Skip to content
emailrules.today

Authentication history · 60 days observed

americanexpress.com

Observed from 4 Aug 2026 to 3 Oct 2026. Nothing published in DNS has moved in that window.

Where it stands today

Live lookup, 3 Oct 2026. The same check /check/americanexpress.com runs.

  • 2fine
  • 3context

  • Looks fine

    present, ending -all

    Hard fail. The strictest setting and the right one once you are confident every sender is listed.

    v=spf1 ip4:63.241.217.23 ip4:74.125.149.0/24 ip4:74.125.150.0/24 ip4:66.119.44.14 ip4:66.119.44.13 ip4:66.244.67.0/24 ip4:199.3.18.4 ip4:148.173.88.0/26 ip4:148.173.96.128/26 -all

    See what this looks like →

  • Looks fine

    present with p=reject

    A policy that actually instructs receivers, which is more than most senders publish.

    v=DMARC1;p=reject;fo=1;rua=mailto:dmarc_agg@auth.returnpath.net;ruf=mailto:dmarc_afrf@auth.returnpath.net

    From DMARC p=none is monitoring, not enforcementSee what this looks like →

  • Context

    No key found on the selectors we know

    This is inconclusive, not a failure. selectors cannot be listed from , so we probed the common ones for Klaviyo, Google, Microsoft, Mailchimp, SendGrid and Postmark. A custom selector will not show up here.

    From DKIM passing is not DKIM alignedSee what this looks like →

  • Context

    record published

    Your logo can appear in supporting clients, which needs at quarantine or reject.

    See what this looks like →

  • Context

    MX records present

    Where you receive mail says nothing about where you send it. Marketing sends usually leave through a different platform entirely.

    mx0b-0023b801.pphosted.com, mx0a-0023b801.pphosted.com

    See what this looks like →

What has moved

One entry per day a published record actually changed. Days we looked and found nothing different are counted, not listed.

  1. First observation — what was already published

    SPF published.

    v=spf1 ip4:63.241.217.23 ip4:74.125.149.0/24 ip4:74.125.150.0/24 ip4:66.119.44.14 ip4:66.119.44.13 ip4:66.244.67.0/24 ip4:199.3.18.4 ip4:148.173.88.0/26 ip4:148.173.96.128/26 -all

    DMARC published.

    v=DMARC1;p=reject;fo=1;rua=mailto:dmarc_agg@auth.returnpath.net;ruf=mailto:dmarc_afrf@auth.returnpath.net

    No DKIM key on the selectors we probe.

    BIMI published.

    v=BIMI1; l=https://www.aexp-static.com/cdaas/one/statics/@americanexpress/static-assets/2.32.1/package/dist/bimi/american_express_company.svg; a=https://www.aexp-static.com/cdaas/dls/static/bimi/american_express_company.pem

    MX records present.

    mx0a-0023b801.pphosted.com, mx0b-0023b801.pphosted.com
Where this comes from. Public DNS, and nothing else. We read the same TXT and MX records any mail server reads before accepting a message, on the days someone looked. There is no scan, no login, no mail, and no score here — only what was published and the date we saw it. Gaps are days we did not get a clean answer from a resolver, and we would rather leave those blank than guess at them.
Run the full checkSee which rules are yours