gitlab.com
Receivers are told to reject mail that fails authentication for this domain.
Receivers are told to reject mail that fails authentication for this domain. Keep watching aggregate reports so a new sending service does not silently start failing.
169 DNS queries · 3557 ms
- 1SPF exceeds the 10 DNS-lookup limit (13 used)Remove unused include: mechanisms, or replace a costly provider include with the ip4/ip6 ranges it resolves to. The include tree below shows the cost of each branch.
- 2Could not verify DKIM signing for Salesforce Marketing CloudConfirm DKIM is switched on in Salesforce Marketing Cloud, then add your selector here so every future scan can verify it directly.
- 3Selector 'm1' uses a 1024-bit RSA keyRotate to 2048-bit at your next key rotation.
- 4Selector 'google' uses a 1024-bit RSA keyRotate to 2048-bit at your next key rotation.
Identity ·Sending services detected
Read from your SPF includes and MX hosts, then checked for a published DKIM key.
Identity ·DMARC
- Policy
- reject
- Coverage
- 100%
- Alignment
- dkim=r spf=r
Identity ·DKIM
111 selectors probed
m1MarketoRSA 1024googleGoogle WorkspaceRSA 1024k1Mailchimp / MailgunRSA 1024zendesk1ZendeskRSA 2048zendesk2ZendeskRSA 2048qualtricsQualtricsRSA 1024mailGenericRSA 1024Identity ·SPF
Worst-case evaluation across every include.
- include:mail.zendesk.com
- include:_spf.google.com
- include:mktomail.com
- include:_spf.salesforce.com
- include:_spf-ip.gitlab.com
- include:mailgun.org
- include:_spf.mailgun.org
- include:_spf1.mailgun.org
- include:_spf2.mailgun.org
- include:_spf.eu.mailgun.org
- include:_spf.sendergen.com
Findings (12)
CriticalSPF exceeds the 10 DNS-lookup limit (13 used)›
Worst-case evaluation of gitlab.com requires 13 DNS lookups, which is 3 over budget. Receivers stop at 10 and return permerror, which means SPF authorises nothing at all -- including your own legitimate mail.
Remove unused include: mechanisms, or replace a costly provider include with the ip4/ip6 ranges it resolves to. The include tree below shows the cost of each branch.
RFC 7208 s4.6.4
MediumCould not verify DKIM signing for Salesforce Marketing Cloud›
Salesforce Marketing Cloud was detected via SPF include:_spf.salesforce.com, so it is authorised to send mail as gitlab.com. We checked the selectors it uses by default (sfmc1, sfmc2, exacttarget) and found no key. Salesforce Marketing Cloud lets you choose your own selector name, so this may simply mean yours is custom. If signing genuinely is not enabled, mail through this service will fail DMARC once forwarded.
Confirm DKIM is switched on in Salesforce Marketing Cloud, then add your selector here so every future scan can verify it directly.
RFC 6376
MediumSelector 'm1' uses a 1024-bit RSA key›
1024-bit is the RFC 8301 floor, not a good target. 2048-bit is the current recommendation and is universally supported.
Rotate to 2048-bit at your next key rotation.
RFC 8301
MediumSelector 'google' uses a 1024-bit RSA key›
1024-bit is the RFC 8301 floor, not a good target. 2048-bit is the current recommendation and is universally supported.
Rotate to 2048-bit at your next key rotation.
RFC 8301
MediumSelector 'k1' uses a 1024-bit RSA key›
1024-bit is the RFC 8301 floor, not a good target. 2048-bit is the current recommendation and is universally supported.
Rotate to 2048-bit at your next key rotation.
RFC 8301
MediumSelector 'qualtrics' uses a 1024-bit RSA key›
1024-bit is the RFC 8301 floor, not a good target. 2048-bit is the current recommendation and is universally supported.
Rotate to 2048-bit at your next key rotation.
RFC 8301
MediumSelector 'mail' uses a 1024-bit RSA key›
1024-bit is the RFC 8301 floor, not a good target. 2048-bit is the current recommendation and is universally supported.
Rotate to 2048-bit at your next key rotation.
RFC 8301
LowNo explicit subdomain policy (sp=)›
Subdomains inherit p=, which is usually what you want. Setting 'sp=reject' explicitly protects unused subdomains even while the parent is still at p=none.
Consider adding 'sp=reject' if no subdomain sends mail.
LowNo MTA-STS policy›
Without MTA-STS, mail to your domain can be downgraded to plaintext by an active network attacker, because SMTP's STARTTLS is opportunistic by default.
Publish a TXT record at _mta-sts.gitlab.com and a policy file at https://mta-sts.gitlab.com/.well-known/mta-sts.txt.
RFC 8461
LowNo TLS-RPT record›
Sending servers have no address to report TLS failures on mail to your domain, so transport problems stay invisible to you until someone complains.
Publish 'v=TLSRPTv1; rua=mailto:<address>' at _smtp._tls.gitlab.com.
RFC 8460
InfoEligible for BIMI›
Your DMARC policy is already enforcing, which is the hard prerequisite for BIMI. Publishing a logo is now largely a branding exercise.
Publish an SVG Tiny PS logo plus a VMC, then add a default._bimi record.
InfoZone is not signed with DNSSEC›
This is the common case and not a misconfiguration -- most working mail domains are unsigned. It is worth knowing because your authentication records are only as trustworthy as the DNS answers carrying them, and because DNSSEC is the prerequisite for DANE.
If your DNS provider supports one-click DNSSEC, enabling it is low risk. If it does not, this is not worth changing providers over.
RFC 4033
Show 12 passing checks
PassAggregate reporting is configured›
Aggregate reports are requested at: [email protected].
PassExternal report destination vali.email is correctly authorised›
Authorised by gitlab.com._report._dmarc.vali.email
PassDMARC policy is p=reject›
Mail failing authentication is rejected outright. This is the correct end state.
PassSPF ends in '-all' (hard fail)›
Unauthorised hosts are explicitly rejected. This is the correct end state.
PassAdobe Marketo's DKIM key is published at m1._domainkey›
Detected via SPF include:mktomail.com. A valid public key for this service is published at m1._domainkey.gitlab.com.
PassGoogle Workspace's DKIM key is published at google._domainkey›
Detected via SPF include:_spf.google.com, MX alt1.aspmx.l.google.com, MX alt2.aspmx.l.google.com, MX alt3.aspmx.l.google.com, MX alt4.aspmx.l.google.com, MX aspmx.l.google.com. A valid public key for this service is published at google._domainkey.gitlab.com.
PassMailgun's DKIM key is published at k1._domainkey›
Detected via SPF include:mailgun.org. A valid public key for this service is published at k1._domainkey.gitlab.com.
PassZendesk's DKIM keys are published at zendesk1._domainkey, zendesk2._domainkey›
Detected via SPF include:mail.zendesk.com. A valid public key for this service is published at zendesk1._domainkey.gitlab.com, zendesk2._domainkey.gitlab.com.
Pass7 DKIM key(s) published›
Found at: google, k1, m1, mail, qualtrics, zendesk1, zendesk2.
PassSelector 'zendesk1' uses a 2048-bit RSA key›
Key length meets current guidance.
PassSelector 'zendesk2' uses a 2048-bit RSA key›
Key length meets current guidance.
PassCertificate issuance is restricted by CAA›
Only amazon.com, amazonaws.com, amazontrust.com, awstrust.com, comodoca.com, digicert.com, globalsign.com, letsencrypt.org, pki.goog, sectigo.com, ssl.com may issue certificates for this domain, so a certificate for your mail hosts or your MTA-STS policy endpoint from any other authority would be a mis-issuance. Wildcard certificates are limited separately, to comodoca.com, digicert.com, letsencrypt.org, pki.goog, ssl.com.
RFC 8659
Transport and zone
Where your mail lands, and whether the DNS carrying your records can be trusted.
This is the configuration. It is not the whole picture.
A DNS scan cannot tell you whether gitlab.com’s mail actually aligns, because alignment is decided per message at the receiver. Collect DMARC aggregate reports to see every source sending as this domain.