Skip to content
Signet
Start free

cisco.com

Receivers are told to reject mail that fails authentication for this domain.

Enforced

Receivers are told to reject mail that fails authentication for this domain. Keep watching aggregate reports so a new sending service does not silently start failing.

Score held up: DMARC is enforcing at p=reject, so nobody else can send as this domain. That is the hard part, and it is done. What is left below is about your own mail arriving, not about anyone spoofing you.

144 DNS queries · 11188 ms

Fix these first
  1. 1
    Selector 'selector1' uses a 1024-bit RSA key
    Rotate to 2048-bit at your next key rotation.
  2. 2
    Selector 'smtpapi' uses a 1024-bit RSA key
    Rotate to 2048-bit at your next key rotation.
  3. 3
    Selector 'iport' uses a 1024-bit RSA key
    Rotate to 2048-bit at your next key rotation.
  4. 4
    Selector 'intercom' uses a 1024-bit RSA key
    Rotate to 2048-bit at your next key rotation.

Identity ·Sending services detected

Read from your SPF includes and MX hosts, then checked for a published DKIM key.

Microsoft 365SPF include:spf.protection.outlook.comkey published · selector1

Identity ·DMARC

v=DMARC1; p=reject; pct=100; sp=reject; fo=1; ri=3600; rua=mailto:[email protected]; ruf=mailto:[email protected];
Policy
reject
Coverage
100%
Alignment
dkim=r spf=r

Identity ·DKIM

111 selectors probed

selector1Microsoft 365RSA 1024
k2MailchimpRSA 2048
k3MailchimpRSA 2048
mte1Mailchimp TransactionalRSA 2048
mte2Mailchimp TransactionalRSA 2048
s1SendGridRSA 2048
s2SendGridRSA 2048
smtpapiSendGridRSA 1024
zendesk1ZendeskRSA 2048
zendesk2ZendeskRSA 2048
ciscoCisco Secure EmailRSA 2048
iportCisco IronPortRSA 1024
intercomIntercomRSA 1024
qualtricsQualtricsRSA 2048
key1GenericRSA 2048
s3GenericRSA 2048

Identity ·SPF

Worst-case evaluation across every include.

v=spf1 redirect=spfa._spf.cisco.com
DNS lookup budget6 / 10
  • include:spfa._spf.cisco.com
  • include:spf.protection.outlook.com
  • include:spfb._spf.cisco.com
  • include:spfc._spf.cisco.com

Findings (7)

MediumSelector 'selector1' uses a 1024-bit RSA key›

1024-bit is the RFC 8301 floor, not a good target. 2048-bit is the current recommendation and is universally supported.

What to do

Rotate to 2048-bit at your next key rotation.

RFC 8301

MediumSelector 'smtpapi' uses a 1024-bit RSA key›

1024-bit is the RFC 8301 floor, not a good target. 2048-bit is the current recommendation and is universally supported.

What to do

Rotate to 2048-bit at your next key rotation.

RFC 8301

MediumSelector 'iport' uses a 1024-bit RSA key›

1024-bit is the RFC 8301 floor, not a good target. 2048-bit is the current recommendation and is universally supported.

What to do

Rotate to 2048-bit at your next key rotation.

RFC 8301

MediumSelector 'intercom' uses a 1024-bit RSA key›

1024-bit is the RFC 8301 floor, not a good target. 2048-bit is the current recommendation and is universally supported.

What to do

Rotate to 2048-bit at your next key rotation.

RFC 8301

LowNo MTA-STS policy›

Without MTA-STS, mail to your domain can be downgraded to plaintext by an active network attacker, because SMTP's STARTTLS is opportunistic by default.

What to do

Publish a TXT record at _mta-sts.cisco.com and a policy file at https://mta-sts.cisco.com/.well-known/mta-sts.txt.

RFC 8461

LowNo TLS-RPT record›

Sending servers have no address to report TLS failures on mail to your domain, so transport problems stay invisible to you until someone complains.

What to do

Publish 'v=TLSRPTv1; rua=mailto:<address>' at _smtp._tls.cisco.com.

RFC 8460

InfoZone is not signed with DNSSEC›

This is the common case and not a misconfiguration -- most working mail domains are unsigned. It is worth knowing because your authentication records are only as trustworthy as the DNS answers carrying them, and because DNSSEC is the prerequisite for DANE.

What to do

If your DNS provider supports one-click DNSSEC, enabling it is low risk. If it does not, this is not worth changing providers over.

RFC 4033

Show 21 passing checks
PassAggregate reporting is configured›

Aggregate reports are requested at: [email protected].

PassExternal report destination ag.dmarcian.com is correctly authorised›

Authorised by cisco.com._report._dmarc.ag.dmarcian.com

PassExternal report destination fr.dmarcian.com is correctly authorised›

Authorised by cisco.com._report._dmarc.fr.dmarcian.com

PassDMARC policy is p=reject›

Mail failing authentication is rejected outright. This is the correct end state.

PassSPF lookup count is healthy (6/10)›

Worst-case evaluation stays within the limit with headroom to spare.

PassMicrosoft 365's DKIM key is published at selector1._domainkey›

Detected via SPF include:spf.protection.outlook.com. A valid public key for this service is published at selector1._domainkey.cisco.com.

Pass16 DKIM key(s) published›

Found at: cisco, intercom, iport, k2, k3, key1, mte1, mte2, qualtrics, s1, s2, s3, selector1, smtpapi, zendesk1, zendesk2.

PassSelector 'k2' uses a 2048-bit RSA key›

Key length meets current guidance.

PassSelector 'k3' uses a 2048-bit RSA key›

Key length meets current guidance.

PassSelector 'mte1' uses a 2048-bit RSA key›

Key length meets current guidance.

PassSelector 'mte2' uses a 2048-bit RSA key›

Key length meets current guidance.

PassSelector 's1' uses a 2048-bit RSA key›

Key length meets current guidance.

PassSelector 's2' uses a 2048-bit RSA key›

Key length meets current guidance.

PassSelector 'zendesk1' uses a 2048-bit RSA key›

Key length meets current guidance.

PassSelector 'zendesk2' uses a 2048-bit RSA key›

Key length meets current guidance.

PassSelector 'cisco' uses a 2048-bit RSA key›

Key length meets current guidance.

PassSelector 'qualtrics' uses a 2048-bit RSA key›

Key length meets current guidance.

PassSelector 'key1' uses a 2048-bit RSA key›

Key length meets current guidance.

PassSelector 's3' uses a 2048-bit RSA key›

Key length meets current guidance.

PassBIMI is published with a certificate reference›

The record at default._bimi.cisco.com names a logo and a Verified Mark Certificate (a=), and DMARC is enforcing, which BIMI requires. We read the record only; the logo and certificate themselves were not fetched or checked.

PassCertificate issuance is restricted by CAA›

Only amazon.com, digicert.com, globalsign.com, identrust.com, letsencrypt.org, pki.goog, ssl.com may issue certificates for this domain, so a certificate for your mail hosts or your MTA-STS policy endpoint from any other authority would be a mis-issuance. Wildcard certificates are limited separately, to digicert.com, identrust.com, ssl.com.

RFC 8659

Transport and zone

Where your mail lands, and whether the DNS carrying your records can be trusted.

MXalln-mx-01.cisco.com, rcdn-mx-01.cisco.com, aer-mx-01.cisco.com
Reverse DNSforward-confirmed on every host
MTA-STSnot published
TLS-RPTnot published
BIMIpublished
DNSSECzone not signedCommon and not a misconfiguration.
CAAdigicert.com, ssl.com, pki.goog, amazon.com, identrust.com, globalsign.com, letsencrypt.org · wildcard: identrust.com, digicert.com, ssl.com
DANEno TLSA records

This is the configuration. It is not the whole picture.

A DNS scan cannot tell you whether cisco.com’s mail actually aligns, because alignment is decided per message at the receiver. Collect DMARC aggregate reports to see every source sending as this domain.

Watch this domain, freeCheck another domain
cisco.com scores A for SPF, DKIM and DMARC · Signet