facebook.com

facebook.com · Last checked 2026-10-04 02:01 UTC

facebook.com

Good, with 2 things to fix

facebook.com scored 84/100 (grade B). The main issues are DKIM key revoked and external DMARC report address is not authorized.

Checked 2026-10-04 02:01 UTC · fresh check

3 passed2 need attention0 failing3 for information

All checks

MXCan servers find your inbox?Only one MX hostInfo
  • Info: Only one MX host

    All mail for facebook.com goes to smtpin.vvv.facebook.com. Most hosted providers make that one name highly available; if you run your own server, consider a backup MX.

SPFWho may send as you?No issues foundPass

Nothing to report.

DKIMAre your emails signed?DKIM key revokedNeeds attention
  • Warning: DKIM key revoked

    default publishes an empty p= tag, so any mail still signed with that selector fails DKIM. That is correct after a key rotation; otherwise publish the current key or stop signing with this selector.

DMARCWhat happens to fakes?External DMARC report address is not authorizedNeeds attention
  • Warning: External DMARC report address is not authorized

    Reports go to dmarc.facebookmail.com, which is outside facebook.com. RFC 7489 requires that domain to publish a valid v=DMARC1 TXT record at facebook.com._report._dmarc.dmarc.facebookmail.com; without it receivers will not send you aggregate reports. Your report provider normally publishes this for you.

AlignmentDoes it match your From?No issues foundPass

Nothing to report.

BIMICan inboxes show your logo?No BIMI recordInfo
  • Info: No BIMI record

    No BIMI record at default._bimi.facebook.com. BIMI is optional: it shows your logo next to your mail in supporting inboxes once DMARC is enforced.

    How to fix this
MTA-STSIs mail to you encrypted?MTA-STS is in testing modeInfo
  • Info: MTA-STS is in testing mode

    Senders report TLS failures (with TLS-RPT) but still deliver. Switch to mode: enforce once the reports are clean.

TLS-RPTWill you hear about failures?TLS-RPT is configuredPass
  • Pass: TLS-RPT is configured

    TLS reports will be sent to mailto:sts-reports@facebookmail.com.

How to fix it

Prepare BIMIinstruction

BIMI shows your logo next to messages in supporting inboxes, but only for mail that passes DMARC under an enforced policy.

Applies to: default._bimi.facebook.com

  1. Enforce DMARC first: p=quarantine or p=reject at 100% (no pct below 100). 2. Convert your logo to an SVG Tiny PS file and host it over HTTPS, for example https://facebook.com/bimi/logo.svg. 3. For Gmail and Apple Mail, obtain a VMC or CMC certificate for the logo. 4. Publish a TXT record at default._bimi.facebook.com with v=BIMI1, l= set to the logo URL and a= set to the certificate URL.