Email Security

SPF, DKIM, DMARC, BIMI and email authentication analysis
Score
95/100
SPF
Present
DKIM
Key present
DMARC
REJECT
Findings
8

BIMI

Status: DNS policy eligible
DMARC Policy
REJECT
Enforcement
100%
Evidence Document
Declared, not fetched
Logo URL (declared)
https://www.cloudflare.com/cloudflare_1171114652.svg
Evidence Document URL (declared)
https://www.cloudflare.com/cloudflare_1171114652.pem
Record
v=BIMI1; l=https://www.cloudflare.com/cloudflare_1171114652.svg; a=https://www.cloudflare.com/cloudflare_1171114652.pem
BIMI certificate declared but not cryptographically verified
Eligibility reflects declared BIMI DNS data and local DMARC policy posture. Logo assets and evidence documents are not fetched or cryptographically verified in this DNS-only check. Final logo display remains mailbox-provider dependent.

BIMI lets a domain declare a brand-logo location for supported inboxes, but this lookup only checks the DNS record and DMARC posture. It does not fetch the logo, verify evidence documents, or prove mailbox-provider display.

SMTP STARTTLS

Status: Not tested
MX Host
5 · mxa-canary.global.inbound.cf-emailsecurity.net
MX Host
5 · mxb-canary.global.inbound.cf-emailsecurity.net
MX Host
10 · mxa.global.inbound.cf-emailsecurity.net
MX Host
10 · mxb.global.inbound.cf-emailsecurity.net
MTA-STS
Not configured
TLS-RPT
Not configured

STARTTLS is negotiated during a live SMTP session after EHLO. This DNS-only lookup does not connect to MX hosts, complete a TLS handshake, or validate SMTP certificates. MTA-STS and TLS-RPT can improve transport policy and reporting, but they do not prove that a specific MX currently accepts STARTTLS.

MTA-STS

No MTA-STS record detected

MTA-STS publishes a HTTPS policy for mail delivery TLS expectations. This lookup checks the DNS record and policy file, but it does not perform a live SMTP delivery or prove that every MX currently negotiates TLS.

TLS-RPT

No TLS-RPT record detected

TLS-RPT publishes where mail systems can report TLS delivery problems. It is a reporting record, not a live SMTP TLS or certificate validation result.