Authentication history · 60 days observed
zoom.us
Observed from 4 Aug 2026 to 3 Oct 2026. Nothing published in DNS has moved in that window.
Where it stands today
Live lookup, 3 Oct 2026. The same check /check/zoom.us runs.
- 3fine
- 3context
Looks fine
present, ending ~all
Soft fail. Accepted everywhere, though -all is stronger once your sender list is complete.
v=spf1 include:%{ir}.%{v}.%{d}.spf.has.pphosted.com include:_spf.google.com include:amazonses.com ip4:52.38.191.241 include:servers.mcsv.net include:_spf.salesforce.com ip4:13.110.78.0/24 ~allLooks fine
present with p=reject
A policy that actually instructs receivers, which is more than most senders publish.
v=DMARC1;p=reject;ri=3600;rua=mailto:sesbounce@zoom.us,mailto:dmarc_rua@emaildefense.proofpoint.com;
From DMARC p=none is monitoring, not enforcementSee what this looks like →
Looks fine
keys published on 5 selectors
A key existing is not the same as working. Read a real received header and check the d= value matches your before you call this done.
google._domainkey (Google Workspace), k1._domainkey (Mailchimp), mandrill._domainkey (Mandrill), s2._domainkey (SendGrid), s1._domainkey (SendGrid)
From DKIM passing is not DKIM alignedSee what this looks like →
Part platform, part you
The key is Mailchimp's to publish and it has. Whether it signs the domain in your is yours to confirm, and cannot show it — send one campaign to yourself and look for =pass header.d=zoom.us in the Authentication-Results header.
Context
SendGrid signs your mail, and your cannot be read to confirm it
2 of SendGrid's selectors carry live keys on this domain, so SendGrid is signing mail as you. Whether your authorises it is not answerable by reading . Your record uses SPF macros (Proofpoint), so the authorised senders are resolved per message from the connecting IP and are never published as a list. No checker can settle it from DNS, including this one — anyone who tells you this record does or does not list SendGrid is guessing.
v=spf1 include:%{ir}.%{v}.%{d}.spf.has.pphosted.com include:_spf.google.com include:amazonses.com ip4:52.38.191.241 include:servers.mcsv.net include:_spf.salesforce.com ip4:13.110.78.0/24 ~allFrom Gmail enforces authentication, PTR, TLS and a 0.30 percent spam rateSee what this looks like →
Good to know — nothing to fix
Send one real campaign through SendGrid and read the Authentication-Results header on what arrives. That header is the only place this question gets answered, because it is the receiver evaluating the macro against the real .
Context
record published
Your logo can appear in supporting clients, which needs at quarantine or reject.
Context
MX records present
Where you receive mail says nothing about where you send it. Marketing sends usually leave through a different platform entirely.
mxb-00569201.gslb.pphosted.com, mxa-00569201.gslb.pphosted.com
What has moved
One entry per day a published record actually changed. Days we looked and found nothing different are counted, not listed.
First observation — what was already published
SPF published.
v=spf1 include:%{ir}.%{v}.%{d}.spf.has.pphosted.com include:_spf.google.com include:amazonses.com ip4:52.38.191.241 include:servers.mcsv.net include:_spf.salesforce.com ip4:13.110.78.0/24 ~allDMARC published.
v=DMARC1;p=reject;ri=3600;rua=mailto:sesbounce@zoom.us,mailto:dmarc_rua@emaildefense.proofpoint.com;
DKIM keys on selectors we probe.
google._domainkey (Google Workspace), k1._domainkey (Mailchimp), mandrill._domainkey (Mandrill), s1._domainkey (SendGrid), s2._domainkey (SendGrid)
BIMI published.
v=BIMI1; l=https://explore.zoom.us/media/zoom-icon-bimi.svg; a=https://explore.zoom.us/docs/zoom_video_communications_inc.pem;
MX records present.
mxa-00569201.gslb.pphosted.com, mxb-00569201.gslb.pphosted.com