apple.com
Receivers are told to send to spam mail that fails authentication for this domain.
Forged mail is being filtered to spam rather than rejected, or the policy applies to only a share of messages. Most of the protection is there; the last step is not.
143 DNS queries · 1009 ms
- 1Selector 'selector1' uses a 1024-bit RSA keyRotate to 2048-bit at your next key rotation.
- 2Selector 'selector2' uses a 1024-bit RSA keyRotate to 2048-bit at your next key rotation.
- 3No MTA-STS policyPublish a TXT record at _mta-sts.apple.com and a policy file at https://mta-sts.apple.com/.well-known/mta-sts.txt.
- 4SPF ends in '~all' (softfail)Once your aggregate reports show no unexplained legitimate sources, tighten to '-all'.
Identity ·DMARC
- Policy
- quarantine
- Coverage
- 100%
- Alignment
- dkim=r spf=r
Identity ·DKIM
111 selectors probed
selector1Microsoft 365RSA 1024selector2Microsoft 365RSA 1024Identity ·SPF
Worst-case evaluation across every include.
- include:_spf.apple.com
- include:_spf-txn.apple.com
Findings (7)
MediumDMARC policy is p=quarantine›
Failing mail is delivered to spam rather than rejected. A meaningful improvement over none, but spoofed mail still reaches the recipient's mailbox.
Move to p=reject once reports show no legitimate mail failing.
MediumSelector 'selector1' uses a 1024-bit RSA key›
1024-bit is the RFC 8301 floor, not a good target. 2048-bit is the current recommendation and is universally supported.
Rotate to 2048-bit at your next key rotation.
RFC 8301
MediumSelector 'selector2' uses a 1024-bit RSA key›
1024-bit is the RFC 8301 floor, not a good target. 2048-bit is the current recommendation and is universally supported.
Rotate to 2048-bit at your next key rotation.
RFC 8301
LowSPF ends in '~all' (softfail)›
Softfail is the correct setting while you are still discovering senders, but it asks receivers to accept unauthorised mail and merely note it.
Once your aggregate reports show no unexplained legitimate sources, tighten to '-all'.
LowNo MTA-STS policy›
Without MTA-STS, mail to your domain can be downgraded to plaintext by an active network attacker, because SMTP's STARTTLS is opportunistic by default.
Publish a TXT record at _mta-sts.apple.com and a policy file at https://mta-sts.apple.com/.well-known/mta-sts.txt.
RFC 8461
LowNo TLS-RPT record›
Sending servers have no address to report TLS failures on mail to your domain, so transport problems stay invisible to you until someone complains.
Publish 'v=TLSRPTv1; rua=mailto:<address>' at _smtp._tls.apple.com.
RFC 8460
InfoZone is not signed with DNSSEC›
This is the common case and not a misconfiguration -- most working mail domains are unsigned. It is worth knowing because your authentication records are only as trustworthy as the DNS answers carrying them, and because DNSSEC is the prerequisite for DANE.
If your DNS provider supports one-click DNSSEC, enabling it is low risk. If it does not, this is not worth changing providers over.
RFC 4033
Show 7 passing checks
PassAggregate reporting is configured›
Aggregate reports are requested at: [email protected].
PassExternal report destination rua.agari.com is correctly authorised›
Authorised by apple.com._report._dmarc.rua.agari.com
PassExternal report destination ruf.agari.com is correctly authorised›
Authorised by apple.com._report._dmarc.ruf.agari.com
PassSPF lookup count is healthy (2/10)›
Worst-case evaluation stays within the limit with headroom to spare.
Pass2 DKIM key(s) published›
Found at: selector1, selector2.
PassBIMI is published with a certificate reference›
The record at default._bimi.apple.com names a logo and a Verified Mark Certificate (a=), and DMARC is enforcing, which BIMI requires. We read the record only; the logo and certificate themselves were not fetched or checked.
PassCertificate issuance is restricted by CAA›
Only pki.apple.com may issue certificates for this domain, so a certificate for your mail hosts or your MTA-STS policy endpoint from any other authority would be a mis-issuance. Wildcard certificates are limited separately, to pki.apple.com.
RFC 8659
Transport and zone
Where your mail lands, and whether the DNS carrying your records can be trusted.
This is the configuration. It is not the whole picture.
A DNS scan cannot tell you whether apple.com’s mail actually aligns, because alignment is decided per message at the receiver. Collect DMARC aggregate reports to see every source sending as this domain.