Unverified sender / no SPF·DKIM·DMARC
Part of the Email safety check · fix arrives as a guide
What it is
Nothing in the repository shows the sending domain has been verified — no SPF, DKIM, DMARC or domain-verification evidence in config, IaC or docs — and mail is sent from it anyway.
Why it matters
This check reads your code, not your DNS, so it flags the absence of any sign the domain was set up. If the records genuinely are published, the finding is a documentation gap; if they are not, unauthenticated mail lands in spam, and password resets in spam read to your users as an outage. Without DMARC anyone can also send as your domain.
How to fix it
Confirm the records exist: publish SPF covering your sending provider, enable DKIM and publish the key, then add DMARC at p=none to collect reports before moving to quarantine and reject. Record the setup in the repo so the next person does not have to guess.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.