{
  "domain": "example.com",
  "checkedAt": "2026-09-16T12:00:00+00:00",
  "status": "warning",
  "checks": [
    {
      "check": "dns",
      "status": "pass",
      "code": "domain_resolves",
      "detail": null,
      "records": null,
      "evidenceLimited": false,
      "summary": "The domain has a published IPv4 or IPv6 address.",
      "recommendation": null,
      "optional": false
    },
    {
      "check": "mx",
      "status": "pass",
      "code": "mx_published",
      "detail": null,
      "records": null,
      "evidenceLimited": false,
      "summary": "Incoming mail servers are published in DNS.",
      "recommendation": null,
      "optional": false
    },
    {
      "check": "spf",
      "status": "warning",
      "code": "softfail_policy",
      "detail": "Configuration analysis only; no sender IP, HELO or MAIL FROM was evaluated.",
      "records": [
        "example.com TXT v=spf1 mx ~all"
      ],
      "evidenceLimited": false,
      "summary": "SPF is published with ~all (soft fail). Unlisted senders are treated as suspicious, rather than given an SPF hard fail.",
      "recommendation": "Confirm every legitimate sender is authorized before considering -all. Do not change this solely to make the report green.",
      "optional": false
    },
    {
      "check": "dmarc",
      "status": "pass",
      "code": "direct_policy_quarantine",
      "detail": null,
      "records": null,
      "evidenceLimited": false,
      "summary": "DMARC requests quarantine for messages that fail aligned SPF and DKIM.",
      "recommendation": null,
      "optional": false
    },
    {
      "check": "dkim",
      "status": "not_tested",
      "code": "selector_required",
      "detail": null,
      "records": null,
      "evidenceLimited": false,
      "summary": "No DKIM key was found at the default selector. A different selector may be in use.",
      "recommendation": "Enter the selector supplied by your mail provider, or the s= value from a DKIM-Signature header. The d= domain in that header must match the domain you check.",
      "optional": false
    },
    {
      "check": "bimi",
      "status": "not_configured",
      "code": "record_not_found",
      "detail": null,
      "records": null,
      "evidenceLimited": false,
      "summary": "No BIMI record is published. BIMI is an optional inbox-logo feature.",
      "recommendation": "Configure this only if you want supported mailboxes to display a verified brand logo. It is not required for ordinary email.",
      "optional": true
    },
    {
      "check": "mta_sts",
      "status": "not_configured",
      "code": "record_not_found",
      "detail": null,
      "records": null,
      "evidenceLimited": false,
      "summary": "No MTA-STS record is published. This optional policy can strengthen encrypted mail delivery.",
      "recommendation": "An MTA-STS rollout needs a valid HTTPS policy and verified MX coverage. Start with testing before enforcing delivery requirements.",
      "optional": true
    },
    {
      "check": "tls_rpt",
      "status": "not_configured",
      "code": "record_not_found",
      "detail": null,
      "records": null,
      "evidenceLimited": false,
      "summary": "No TLS reporting record is published. This optional feature reports mail encryption problems.",
      "recommendation": "Publish TLS reporting only after choosing and preparing the report destination.",
      "optional": true
    },
    {
      "check": "dnssec",
      "status": "unknown",
      "code": "no_authenticated_answer",
      "detail": null,
      "records": null,
      "evidenceLimited": false,
      "summary": "DNSSEC validation could not be established for this answer.",
      "recommendation": "Try a new check later; this result does not by itself justify changing DNS.",
      "optional": false
    },
    {
      "check": "certificate",
      "status": "pass",
      "code": "hostname_and_chain_valid",
      "detail": null,
      "records": null,
      "evidenceLimited": false,
      "summary": "The HTTPS certificate matches the hostname and has a trusted certificate chain.",
      "recommendation": null,
      "optional": false
    }
  ],
  "certificate": {
    "status": "pass",
    "expiresAt": "2026-11-15T12:00:00+00:00",
    "daysRemaining": 60,
    "reason": null,
    "revocation": "not_checked"
  },
  "resolver": "Cloudflare DNS over HTTPS",
  "version": "2026-09-2"
}