online-metrix.net
At risk, with 3 things to fix
online-metrix.net scored 28/100 (grade F). The main issues are no DMARC record and no SPF record, plus 1 more. Detected senders: Zoho Mail.
Checked 2026-10-04 02:09 UTC · fresh check
Publish an SPF record
Lists the sending services detected for online-metrix.net (Zoho Mail) and rejects everything else. Add any other service that sends as online-metrix.net before publishing. Changes: Added include:zoho.com for Zoho Mail.
online-metrix.net
Some DNS providers want “@” here instead of the full domain.
v=spf1 include:zoho.com -all
How to apply it
- Sign in where your domain’s DNS is managed. This is often where you bought the domain, such as Cloudflare, GoDaddy or Namecheap.
- Add a new TXT record with the name and value above.
- Save, then come back and re-check. DNS changes can take up to a few hours to show.
All checks
MXCan servers find your inbox?No issues foundPass
Nothing to report.
SPFWho may send as you?No SPF recordFailing
- Fail: No SPF record
online-metrix.net publishes no TXT record starting with "v=spf1", so receivers cannot tell which servers may send mail for it. Publish one SPF record listing every service that sends as online-metrix.net.
How to fix this
DKIMAre your emails signed?No DKIM key found for the common selectorsNeeds attention
- Warning: No DKIM key found for the common selectors
None of the 47 selectors probed under online-metrix.net publish a DKIM key. DNS cannot list selectors, so a key under a custom selector may exist: find the s= value in the DKIM-Signature header of a message you sent and check that selector. If DKIM is not set up, enable it at each service that sends mail for online-metrix.net.
DMARCWhat happens to fakes?No DMARC recordFailing
- Fail: No DMARC record
There is no v=DMARC1 TXT record at _dmarc.online-metrix.net. Without DMARC, receivers have no policy for mail that fails SPF and DKIM, and Gmail and Yahoo require one for bulk senders. Start with p=none and a rua address to collect reports.
How to fix this
AlignmentDoes it match your From?No issues foundPass
Nothing to report.
BIMICan inboxes show your logo?No BIMI recordInfo
- Info: No BIMI record
No BIMI record at default._bimi.online-metrix.net. BIMI is optional: it shows your logo next to your mail in supporting inboxes once DMARC is enforced.
How to fix this
MTA-STSIs mail to you encrypted?No MTA-STS recordInfo
- Info: No MTA-STS record
No MTA-STS record at _mta-sts.online-metrix.net. MTA-STS (RFC 8461) makes sending servers require TLS and a valid certificate when delivering to you, which blocks downgrade attacks.
How to fix this
TLS-RPTWill you hear about failures?No TLS-RPT recordInfo
- Info: No TLS-RPT record
No TLS reporting record at _smtp._tls.online-metrix.net. TLS-RPT (RFC 8460) tells senders where to send daily reports about failed encrypted deliveries to you.
How to fix this
Other fixes
Publish a DMARC recordTXT
Starts DMARC in monitoring mode (p=none), so you can see who sends as online-metrix.net before enforcing a policy. Move to quarantine once the reports show only your own services.
_dmarc.online-metrix.net
Some DNS providers want just “_dmarc” here.
v=DMARC1; p=none; adkim=r; aspf=r
Enable DKIM for Zoho Mailinstruction
Zoho Mail generates the DKIM key for each account, so the exact record must come from Zoho Mail. Without DKIM, mail it sends for online-metrix.net cannot pass DMARC through DKIM.
Applies to: zoho._domainkey.online-metrix.net
- In Zoho Mail, enable DKIM signing for online-metrix.net: account-specific: copy the CNAME/TXT from the Zoho Mail dashboard. Publish exactly the record Zoho Mail shows (TXT or CNAME) at the host name it gives, then turn signing on. Instructions: https://www.zoho.com/mail/help/adminconsole/dkim-configuration.html
Publish the MTA-STS recordTXT
Tells sending servers that online-metrix.net publishes an MTA-STS policy at https://mta-sts.online-metrix.net/.well-known/mta-sts.txt. Change the id whenever the policy file changes.
_mta-sts.online-metrix.net
Some DNS providers want just “_mta-sts” here.
v=STSv1; id=202610040209
Host the MTA-STS policy filepolicy-file
Serve this file over HTTPS with a valid certificate for mta-sts.online-metrix.net. It lists your MX hosts and starts in testing mode; switch to mode: enforce once TLS-RPT reports show no failures.
https://mta-sts.online-metrix.net/.well-known/mta-sts.txt
version: STSv1 mode: testing mx: mx.zoho.com mx: mx2.zoho.com max_age: 604800
Set up a TLS report addressinstruction
Sending servers will report TLS failures when delivering to online-metrix.net, which you need before enforcing MTA-STS. The address must accept TLS reports; a DMARC report address does not necessarily do so.
Applies to: _smtp._tls.online-metrix.net
- Pick an address that will receive TLS reports: a mailbox you read (for example tls-reports@online-metrix.net, created first) or a TLS reporting service. 2. Publish a TXT record at _smtp._tls.online-metrix.net with the value v=TLSRPTv1; rua=mailto:<that address>.
Prepare BIMIinstruction
BIMI shows your logo next to messages in supporting inboxes, but only for mail that passes DMARC under an enforced policy.
Applies to: default._bimi.online-metrix.net
- Enforce DMARC first: p=quarantine or p=reject at 100% (no pct below 100). 2. Convert your logo to an SVG Tiny PS file and host it over HTTPS, for example https://online-metrix.net/bimi/logo.svg. 3. For Gmail and Apple Mail, obtain a VMC or CMC certificate for the logo. 4. Publish a TXT record at default._bimi.online-metrix.net with v=BIMI1, l= set to the logo URL and a= set to the certificate URL.