dgfip.finances.gouv.fr

Scanné il y a 19 j · Rescanner

Conformité expéditeur

SPF · DKIM · DMARC — 50/50

A+

Durcissement

DNS & transport — 7/45

✓ DMARC 20/20

DMARC present — p=reject, sp=reject.

v=DMARC1;p=reject;sp=reject;aspf=r;adkim=r;fo=1;rua=mailto:rua@dgfip.finances.gouv.fr!5m;ruf=mailto:ruf@dgfip.finances.gouv.fr!5m

~ CAA 7/10

CAA present but no iodef reporting.

0 issue "sectigo.com" | 0 issue "certigna.fr" | 0 issue "globalsign.com" | 0 issue "digicert.com"

→ Add an iodef record to be notified of unauthorized issuance attempts.

CAA @  0 iodef "mailto:security@dgfip.finances.gouv.fr"

✗ DANE/TLSA 0/5

No DANE/TLSA records on the MX (mail.dgfip.finances.gouv.fr).

→ DANE requires DNSSEC. Once the zone is signed, publish a TLSA record at _25._tcp.<mail-server> for each MX host, matching the certificate it serves on port 25.
✗ MTA-STS 0/10

No MTA-STS record — inbound mail can be downgraded to cleartext.
→ Publish the MTA-STS TXT record AND serve the policy file at https://mta-sts.dgfip.finances.gouv.fr/.well-known/mta-sts.txt (set id to a fresh YYYYMMDDnn value).
```
TXT _mta-sts.dgfip.finances.gouv.fr  v=STSv1; id=REPLACE_WITH_DATE
```
✗ TLS-RPT 0/5

No TLS-RPT record — you won't be told when mail TLS fails.
→ Publish a TLS-RPT record to receive reports of mail TLS failures.
```
TXT _smtp._tls.dgfip.finances.gouv.fr  v=TLSRPTv1; rua=mailto:tls-reports@dgfip.finances.gouv.fr
```
✗ BIMI 0/5

No BIMI record found.

→ BIMI requires DMARC at quarantine/reject first. Then publish a BIMI record pointing to an SVG Tiny PS logo (l=) and ideally a VMC certificate (a=).
✗ DNSSEC 0/10

DNSSEC not detected.

→ Enable DNSSEC at your DNS host, then add the DS record at your registrar to complete the chain of trust.
– TLS web 0/5

No public web address — this domain has no website to secure.

Ce domaine n'est qu'un début — surveillez vos 40 domaines et soyez alerté à la moindre dérive.