Good, with 2 things to fix

mixpanel.com scored 84/100 (grade B). The main issues are DKIM key shorter than 2048 bits and DMARC: subdomain policy is weaker than the domain policy. Detected senders: Google Workspace, HubSpot and Zendesk.

Checked 2026-10-04 02:17 UTC · fresh check

5 passed2 need attention0 failing1 for informationDetected senders: Google Workspace, HubSpot, Zendesk

Fix this firstThe change with the biggest effect

Strengthen the DMARC policy

Rejects mail that fails DMARC, the strongest protection against spoofing. Changes: Subdomains move one step, from sp=none to sp=quarantine.

TypeTXT

Name / Host

_dmarc.mixpanel.com

Some DNS providers want just “_dmarc” here.

Value

v=DMARC1; p=reject; sp=quarantine; rua=mailto:dmarcreports@mixpanel.com; adkim=r; aspf=r

Replaces

v=DMARC1; p=reject; sp=none; fo=1; ri=3600; rua=mailto:dmarcreports@mixpanel.com

How to apply it

Sign in where your domain’s DNS is managed. This is often where you bought the domain, such as Cloudflare, GoDaddy or Namecheap.
Find the existing TXT record with that name and replace its value.
Save, then come back and re-check. DNS changes can take up to a few hours to show.

All checks

MXCan servers find your inbox?No issues foundPass

Nothing to report.

SPFWho may send as you?No issues foundPass

Nothing to report.

DKIMAre your emails signed?DKIM key shorter than 2048 bitsNeeds attention

Warning: DKIM key shorter than 2048 bits
google (1024-bit), s2 (1024-bit) uses an RSA key below 2048 bits. Short keys can be factored and some receivers treat them as weak. Rotate to a 2048-bit key at your sending provider.
Pass: DKIM key published
mixpanel.com publishes a DKIM key under google, s1, s2.

DMARCWhat happens to fakes?Subdomain policy is weaker than the domain policyNeeds attention

Warning: Subdomain policy is weaker than the domain policy
sp=none is weaker than p=reject, so attackers can spoof any subdomain of mixpanel.com (for example billing.mixpanel.com) even though the main domain is protected.
How to fix this

AlignmentDoes it match your From?No issues foundPass

Nothing to report.

BIMICan inboxes show your logo?No BIMI recordInfo

Info: No BIMI record
No BIMI record at default._bimi.mixpanel.com. BIMI is optional: it shows your logo next to your mail in supporting inboxes once DMARC is enforced.
How to fix this

MTA-STSIs mail to you encrypted?No issues foundPass

Nothing to report.

TLS-RPTWill you hear about failures?TLS-RPT is configuredPass

Pass: TLS-RPT is configured
TLS reports will be sent to mailto:smtp-tls-reports@mixpanel.com.

Other fixes

Prepare BIMIinstruction

BIMI shows your logo next to messages in supporting inboxes, but only for mail that passes DMARC under an enforced policy.

Applies to: default._bimi.mixpanel.com

Enforce DMARC first: p=quarantine or p=reject at 100% (no pct below 100). 2. Convert your logo to an SVG Tiny PS file and host it over HTTPS, for example https://mixpanel.com/bimi/logo.svg. 3. For Gmail and Apple Mail, obtain a VMC or CMC certificate for the logo. 4. Publish a TXT record at default._bimi.mixpanel.com with v=BIMI1, l= set to the logo URL and a= set to the certificate URL.