Sample report

What you get for $0.01, run on our own domain.

This is the full report DomainRef returned for 3l-groupconsulting.co.za, the domain of the company that runs DomainRef. Nothing is trimmed or edited. Checked 2026-10-21 20:05 SAST. It refreshes once a day.

3l-groupconsulting.co.za

Score 90/100. 0 fail, 1 warn, 6 pass, 6 info.

Live sample

WARN DKIM

DKIM keys found (selector1, selector2), but one is RSA under 2048 bits: selector1 (1024-bit). Receivers still accept them, but they are weak by current standards.

Fix: Microsoft 365 (selector1): in the Microsoft Defender portal DKIM tab (https://security.microsoft.com/authentication?viewid=DKIM) select 3l-groupconsulting.co.za and choose Rotate DKIM keys, or run Rotate-DkimSigningConfig -Identity 3l-groupconsulting.co.za -KeySize 2048 in Exchange Online PowerShell. The CNAMEs stay the same.
PASS SPF

One valid SPF record that inherits -all from redirect=3l-groupconsulting.co.za.spf.sophosdmarc.net, 2 of 10 DNS lookups.
PASS DMARC

DMARC enforces p=reject on 100% of mail, with reports to reports.sophosdmarc.net.
PASS MX

1 MX host, all resolvable.
PASS Website certificate (HTTPS on 443)

Valid certificate from Google Trust Services WE1, 40 days left.
PASS MTA-STS

MTA-STS enforced for 3lgroupconsulting-co-za0e.mail.protection.outlook.com, max_age 604800s.
PASS TLS-RPT

TLS-RPT reports go to reports.sophosdmarc.net.

6 optional extras (info, not scored)

INFO Microsoft 365 tenant

Not checked: the lookup did not complete (fetch failed). Left out of the score.
INFO Registration (registrar and age)

The .za registry publishes no RDAP service, so registrar and age cannot be read. Not graded.
INFO DNSSEC

DNSSEC is not enabled. DNS answers for this domain can be spoofed on the path.

Fix: Turn on DNSSEC at your DNS host, wait until it serves the DNSKEY, then publish the DS record it gives you at the registrar for 3l-groupconsulting.co.za (algorithm 13, digest type 2). Publish the DS last: a DS that does not match the zone takes the domain offline for validating resolvers until the DS TTL runs out.
INFO CAA

No CAA record, so any public CA may issue certificates for this domain.

Fix: Publish CAA at 3l-groupconsulting.co.za: 0 issue "pki.goog", plus one 0 issue record for every other CA that issues for you (check your CDN, e.g. Cloudflare or AWS, and any second CA), and 0 iodef "mailto:[email protected]". A CA left off the list cannot renew. [email protected] is a placeholder: replace it with a real mailbox you read (create it first).
INFO BIMI

No BIMI record (optional: shows your logo in Gmail, Apple Mail and Yahoo).

Fix: Publish TXT at default._bimi.3l-groupconsulting.co.za: "v=BIMI1; l=https://3l-groupconsulting.co.za/bimi/logo.svg" (SVG Tiny PS; Gmail also needs a VMC or CMC in a=).
INFO Blocklist (UCEPROTECT Level 1)

Not listed on UCEPROTECT Level 1 (4 mail IPs checked).

FAILBroken or missing. Fix this first. WARNWorks, but weaker than it should be. PASSSet up correctly. INFOOptional or informational. Never lowers the score.

The same report as JSON, the shape the API returns: /sample.json.

Check your own domain

Each check is $0.01, paid per call. Get an API key See pricing

Agents and wallets can pay per call over x402 or MPP with no key: see how to run a check. Or grade your own domain free first.