aa.com

Checked 5/14/2026, 10:50:20 PM · 40ms

Solid: p=reject is enforced.

DMARC record

v=DMARC1; p=reject; sp=reject; fo=1; ri=3600; rua=mailto:[email protected]; ruf=mailto:[email protected]

Policy (p): reject
Subdomain policy (sp): reject
Enforcement % (pct): 100%
DKIM alignment (adkim): unset · defaults to r (relaxed)
SPF alignment (aspf): unset · defaults to r (relaxed)
Aggregate reports (rua): mailto:[email protected]
Failure reports (ruf): mailto:[email protected]

All tags (7)

vDMARC1DMARC version
prejectPolicy for the domain
sprejectPolicy for subdomains
fo1Failure reporting options
ri3600Reporting interval (seconds)
ruamailto:[email protected]Aggregate report URIs
rufmailto:[email protected]Forensic (failure) report URIs

SPF record

Found on the apex domain.

v=spf1 include:spf.protection.outlook.com include:onprem.aa.com include:_spf-dc4.sapsf.com include:spf.aa.com ip4:169.55.103.7 ip4:169.55.103.8 ip4:169.44.200.37 ip4:169.44.200.38 ip4:136.147.176.0/20 ip4:13.111.0.0/18 ip4:70.42.227.151 ip4:70.42.227.152 ip4:146.20.91.152 ip4:146.20.91.153 ip4:66.48.80.132 ip4:204.232.172.40 ip4:161.47.34.7 ip4:108.166.43.0/24 ip4:173.203.2.22 ip4:12.104.201.5 ip4:91.198.224.29/32 ip4:194.37.255.29/32 ~all

Recommendations

DKIM alignment (adkim) is unset, so it defaults to r (relaxed). That is fine for most deployments. Set adkim=s explicitly only if your DKIM d= header matches the From: domain exactly.
SPF alignment (aspf) is unset, so it defaults to r (relaxed). That is fine for most deployments. Set aspf=s explicitly only if your Return-Path aligns with the From: domain exactly.

AI-assisted remediation

Want a tailored fix plan in plain English?

Wiredepth Pro sends this report to our AI engine and streams back a 30-day rollout plan tailored to aa.com, with provider-specific tips when we can infer them from the data. 10 playbooks per month on Pro, 100 on MSP.

ProSee Pro plans→

Check another domain

Or share this URL with the team that owns the records.