sncf.fr

Scanné à l'instant · Rescanner

Conformité expéditeur

SPF · DKIM · DMARC — 47/50

Durcissement

DNS & transport — 7/45

✓ SPF 15/15

SPF present with -all (hardfail) — strongest policy. Uses 5/10 DNS lookups.
```
v=spf1 include:spf.sncf.fr include:_spf.prod.vsct.fr include:_spf.dev.vsct.fr -all
```

✓ DMARC 20/20

DMARC present — p=reject, sp=reject.

v=DMARC1; p=reject; fo=1; rua=mailto:dmarc_rua@emaildefense.proofpoint.com; ruf=mailto:dmarc_ruf@emaildefense.proofpoint.com

~ DKIM 12/15

DKIM key found (k2, k3, mail) but looks 1024-bit or weaker: mail.
```
k2, k3, mail
```
→ Rotate to a 2048-bit DKIM key at your provider.
✗ CAA 0/10

No CAA records — any certificate authority can issue certs for this domain.
→ Restrict which CAs may issue certificates for your domain (create the security@ mailbox or alias to receive iodef reports).
```
CAA @  0 issue "letsencrypt.org"
0 iodef "mailto:security@sncf.fr"
```
– DANE/TLSA 0/5

Mail is hosted by a third party (mxa-00363202.gslb.pphosted.com, mxb-00363202.gslb.pphosted.com) that publishes no TLSA — DANE lives in the mail server's zone, out of this domain owner's hands.
✗ MTA-STS 0/10

No MTA-STS record — inbound mail can be downgraded to cleartext.
→ Publish the MTA-STS TXT record AND serve the policy file at https://mta-sts.sncf.fr/.well-known/mta-sts.txt (set id to a fresh YYYYMMDDnn value).
```
TXT _mta-sts.sncf.fr  v=STSv1; id=REPLACE_WITH_DATE
```
✗ TLS-RPT 0/5

No TLS-RPT record — you won't be told when mail TLS fails.
→ Publish a TLS-RPT record to receive reports of mail TLS failures.
```
TXT _smtp._tls.sncf.fr  v=TLSRPTv1; rua=mailto:tls-reports@sncf.fr
```
✗ BIMI 0/5

No BIMI record found.

→ BIMI requires DMARC at quarantine/reject first. Then publish a BIMI record pointing to an SVG Tiny PS logo (l=) and ideally a VMC certificate (a=).
✗ DNSSEC 0/10

DNSSEC not detected.

→ Enable DNSSEC at your DNS host, then add the DS record at your registrar to complete the chain of trust.
~ TLS web 7/5

HTTPS active — TLSv1.2. TLS 1.3 is recommended.

→ Enable TLS 1.3 on your web server.

Ce domaine n'est qu'un début — surveillez vos 40 domaines et soyez alerté à la moindre dérive.

Rejoindre la liste d'attente