One thing is yours.
19 DNS lookups23 blocklists askedno entriesno score, ever
read from DNS, quoted verbatim
- SPF
- ~all
- DMARC
- p=none
- DKIM
- 3 selectors
- BIMI
- published
- MX
- Google Workspace
- LISTS
- 23 asked
Who sends as you
4 Aug 2026 · no score, no grade, nothing inferred
Who this domain authorises
SendGrid signs your mail — and your SPF does not list it
- s1._domainkeyDKIM key present
- s2._domainkeyDKIM key present
2 of SendGrid’s own selectors carry live keys, which is a setup somebody completed — not a selector collision. Your SPF names somebody else, so this mail passes DMARC on DKIM alignment alone.
google._domainkey is Google Workspace, which is where staff read mail. It says nothing about where campaigns leave from, and a checker that counts it as your sending platform has told you about your inbox, not your list.
This is what your DNS authorises, not proof of what you send. A domain can authorise a platform it stopped paying for two years ago, and it can carry live keys for a platform it never authorised, which is the reverse and the more expensive of the two. Only a real message names the address that actually sent your campaign.
Whose job each one is
- 1worth a look
- 3fine
- 2context
Worth a look
present with p=none
This satisfies Gmail and Outlook, and protects nothing. p=none only asks for reports; it never tells a receiver to act, so anyone can still send as this domain and nothing happens.
v=DMARC1; p=none; rua=mailto:5b009d635d9641139a9258faa394b65c@dmarc-reports.cloudflare.net;
From DMARC p=none is monitoring, not enforcementSee what this looks like →
This one needs you
Move to p=quarantine with pct=5 once a week of shows no unaligned sender you cannot name. No platform can choose your policy. This one has never been anybody else's.
Looks fine
present, ending ~all
Soft fail. Accepted everywhere, though -all is stronger once your sender list is complete.
v=spf1 include:_s00398851.autospf.email ~all
Looks fine
keys published on 3 selectors
A key existing is not the same as working. Read a real received header and check the d= value matches your before you call this done.
google._domainkey (Google Workspace), s2._domainkey (SendGrid), s1._domainkey (SendGrid)
From DKIM passing is not DKIM alignedSee what this looks like →
Part platform, part you
The key is your platform's to publish and it has. Whether it signs the domain in your is yours to confirm, and cannot show it — send one campaign to yourself and look for =pass header.d=lush.com in the Authentication-Results header.
Looks fine
SendGrid is authorised on link.lush.com
SendGrid signs mail as this domain, and the root record does not name it — which on its own looks like a mismatch. It is not: link.lush.com publishes its own SPF naming SendGrid, and SPF is evaluated against the envelope domain rather than the root. This is the normal setup for bulk mail on a subdomain.
v=spf1 include:_s00398851.autospf.email ~all
From Gmail enforces authentication, PTR, TLS and a 0.30 percent spam rateSee what this looks like →
Context
record published
Your logo can appear in supporting clients, which needs at quarantine or reject.
Context
Receiving mail via Google Workspace
Where you receive mail says nothing about where you send it. Marketing sends usually leave through a different platform entirely.
aspmx.l.google.com, alt3.aspmx.l.google.com, alt4.aspmx.l.google.com
Blocklists
Nothing has an entry for you.
23 lists asked0 with an entry1 could not be asked
lush.com is not on any of the 23 lists that answered us today. That is the whole result — there is no score, and a clean answer is allowed to be short.
Which lists, and which would not answer
- SpamCopanswered
- PSBLanswered
- Mailspikeanswered
- Spam Eating Monkeyanswered
- blocklist.deanswered
- 0SPAManswered
- InterServeranswered
- SPFBLanswered
- GBUdb Truncateanswered
- s5h.netanswered
- ZapBLanswered
- SWINOGanswered
- Kemptanswered
- Anonmailsanswered
- Fabelanswered
- NoSolicitadoanswered
- Schulteanswered
- JIPPGanswered
- UCEPROTECT Level 1answered
- UCEPROTECT Level 2answered
- UCEPROTECT Level 3answered
- Backscattereranswered
- SEM Backscatteranswered
- URIBLdeclined the query
Each of these answered an entry it is required to publish, and one it is required not to, before we believed anything it said about you. A list that fails either is reported as unanswered rather than as clean — because a blocklist that declines to reply looks exactly like one giving you the all-clear. How we choose them.
Putting this in a client report? Embed a live, dated badge that re-checks itself.
Watch this domain
One email if authentication DNS for lush.com actually changes. Same list as rule alerts — one inbox, one promise.