Who handles email for casper.com?
  14 services handle email for casper.com. 4 things need fixing.

  Google Workspace receives the domain's mail and has a DKIM key in place to sign it.
  Eleven other services are set up to send as the domain: four marketing (Campaign Monitor,         
  Iterable, Mailchimp, Salesforce Marketing Cloud Engagement), two commerce and apps (Docebo, Q4),  
  four transactional (Mailgun, Mandrill, Postmark, SendGrid), one support and CRM (Salesforce); one 
  more is likely from a DKIM key name alone (Customer.io).                                          
  One service shows an account and nothing set up to send (Microsoft 365); DMARC reports go to      
  DMARCian.                                                                                         

Who handles your email
  Each service below receives or sends email for casper.com.
  Receives your mail: your MX records deliver the domain's mail there.
  Set up to send: its records for sending are in your DNS.
  Likely sends: one clue points to it, such as a key named for it.
  Account only: an account exists, with nothing set up to send.

  ●  Google Workspace                Mailbox            Receives your mail  ⚠ setup incomplete      
  ●  Campaign Monitor                Marketing          Set up to send      ✓ setup complete        
  ●  Docebo                          Commerce and apps  Set up to send                              
  ●  Iterable                        Marketing          Set up to send                              
  ●  Mailchimp                       Marketing          Set up to send      ✓ setup complete        
  ●  Mailgun                         Transactional      Set up to send      ✓ setup complete        
  ●  Mandrill                        Transactional      Set up to send      ✓ setup complete        
  ●  Postmark                        Transactional      Set up to send      ✓ setup complete        
  ●  Q4                              Commerce and apps  Set up to send                              
  ●  Salesforce                      Support and CRM    Set up to send                              
  ●  Salesforce Marketing Cloud      Marketing          Set up to send                              
     Engagement (mail.casper.com)                                                                   
  ●  SendGrid                        Transactional      Set up to send      ✓ setup complete        
  ◐  Customer.io (e.casper.com)      Marketing          Likely sends        from: DKIM key          
  ○  Microsoft 365                   Mailbox            Account only        from: Verification token

What to fix
  Problems found in the setup, most serious first.

  1 ▲ Eight DKIM keys at casper.com are 1024-bit: google (Google Workspace), cm (Campaign Monitor), 
      k1 (Mailchimp), mandrill (Mandrill), salesforce (Salesforce), s2 (SendGrid), smtpapi          
      (SendGrid) and mx                                                                             
      Some receivers already treat 1024-bit RSA keys as weak. Rotate to 2048-bit.                   
  2 ▲ Google Workspace at e.casper.com and mail.casper.com has no SPF                               
      Its documented setup needs it and the map shows it missing: the record does not authorize     
      _spf.google.com.                                                                              
  3 ▲ Google Workspace at e.casper.com and mail.casper.com has no DKIM                              
      Its documented setup needs it and the map shows it missing: no key at google._domainkey, a    
      name that does not exist.                                                                     
  4 ▲ Google Workspace at orders.casper.com has no SPF                          
      Its documented setup needs it and the map shows it missing: no SPF record.

Good to know
  Nothing to change here. These explain what the map shows.

  ·   The mte1 key at casper.com and the mte1 key at email.casper.com are the same key              
      They publish one public key, fp 402b5aebde0f1c9f, so one private key signs for all of them,   
      and replacing the key at one selector leaves it live at the others.                           
  ·   The mte2 key at casper.com and the mte2 key at email.casper.com are the same key              
      They publish one public key, fp bd970c8868f21f9b, so one private key signs for all of them,   
      and replacing the key at one selector leaves it live at the others.                           
  ·   Microsoft 365 shows only an account at casper.com                                             
      The records name an account (a verification token, an autodiscover CNAME, or a revoked or     
      dangling key) and nothing that sends or receives mail. Is the account still used? If not,     
      remove its records.                                                                           

The proof, service by service
  The DNS records behind each service above, for anyone who wants to check them.
  MX: where the domain's mail is delivered.
  SPF: the list of servers allowed to send as the domain.
  DKIM: a signature key that proves mail really came from the domain.
  Tracking CNAME: links in a service's emails point here.
  Bounce CNAME: lets a service handle bounced mail under the domain's name.
  Delegated by NS: the service runs DNS for a sending subdomain.
  Verification token: proves the domain owner set up an account with the service.

  Google Workspace  ·  Mailbox  ·  receives your mail
    MX                          aspmx.l.google.com, alt1.aspmx.l.google.com and 3 more              
    SPF                         include:_spf.google.com                                             
    MX for a subdomain's mail   aspmx.l.google.com, alt1.aspmx.l.google.com and 5 more at           
                                e.casper.com, mail.casper.com and orders.casper.com                 
    DKIM keys                   google (1024 and 2048 bit, named for it) at casper.com and          
                                orders.casper.com                                                   
    Setup                       incomplete: SPF missing at e.casper.com, mail.casper.com and        
                                orders.casper.com, DKIM missing at e.casper.com and mail.casper.com 

  Campaign Monitor  ·  Marketing  ·  set up to send
    SPF                         include:_spf.createsend.com
    DKIM key                    cm (1024 bit, named for it)
    Setup                       complete                   

  Docebo  ·  Commerce and apps  ·  set up to send
    SPF                         include:docebosaas.com

  Iterable  ·  Marketing  ·  set up to send
    Tracking CNAME              links.casper.com

  Mailchimp  ·  Marketing  ·  set up to send
    DKIM key                    k1 (1024 bit, by CNAME)
    Setup                       complete               

  Mailgun  ·  Transactional  ·  set up to send
    MX for bounces              mxa.mailgun.org, mxb.mailgun.org at e.casper.com and t.casper.com
    SPF                         include:mailgun.org at e.casper.com and t.casper.com             
    Setup                       complete                                                         

  Mandrill  ·  Transactional  ·  set up to send
    DKIM keys                   mte1, mte2 (all 2048 bit, by CNAME) at casper.com and               
                                email.casper.com                                                    
    SPF                         include:spf.mandrillapp.com at email.casper.com                     
    DKIM key                    mandrill (1024 bit, named for it)                                   
    Setup                       complete                                                            

  Postmark  ·  Transactional  ·  set up to send
    Bounce CNAME                pm-bounces.casper.com
    Setup                       complete             

  Q4  ·  Commerce and apps  ·  set up to send
    SPF                         include:_spf.q4press.com

  Salesforce  ·  Support and CRM  ·  set up to send
    SPF                         include:_spf.salesforce.com        
    DKIM key                    salesforce (1024 bit, named for it)

  Salesforce Marketing Cloud Engagement  ·  Marketing  ·  set up to send  at mail.casper.com
    SPF                         include:cust-spf.exacttarget.com
    Delegated by NS             mail.casper.com                 

  SendGrid  ·  Transactional  ·  set up to send
    DKIM keys                   s1 2048 bit, s2 1024 bit (by CNAME)
    DKIM key                    smtpapi (1024 bit, named for it)   
    Setup                       complete                           

  Customer.io  ·  Marketing  ·  likely sends  at e.casper.com
    DKIM key                    krs (2048 bit, named for it)
    Setup                       complete                    

  Microsoft 365  ·  Mailbox  ·  account only
    Verification token          MS=ms55520198                                                       
    Setup                       incomplete: SPF missing (the record does not authorize              
                                spf.protection.outlook.com), DKIM missing (no key at                
                                selector1._domainkey or selector2._domainkey, names with no TXT     
                                record; this zone gives that answer for every name that does not    
                                exist)                                                              

Not matched to a service
  These records point somewhere Sendermap does not recognise: a service it does not know yet, or    
  your own servers.                                                                                 

  DKIM key: mx
  IP address in SPF: 208.89.14.209 (AS11054, LIVEPERSON - LivePerson, Inc., US)
  mail server: incoming.bm23.com  at email.casper.com

Looked for and not found
  Records Sendermap looked for and did not find.

  DKIM keys at t.casper.com: selectors exist but none of the 32 names asked is one
    _domainkey.t.casper.com TXT no record of this type

How this was checked
  Checked 2026-10-12 01:25 UTC: 756 DNS lookups in 0.0 s over Google DNS over HTTPS.
  At casper.com: 114 possible DKIM key names, 25 service record names, 1 web page.
  At e.casper.com: 36 possible DKIM key names.
  At email.casper.com: 30 possible DKIM key names.
  At mail.casper.com: 32 possible DKIM key names.
  At orders.casper.com: 31 possible DKIM key names.
  At t.casper.com: 32 possible DKIM key names.
  Not checked: DKIM selectors at e.casper.com: 78 of 114 not asked. The first 27 were asked, plus   
  any the name's own SPF, MX or delegation points to (cap 27).                                      
  Not checked: DKIM selectors at email.casper.com: 80 of 110 not asked. The first 27 were asked,    
  plus any the name's own SPF, MX or delegation points to (cap 27).                                 
  Not checked: DKIM selectors at mail.casper.com: 82 of 114 not asked. The first 27 were asked, plus
  any the name's own SPF, MX or delegation points to (cap 27).                                      
  Not checked: DKIM selectors at orders.casper.com: 83 of 114 not asked. The first 27 were asked,   
  plus any the name's own SPF, MX or delegation points to (cap 27).                                 
  Not checked: DKIM selectors at t.casper.com: 78 of 110 not asked. The first 27 were asked, plus   
  any the name's own SPF, MX or delegation points to (cap 27).                                      
  Not run: the website. Web checks were turned off (--no-web).
  Not run: certificate transparency, crt.sh. Read only with --ct (it also holds expired             
  certificates).                                                                                    
  Add --evidence to see every record behind each line.
