Excellent, with 1 thing to fix

epicgames.com scored 92/100 (grade A). The main issue is DKIM key shorter than 2048 bits. Detected senders: Google Workspace.

Checked 2026-10-04 02:03 UTC · fresh check

3 passed1 needs attention0 failing4 for informationDetected senders: Google Workspace

All checks

MXCan servers find your inbox?No issues foundPass

Nothing to report.

SPFWho may send as you?SPF ends in softfail (~all)Info

Info: SPF ends in softfail (~all)
"~all" is common and works well with DMARC. "-all" is stricter; switch when you are sure every sender is listed.

DKIMAre your emails signed?DKIM key shorter than 2048 bitsNeeds attention

Warning: DKIM key shorter than 2048 bits
google (1024-bit), k1 (1024-bit), s2 (1024-bit) uses an RSA key below 2048 bits. Short keys can be factored and some receivers treat them as weak. Rotate to a 2048-bit key at your sending provider.
Pass: DKIM key published
epicgames.com publishes a DKIM key under google, k1, s1, s2.

DMARCWhat happens to fakes?No issues foundPass

Nothing to report.

AlignmentDoes it match your From?SPF alignment is unknownInfo

Info: SPF alignment is unknown
The SPF record of epicgames.com authorizes no sender (no +ip4, +ip6, +a, +mx, +exists or +ptr term, include of a record that has one, or +all before all), so SPF never passes and cannot align. That is correct for a domain that sends no mail; otherwise DMARC depends on DKIM alone.

BIMICan inboxes show your logo?No issues foundPass

Nothing to report.

MTA-STSIs mail to you encrypted?No MTA-STS recordInfo

Info: No MTA-STS record
No MTA-STS record at _mta-sts.epicgames.com. MTA-STS (RFC 8461) makes sending servers require TLS and a valid certificate when delivering to you, which blocks downgrade attacks.
How to fix this

TLS-RPTWill you hear about failures?No TLS-RPT recordInfo

Info: No TLS-RPT record
No TLS reporting record at _smtp._tls.epicgames.com. TLS-RPT (RFC 8460) tells senders where to send daily reports about failed encrypted deliveries to you.
How to fix this

How to fix it

Publish the MTA-STS recordTXT

Tells sending servers that epicgames.com publishes an MTA-STS policy at https://mta-sts.epicgames.com/.well-known/mta-sts.txt. Change the id whenever the policy file changes.

TypeTXT

Name / Host

_mta-sts.epicgames.com

Some DNS providers want just “_mta-sts” here.

Value

v=STSv1; id=202610040203

Host the MTA-STS policy filepolicy-file

Serve this file over HTTPS with a valid certificate for mta-sts.epicgames.com. It lists your MX hosts and starts in testing mode; switch to mode: enforce once TLS-RPT reports show no failures.

Location

https://mta-sts.epicgames.com/.well-known/mta-sts.txt

Contents

version: STSv1
mode: testing
mx: aspmx.l.google.com
mx: alt1.aspmx.l.google.com
mx: alt2.aspmx.l.google.com
mx: alt3.aspmx.l.google.com
mx: alt4.aspmx.l.google.com
max_age: 604800

Set up a TLS report addressinstruction

Sending servers will report TLS failures when delivering to epicgames.com, which you need before enforcing MTA-STS. The address must accept TLS reports; a DMARC report address does not necessarily do so.

Applies to: _smtp._tls.epicgames.com

Pick an address that will receive TLS reports: a mailbox you read (for example tls-reports@epicgames.com, created first) or a TLS reporting service. 2. Publish a TXT record at _smtp._tls.epicgames.com with the value v=TLSRPTv1; rua=mailto:<that address>.