digitregroup.com

Scanné à l'instant · Rescanner

Conformité expéditeur

SPF · DKIM · DMARC — 50/50

A+

Durcissement

DNS & transport — 20/45

✓ SPF 15/15

SPF present with -all (hardfail) — strongest policy. Uses 3/10 DNS lookups.

v=spf1 include:spf.mailjet.com include:spf.protection.outlook.com a:smtp-gw1.silae.fr ip4:31.172.232.198 ip4:145.239.114.130 -all

✓ DMARC 20/20

DMARC present — p=reject, sp=reject.

v=DMARC1; p=reject; rua=mailto:digitre.rua@emailsecurity.merox.io; ruf=mailto:digitre.ruf@emailsecurity.merox.io; fo=1;

✓ DKIM 15/15

Active DKIM key published for: selector1.
```
selector1
```
✗ CAA 0/10

No CAA records — any certificate authority can issue certs for this domain.
→ Restrict which CAs may issue certificates for your domain (create the security@ mailbox or alias to receive iodef reports).
```
CAA @  0 issue "letsencrypt.org"
0 iodef "mailto:security@digitregroup.com"
```
– DANE/TLSA 0/5

Mail is hosted by a third party (digitregroup-com.mail.protection.outlook.com) that publishes no TLSA — DANE lives in the mail server's zone, out of this domain owner's hands.
✗ MTA-STS 0/10

No MTA-STS record — inbound mail can be downgraded to cleartext.
→ Publish the MTA-STS TXT record AND serve the policy file at https://mta-sts.digitregroup.com/.well-known/mta-sts.txt (set id to a fresh YYYYMMDDnn value).
```
TXT _mta-sts.digitregroup.com  v=STSv1; id=REPLACE_WITH_DATE
```
✗ TLS-RPT 0/5

No TLS-RPT record — you won't be told when mail TLS fails.
→ Publish a TLS-RPT record to receive reports of mail TLS failures.
```
TXT _smtp._tls.digitregroup.com  v=TLSRPTv1; rua=mailto:tls-reports@digitregroup.com
```
✗ BIMI 0/5

No BIMI record found.

→ BIMI requires DMARC at quarantine/reject first. Then publish a BIMI record pointing to an SVG Tiny PS logo (l=) and ideally a VMC certificate (a=).
✓ DNSSEC 10/10

DNSSEC enabled — DS published at the parent, chain of trust complete.
```
32201 8 2 9a5723ce9427c4bbe827bc06831be00e502c277f4381caffd6a731b58d4fc04b
```
✓ TLS web 10/5

HTTPS active — TLSv1.3.

Ce domaine n'est qu'un début — surveillez vos 40 domaines et soyez alerté à la moindre dérive.

Rejoindre la liste d'attente