top-kek.fr

Scanné il y a 2 h · Rescanner

Conformité expéditeur

SPF · DKIM · DMARC — 0/50

Durcissement

DNS & transport — 10/40

✗ SPF 0/15

No SPF record found — anyone can send mail as this domain.
→ Publish an SPF record listing your authorized senders, ending with -all.
```
TXT @  v=spf1 include:_spf.google.com -all
```
✗ DMARC 0/20

No DMARC record found.
→ Publish DMARC. Start at p=none to monitor, then progress to quarantine and reject.
```
TXT _dmarc.top-kek.fr  v=DMARC1; p=none; rua=mailto:dmarc@top-kek.fr
```
✗ DKIM 0/15

No DKIM key found — probed 7 selectors for google.com. A custom selector may still exist: selectors are unbounded, so absence cannot be proved from DNS alone.

→ Enable DKIM signing at your email provider and publish the public key it gives you at <selector>._domainkey.top-kek.fr. DKIM keys are provider-specific and can't be generated generically.
✗ CAA 0/10

No CAA records — any certificate authority can issue certs for this domain.
→ Restrict which CAs may issue certificates for your domain (create the security@ mailbox or alias to receive iodef reports).
```
CAA @  0 issue "letsencrypt.org"
0 iodef "mailto:security@top-kek.fr"
```
– DANE/TLSA 0/5

Mail is hosted by a third party (smtp.google.com) that publishes no TLSA — DANE lives in the mail server's zone, out of this domain owner's hands.
✗ MTA-STS 0/10

No MTA-STS record — inbound mail can be downgraded to cleartext.
→ Publish the MTA-STS TXT record AND serve the policy file at https://mta-sts.top-kek.fr/.well-known/mta-sts.txt (set id to a fresh YYYYMMDDnn value).
```
TXT _mta-sts.top-kek.fr  v=STSv1; id=REPLACE_WITH_DATE
```
✗ TLS-RPT 0/5

No TLS-RPT record — you won't be told when mail TLS fails.
→ Publish a TLS-RPT record to receive reports of mail TLS failures.
```
TXT _smtp._tls.top-kek.fr  v=TLSRPTv1; rua=mailto:tls-reports@top-kek.fr
```
✗ BIMI 0/5

No BIMI record found.

→ BIMI requires DMARC at quarantine/reject first. Then publish a BIMI record pointing to an SVG Tiny PS logo (l=) and ideally a VMC certificate (a=).
✓ DNSSEC 10/10

DNSSEC enabled — DS published at the parent, chain of trust complete.
```
58561 8 2 38bd5014cf52a2e885b039c1c0fd8fc1a476624c3f2ac7abbe17782482550001
```
– TLS web 0/5

No public web address — this domain has no website to secure.

Ce domaine n'est qu'un début — surveillez vos 40 domaines et soyez alerté à la moindre dérive.

Rejoindre la liste d'attente