nikon.com

SPF record published

Found

Record

v=spf1 ip4:66.159.235.157 ip4:66.159.246.31 ip4:205.220.175.202 ip4:205.220.163.203 ip4:205.220.177.10 ip4:205.220.165.10 ip4:143.55.146.95 ip4:143.55.149.5 ip4:148.163.157.185 ip4:148.163.159.149 ip4:67.231.145.117 ip4:208.86.201.73 ip4:202.55.137.94 ip4:202.55.138.93 ip4:202.55.138.94 ip4:202.55.139.102 ip4:202.55.139.118 ip4:202.55.139.120 ip4:4.241.96.193 ip4:48.210.84.68 ip4:20.222.105.192 ip4:61.113.120.160/29 ip4:46.34.80.160/30 ip4:66.11.133.41 ip4:66.11.133.42 ip4:18.168.51.200 ip4:18.168.140.58 ip4:148.59.101.16/28 ip4:58.80.8.125 ip4:160.17.14.67 ip4:13.71.133.58 ip4:210.166.72.24/31 ip4:210.166.72.35 ip4:210.166.72.36/31 include:spf.protection.outlook.com ip4:103.239.16.0/26 ip4:103.239.16.64/26 ip4:52.193.161.140 ip4:54.238.138.18 ip4:52.192.185.134 ip4:3.115.118.190 ip4:103.2.52.0/23 ip4:158.201.232.0/22 ip4:158.201.238.0/23 ip4:158.201.247.96/27 ip4:158.201.247.128/26 ip4:158.201.250.0/22 ip4:203.133.232.0/21 ip4:210.171.0.0/22 ip4:210.171.6.208/28 ip4:210.171.13.0/25 ip4:210.171.15.128/26 ip4:210.171.21.0/24 ip4:13.112.173.97 ip4:13.114.237.143 ip4:18.99.64.208/29 ip4:35.72.25.0/24 ip4:35.72.75.115 ip4:52.69.196.84 ip4:52.198.79.8 ip4:54.95.172.92 ip4:149.72.113.121 ip4:159.183.221.130 ip4:209.222.82.0/24 ip4:20.97.70.227 ip4:20.98.2.159 ip4:20.98.33.77 ip4:40.124.2.148 ip4:52.240.209.173 ip4:52.252.238.67 ip4:58.191.37.0/24 ip4:58.191.38.0/24 ip4:58.191.39.0/24 ip4:58.191.56.0/24 ip4:121.87.8.0/24 ip4:121.87.10.0/24 ip4:121.87.12.0/24 ip4:121.87.20.0/24 ip4:121.87.22.0/24 ip4:121.87.24.0/24 ip4:121.87.26.0/24 ip4:121.87.51.0/24 ip4:128.27.33.0/24 ip4:128.27.34.0/24 ip4:128.27.35.0/24 ip4:128.27.36.0/24 ip4:128.27.37.0/24 ip4:218.251.75.0/24 include:_spf2.nikon.com include:_spf3.nikon.com ?all

DNS lookups

5 of 10

Void lookups

0 of 2

Checks

• ✓ No deprecated ptr mechanism #1

  No ptr mechanism found in SPF record.
• ✓ 5 of 10 DNS lookups #2

  SPF record needs 5 DNS lookups (limit is 10).
• !

  Ends with ?all (neutral)

  SPF record uses ?all (neutral), which gives no protection against unauthorized senders. Use -all or ~all instead.

  #3
• ✓ Record published #6

  SPF record exists for this domain.
• ✓ Single record #16

  Exactly one SPF record is published.
• ✓ Valid syntax #25

  All SPF mechanisms and modifiers are valid.
• ✓ No void lookups #26

  All include/redirect targets exist.
• ✓ No overly broad IP ranges #27

  All ip4/ip6 ranges are narrow enough.

p=quarantine (_dmarc.nikon.com)

Found

Record

v=DMARC1; p=quarantine; fo=1; rua=mailto:nikoncom.dmarc.rua@nikon.com, mailto:nikon00001-ra@dmarc25.jp; ruf=mailto:nikoncom.dmarc.ruf@nikon.com

Found at

_dmarc.nikon.com

External report address

mailto:nikon00001-ra@dmarc25.jp (authorized)

Checks

• !

  Policy: quarantine

  DMARC policy is set to 'quarantine'. Consider upgrading to 'reject' for stronger protection once you've verified legitimate emails are passing authentication.

  #4
• ✓ Record published #5

  DMARC record exists for this domain.
• ✓ Valid syntax #17

  DMARC record syntax is valid.
• ✓ Applies to 100% of mail #18

  DMARC policy applies to all failing mail.
• ✓ Aggregate reports enabled #19

  Aggregate reports are sent to: mailto:nikoncom.dmarc.rua@nikon.com, mailto:nikon00001-ra@dmarc25.jp
• ✓ Subdomain policy: quarantine #20

  Subdomains are covered by policy 'quarantine'.
• ✓ External report addresses authorized #29

  Report addresses in other domains have published their authorization.

Selectors: s1, s2

Found

Selectors

s1, s2

_domainkey

NOERROR

Checks

• ✓ Keys found: s1, s2 #7

  DKIM keys found for this domain with selectors: s1, s2
• !

  1024-bit DKIM key

  1024-bit RSA keys are the minimum and are considered weak today: s1 (1024 bits), s2 (1024 bits). Rotate to a 2048-bit key.

  #23
• ✓ No problematic flags #24

  No keys in test mode, revoked, or limited to SHA-1.

Not signed

Found

DNSKEY records

No (0)

DS at parent

No

Checks

• !

  Not enabled

  DNSSEC is not enabled for this domain. Consider enabling DNSSEC to protect against DNS spoofing attacks.

  #8

2 mail servers

Found

Checks

• ✓ 2 MX records #9

  Found 2 MX records for this domain.
• ✓ All hosts resolve #10

  All MX records resolve to valid IP addresses.
• !

  Hosts without IPv6

  The following MX hosts could not be resolved to IPv6 addresses: mxa-00620203.gslb.pphosted.com, mxb-00620203.gslb.pphosted.com

  #11
• ✓ Redundant MX hosts #12

  Found 2 MX records, which provides redundancy for email delivery.
• ✓ At most 5 MX records #13

  Found 2 MX records, which is within the recommended range (1-5).
• ✓ No localhost targets #14

  No MX records pointing to localhost found.
• ✓ No private IP addresses #15

  No MX records resolving to private IP addresses found.
• ✓ No CNAME targets #22

  No MX records point to a CNAME.
• ✓ Reverse DNS confirmed #30

  All 2 MX addresss have a PTR record that resolves back to them.

no MTA-STS · no TLS-RPT · DANE on 0 of 2 MX hosts

Found

DANE (TLSA records)

Checks

• !

  Not configured

  MTA-STS is not configured, so other mail servers fall back to unencrypted delivery when TLS fails or is stripped by an attacker. Publish a _mta-sts TXT record and a policy at https://mta-sts.<domain>/.well-known/mta-sts.txt.

  #32
• i

  Not configured

  TLS-RPT lets senders report TLS delivery problems to you. It is most useful together with MTA-STS or DANE.

  #35
• i

  Not used

  No MX host publishes TLSA records. DANE lets senders verify your mail server's certificate through DNSSEC; it requires DNSSEC on the MX host's zone.

  #36