What's happening

Your DKIM key was generated when 1024-bit was the default. It still validates, but providers like Yahoo and Gmail are increasingly biased against shorter keys when reputation is borderline.

Fix in Google Admin (Workspace)

1. Sign in at admin.google.com with super-admin rights.
2. Go to Apps → Google Workspace → Gmail → Authenticate email.
3. Select your domain, then click Generate new record and choose 2048-bit.
4. Copy the new TXT record value Google provides.
5. In your DNS host, add a new TXT record at google._domainkey with the new value (replace the existing 1024-bit record, or stage it as google2024._domainkey first if you want a safe rollover).
6. Back in Google Admin, click Start authentication.

Verify

Wait 1 hour for propagation, then re-run this audit. The selector should report 2048-bit and remain a pass.

The safe rollout

Never jump straight from quarantine to reject. Use these stages:

1. Confirm clean RUA reports — review at least 30 days of aggregate DMARC reports (the rua address) and check that everything sending mail on your behalf is aligned. Tools like Postmark, Valimail, or dmarcian make this readable.
2. Tighten alignment — switch aspf=r and adkim=r to s (strict) only after you're sure every legitimate sender authenticates the exact sending domain.
3. Step up to reject with pct=10 — change p=reject but keep pct=10 so only 10% of failing mail is actually rejected. Monitor for two weeks.
4. Ramp pct — 25, 50, then 100 over 4–6 weeks. Each step, watch for reports of legitimate mail being rejected.

Target record

v=DMARC1; p=reject; rua=mailto:dmarc@perfect-config.example;
ruf=mailto:dmarc@perfect-config.example; pct=100; aspf=s; adkim=s

Warning

If you use ESPs (MailerLite, Mailchimp, etc.) that don't fully align, you must add them as authorised senders in SPF and ensure they DKIM-sign with your domain before going to reject.

What MTA-STS does

MTA-STS lets sending servers know they should require TLS when delivering to your domain. Without it, attackers can force connections to downgrade to plain text and intercept mail.

Two steps to deploy

1. Add a TXT record in DNS at _mta-sts.perfect-config.example with the value:

   v=STSv1; id=20260524001

   The id is a version stamp — increment it whenever you update the policy file.
2. Publish a policy file at https://mta-sts.perfect-config.example/.well-known/mta-sts.txt:

   version: STSv1
   mode: enforce
   mx: aspmx.l.google.com
   mx: *.aspmx.l.google.com
   max_age: 604800

   The host mta-sts.perfect-config.example must serve over HTTPS with a valid certificate. On cPanel, create a subdomain pointing to the same docroot and ensure AutoSSL covers it.

Recommended companion: TLS-RPT

Pair it with a TLS-RPT record so you receive reports when delivery fails: v=TLSRPTv1; rua=mailto:tls-reports@perfect-config.example at _smtp._tls.perfect-config.example.

Verify

Allow 1 hour for DNS, then re-run this audit. Both MTA-STS and TLS-RPT checks should pass.

Add a single TXT record

Add a TXT record at _smtp._tls.perfect-config.example with the value:

v=TLSRPTv1; rua=mailto:tls-reports@perfect-config.example

Use a real, monitored mailbox (or alias) — reports are useful diagnostic data, especially after enabling MTA-STS in enforce mode.

Verify

Wait 30 minutes for DNS, then re-run this audit.

What HSTS does

The Strict-Transport-Security header tells browsers "always use HTTPS for this site, never plain HTTP, even if a user types http://". This blocks the entire class of SSL-stripping man-in-the-middle attacks.

Safe rollout (do not skip stages)

1. Stage 1 — short max-age: add the header with a 5-minute max-age. Check nothing breaks. Apache (in .htaccess or vhost):

   Header always set Strict-Transport-Security "max-age=300"

   Nginx:

   add_header Strict-Transport-Security "max-age=300" always;

2. Stage 2 — 1 day: bump to max-age=86400. Monitor for 24 hours.
3. Stage 3 — 1 year + includeSubDomains:

   max-age=31536000; includeSubDomains

   Only add includeSubDomains after confirming every subdomain serves HTTPS.
4. Stage 4 — preload (optional): once stable for 6+ months, add preload and submit at hstspreload.org to be baked into browsers.

Warning

HSTS is sticky — once a browser sees it, it remembers for the full max-age. Don't deploy with a 1-year max-age until you're certain.

Verify

Re-run this audit. Header should appear in the response.

Why CSP is tricky

CSP defines exactly which sources can load scripts, styles, images, fonts, and so on. Get it wrong and your site breaks visibly. Always deploy in report-only mode first.

Starter CSP (report-only)

Content-Security-Policy-Report-Only:
  default-src 'self';
  script-src 'self' 'unsafe-inline' https://www.googletagmanager.com;
  style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;
  font-src 'self' https://fonts.gstatic.com;
  img-src 'self' data: https:;
  connect-src 'self';
  frame-ancestors 'self';
  report-uri /csp-report

Monitor reports for 2-4 weeks, adjust, then switch from Content-Security-Policy-Report-Only to Content-Security-Policy.

Permissions-Policy starter

Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()