/20                                                
                                marketing.glossier.com TXT ip4:149.72.0.0/16 via sendgrid.net TXT   
                                ip4:149.72.0.0/16                                                   
                                marketing.glossier.com TXT ip4:159.183.0.0/16 via sendgrid.net TXT  
                                ip4:159.183.0.0/16                                                  
                                marketing.glossier.com TXT ip4:134.128.64.0/18 via sendgrid.net TXT 
                                ip4:134.128.64.0/18                                                 
                                marketing.glossier.com TXT ip4:159.26.176.0/20 via sendgrid.net TXT 
                                ip4:159.26.176.0/20                                                 
                                marketing.glossier.com TXT ip4:167.89.0.0/17 via                    
                                1.0.89.167.origin.asn.cymru.com TXT 11377 | 167.89.0.0/18 | US |    
                                arin | 2013-10-31 via as11377.asn.cymru.com TXT 11377 | US | arin | 
                                2012-06-28 | SENDGRID - SendGrid, Inc., US via                      
                                1.64.89.167.origin.asn.cymru.com TXT 11377 | 167.89.64.0/19 | US |  
                                arin | 2013-10-31 via 1.96.89.167.origin.asn.cymru.com TXT 11377 |  
                                167.89.96.0/20 | US | arin | 2013-10-31                             
                                marketing.glossier.com TXT ip4:168.245.0.0/17 via                   
                                1.0.245.168.origin.asn.cymru.com TXT 11377 | 168.245.0.0/18 | US |  
                                arin | 2016-11-10 via as11377.asn.cymru.com TXT 11377 | US | arin | 
                                2012-06-28 | SENDGRID - SendGrid, Inc., US via                      
                                1.64.245.168.origin.asn.cymru.com TXT 11377 | 168.245.64.0/20 | US |
                                arin | 2016-11-10 via 1.96.245.168.origin.asn.cymru.com TXT 11377 | 
                                168.245.96.0/19 | US | arin | 2016-11-10                            
    Setup                       complete: DKIM present, bounce CNAME present, SPF not needed,       
                                tracking CNAME present                                              

  Zendesk  ·  Support and CRM  ·  set up to send
    SPF passes its address      ip4:103.151.192.0/23                                                
                                mail.zendesk.com TXT ip4:103.151.192.0/23 via                       
                                103.151.192.1._ip.mta-out1.pod25.apne1.zdsys.com._ehlo.glossier.com.
                                _spf.vali.email TXT v=spf1 include:mail.zendesk.com -all via        
                                mail.zendesk.com TXT v=spf1 ip4:103.151.192.0/23 ip4:185.12.80.0/22 
                                ip4:188.172.128.0/20 ip4:192.161.144.0/20 ip4:216.198.0.0/18 ~all   
    DKIM keys                   zendesk1, zendesk2 (both 2048 bit, by CNAME)                        
                                zendesk1._domainkey.glossier.com TXT v=DKIM1; t=s (strict); n=core; 
                                k=rsa; p=MIIBIjANBgkq..., 2048-bit, fp 45ce096f162d5ec4 via         
                                zendesk1._domainkey.zendesk.com                                     
                                zendesk2._domainkey.glossier.com TXT v=DKIM1; t=s (strict); n=core; 
                                k=rsa; p=MIIBIjANBgkq..., 2048-bit, fp c5fa8a017cd8c5a5 via         
                                zendesk2._domainkey.zendesk.com                                     
    Setup                       complete: SPF present, DKIM present                                 

  Mandrill  ·  Transactional  ·  likely sends
    DKIM key                    mandrill (1024 bit, named for it)                                   
                                mandrill._domainkey.glossier.com TXT v=DKIM1; k=rsa;                
                                p=MIGfMA0GCSqG..., 1024-bit, fp 9cee89b6f986543a                    
    Setup                       complete: DKIM present (older setup: a key at mandrill; the current 
                                setup names mte1 and mte2), bounce CNAME not used (optional, CNAME  
                                at 25 labels under glossier.com), tracking CNAME not used (optional,
                                CNAME at 25 labels under glossier.com)                              

  Amazon SES  ·  Transactional  ·  account only
    Verification token          amazonses:awBV5EM6W53p2/Xbg80uJ29zurZnGsMMJcLLLp6vUcY=              
                                glossier.com TXT                                                    
                                amazonses:awBV5EM6W53p2/Xbg80uJ29zurZnGsMMJcLLLp6vUcY=              

Not matched to a service
  These records point somewhere Sendermap does not recognise: a service it does not know yet, or    
  your own servers.                                                                                 

  CNAME at go: cname.short.io
    go.glossier.com CNAME cname.short.io

How this was checked
  Checked 2026-10-12 01:25 UTC: 758 DNS lookups in 0.0 s over Google DNS over HTTPS.
  At glossier.com: 114 possible DKIM key names, 25 service record names, 1 web page.
    Pages:                                                                                          
    https://api.certspotter.com/v1/issuances?domain=glossier.com&include_subdomains=true&expand=dns_
    names                                                                                           
    CNAME labels: bounce, bounces, em, email, mail, send, mta, rp, pm-bounces, links, link, click,  
    track, tracking, url, go, autodiscover, cf-bounce, eversrv, fwdkim1, bnc3, bounces.cloud.em,    
    bounces.cloud2.em, outbound.intercom, atlassian-bounces                                         
    DKIM selectors: acdkim1, acdkim2, ses, aweber_key_a, aweber_key_b, aweber_key_c, brevo, brevo1, 
    brevo2, cm, cf2024-1, ctct1, ctct2, krs, e2ma-k1, e2ma-k2, e2ma-k3, everlytickey1,              
    everlytickey2, fm2, fm1, fm3, mesmtp, secureserver1, secureserver2, google, gapps, gor, strong1,
    strong2, hs1, hs2, intercom, s1-ionos, s42582890, s2-ionos, cka, kl, kl1, kl2, km1, km2, k2, k1,
    k3, litesrv, mg, mailgun, mg1, pdk1, pdk2, mailjet, mailpoet2, mailpoet1, mandrill, mte1, mte2, 
    marketo, mkto, mkto1, selector1, selector2, mimecast, mimecast20190719, pepipost, pp1,          
    protonmail, protonmail2, protonmail3, resend, sailthru, salesforce, salesforce2, salesforce1,   
    sf, sf1, sf2, sfdc, 200608, pardot, sfmc, s1, s2, smtpapi, scph0819, sparkpost, squarespace,    
    zendesk1, zendesk2, zoho, mail, mailru, api, default, dk, dkim, dkim1, dkim2, email, k, key,    
    key1, key2, mta, mx, pm, s, selector, smtp, sp, 20161025, 20210112, 20221208, 20230601          
  At marketing.glossier.com: 27 possible DKIM key names.
    DKIM selectors: s1, s2, smtpapi, acdkim1, acdkim2, ses, aweber_key_a, aweber_key_b,             
    aweber_key_c, brevo, brevo1, brevo2, cm, cf2024-1, ctct1, ctct2, krs, e2ma-k1, e2ma-k2, e2ma-k3,
    everlytickey1, everlytickey2, fm2, fm1, fm3, mesmtp, secureserver1                              
  At receipts.glossier.com: 31 possible DKIM key names.
    DKIM selectors: acdkim1, acdkim2, ses, aweber_key_a, aweber_key_b, aweber_key_c, brevo, brevo1, 
    brevo2, cm, cf2024-1, ctct1, ctct2, krs, e2ma-k1, e2ma-k2, e2ma-k3, everlytickey1,              
    everlytickey2, fm2, fm1, fm3, mesmtp, secureserver1, secureserver2, google, gapps, 20161025,    
    20210112, 20221208, 20230601                                                                    
  At send.glossier.com: 27 possible DKIM key names.
    DKIM selectors: s1, s2, smtpapi, acdkim1, acdkim2, ses, aweber_key_a, aweber_key_b,             
    aweber_key_c, brevo, brevo1, brevo2, cm, cf2024-1, ctct1, ctct2, krs, e2ma-k1, e2ma-k2, e2ma-k3,
    everlytickey1, everlytickey2, fm2, fm1, fm3, mesmtp, secureserver1                              
  Not checked: DKIM selectors at marketing and send.glossier.com: 83 of 110 not asked at each. The  
  first 27 were asked, plus any the name's own SPF, MX or delegation points to (cap 27).            
  Not checked: DKIM selectors at receipts.glossier.com: 83 of 114 not asked. The first 27 were      
  asked, plus any the name's own SPF, MX or delegation points to (cap 27).                          
  Not run: the website. Web checks were turned off (--no-web).
  Not run: certificate transparency, crt.sh. Read only with --ct (it also holds expired             
  certificates).                                                                                    
