exobserver.com
Scanné il y a 78 min · Rescanner
Conformité expéditeur
SPF · DKIM · DMARC — 10/50
Durcissement
DNS & transport — 10/45
-
~ SPF 10/15
SPF present with ~all (softfail). Hardfail (-all) is stronger. Uses 6/10 DNS lookups.
v=spf1 a mx ip4:46.105.249.64/28 ip4:137.74.10.192/28 ip4:51.178.241.160/27 include:spf.mailjet.com include:mx.ovh.com ~all
→ Once all senders are listed, tighten ~all to -all.TXT @ v=spf1 a mx ip4:46.105.249.64/28 ip4:137.74.10.192/28 ip4:51.178.241.160/27 include:spf.mailjet.com include:mx.ovh.com -all
-
✗ DMARC 0/20
No DMARC record found.
→ Publish DMARC. Start at p=none to monitor, then progress to quarantine and reject.TXT _dmarc.exobserver.com v=DMARC1; p=none; rua=mailto:dmarc@exobserver.com
-
✗ DKIM 0/15
No DKIM key found — probed 20 selectors (no known provider in MX/SPF). A custom selector may still exist: selectors are unbounded, so absence cannot be proved from DNS alone.
→ Enable DKIM signing at your email provider and publish the public key it gives you at <selector>._domainkey.exobserver.com. DKIM keys are provider-specific and can't be generated generically. -
✗ CAA 0/10
No CAA records — any certificate authority can issue certs for this domain.
→ Restrict which CAs may issue certificates for your domain (create the security@ mailbox or alias to receive iodef reports).CAA @ 0 issue "letsencrypt.org" 0 iodef "mailto:security@exobserver.com"
-
– DANE/TLSA 0/5
Mail is hosted by a third party (redirect.ovh.net) that publishes no TLSA — DANE lives in the mail server's zone, out of this domain owner's hands.
-
✗ MTA-STS 0/10
No MTA-STS record — inbound mail can be downgraded to cleartext.
→ Publish the MTA-STS TXT record AND serve the policy file at https://mta-sts.exobserver.com/.well-known/mta-sts.txt (set id to a fresh YYYYMMDDnn value).TXT _mta-sts.exobserver.com v=STSv1; id=REPLACE_WITH_DATE
-
✗ TLS-RPT 0/5
No TLS-RPT record — you won't be told when mail TLS fails.
→ Publish a TLS-RPT record to receive reports of mail TLS failures.TXT _smtp._tls.exobserver.com v=TLSRPTv1; rua=mailto:tls-reports@exobserver.com
-
✗ BIMI 0/5
No BIMI record found.
→ BIMI requires DMARC at quarantine/reject first. Then publish a BIMI record pointing to an SVG Tiny PS logo (l=) and ideally a VMC certificate (a=). -
✓ DNSSEC 10/10
DNSSEC enabled — DS published at the parent, chain of trust complete.
46022 8 2 b61d28008a3c92c5e56ce9fef985b2bd4d141a25f0cd5de4f15e4f21d49267bb
-
✗ TLS web 0/5
HTTPS served with an invalid certificate (Hostname mismatch, certificate is not valid for 'exobserver.com'.).
→ Fix the certificate: it must be valid, unexpired and issued for this hostname.
Ce domaine n'est qu'un début — surveillez vos 40 domaines et soyez alerté à la moindre dérive.
Rejoindre la liste d'attente