Fixed — A domain deliberately set up to send and receive no email — a null MX record, an SPF record of "v=spf1 -all", a reject DMARC policy and a wildcard DKIM record with an empty key — was graded as if it were misconfigured. The wildcard DKIM record, which revokes every signing key, looked to the scanner like a DNS setup that answers every name, so DKIM came back "can't be verified". And the DMARC record was marked down for not asking for reports that a domain sending no mail has no use for. Both were false alarms and no longer appear.

Improved — The Email Authentication card now recognises a null MX record and says so: the domain is graded as a no-mail domain, DKIM shows "all selectors revoked" instead of "missing", and the fix instructions for any gap give the exact records such a domain should publish rather than a mail provider's SPF include.

Improved — The free Email Security Checker and the check_email_auth MCP tool make the same distinction, so all three give a no-mail domain the same verdict.

Improved — A DKIM record with an empty key is a revocation, not a key. It is no longer counted as DKIM being configured on a domain that does send mail, and a domain that revoked every selector while still publishing mail servers is told so, with the two ways to resolve it.

v2.1.67 — released September 8, 2026