sparkasse.de

22 passed 5 warn 2 failed

Areas

Problems

• ✗

  Policy: none (monitoring only)

  DMARC · DMARC policy is set to 'none', which only monitors but doesn't protect against spoofing. Consider upgrading to 'quarantine' or ideally 'reject'.

  #4
• ✗

  TLSA records not DNSSEC-validated

  TLS · These MX hosts publish TLSA records that the resolver could not validate with DNSSEC, so senders ignore them or, if validation fails, may refuse delivery: mx1.heinlein-support.de, mx2.heinlein-support.de, mx3.heinlein-support.de.

  #36
• !

  Hosts without IPv6

  MX · The following MX hosts could not be resolved to IPv6 addresses: mx1.heinlein-support.de, mx2.heinlein-support.de, mx3.heinlein-support.de, sparkasse-de.mail.protection.outlook.com

  #11
• !

  No aggregate reports (rua)

  DMARC · DMARC record has no rua tag, so you receive no aggregate reports about who sends mail as your domain. Add rua=mailto:...

  #19
• !

  Signatures expire in 77h0m0s

  DNSSEC · DNSKEY signatures expire at 2026-10-25T05:02:18Z (in 77h0m0s). Check that re-signing works.

  #21
• !

  Not configured

  TLS · MTA-STS is not configured, so other mail servers fall back to unencrypted delivery when TLS fails or is stripped by an attacker. Publish a _mta-sts TXT record and a policy at https://mta-sts.<domain>/.well-known/mta-sts.txt.

  #32
• !

  Not configured

  TLS · MTA-STS or DANE is used without TLS-RPT, so you get no reports when senders fail to deliver because of TLS problems. Publish _smtp._tls TXT "v=TLSRPTv1; rua=mailto:...".

  #35

Recent checks

Full report

Mail report for sparkasse.de ›