infosys.com
Receivers are told to reject mail that fails authentication for this domain.
Receivers are told to reject mail that fails authentication for this domain. Keep watching aggregate reports so a new sending service does not silently start failing.
131 DNS queries · 849 ms
- 1No MTA-STS policyPublish a TXT record at _mta-sts.infosys.com and a policy file at https://mta-sts.infosys.com/.well-known/mta-sts.txt.
- 2No TLS-RPT recordPublish 'v=TLSRPTv1; rua=mailto:<address>' at _smtp._tls.infosys.com.
Identity ·DMARC
- Policy
- reject
- Coverage
- 100%
- Alignment
- dkim=r spf=r
Identity ·DKIM
111 selectors probed
defaultDefault (OpenDKIM / cPanel / Plesk)RSA 2048Identity ·SPF
Worst-case evaluation across every include.
- include:_spf-a.infosys.com
- include:ipreomail.com
- include:spf.tmes.trendmicro.com
- include:spfb.tmes.trendmicro.com
- include:spfc.tmes.trendmicro.com
Findings (4)
LowNo MTA-STS policy›
Without MTA-STS, mail to your domain can be downgraded to plaintext by an active network attacker, because SMTP's STARTTLS is opportunistic by default.
Publish a TXT record at _mta-sts.infosys.com and a policy file at https://mta-sts.infosys.com/.well-known/mta-sts.txt.
RFC 8461
LowNo TLS-RPT record›
Sending servers have no address to report TLS failures on mail to your domain, so transport problems stay invisible to you until someone complains.
Publish 'v=TLSRPTv1; rua=mailto:<address>' at _smtp._tls.infosys.com.
RFC 8460
InfoEligible for BIMI›
Your DMARC policy is already enforcing, which is the hard prerequisite for BIMI. Publishing a logo is now largely a branding exercise.
Publish an SVG Tiny PS logo plus a VMC, then add a default._bimi record.
InfoEligible for DANE›
Your zone is signed, which is the hard prerequisite for DANE. Publishing TLSA records for your MX hosts would let sending servers pin your certificates without relying on the public CA system.
Publish a TLSA record at _25._tcp.<each MX host> matching your MX certificate.
RFC 7672
Show 8 passing checks
PassAggregate reporting is configured›
Aggregate reports are requested at: [email protected].
PassDMARC policy is p=reject›
Mail failing authentication is rejected outright. This is the correct end state.
PassSPF lookup count is healthy (5/10)›
Worst-case evaluation stays within the limit with headroom to spare.
PassSPF ends in '-all' (hard fail)›
Unauthorised hosts are explicitly rejected. This is the correct end state.
Pass1 DKIM key(s) published›
Found at: default.
PassSelector 'default' uses a 2048-bit RSA key›
Key length meets current guidance.
PassZone is signed and validates›
A validating resolver reported this zone's answers as authenticated. Resolvers that validate DNSSEC reject a tampered answer for your SPF, DKIM and DMARC records rather than pass it on. This also makes DANE available to you.
PassCertificate issuance is restricted by CAA›
Only amazon.com, digicert.com, emsign.com may issue certificates for this domain, so a certificate for your mail hosts or your MTA-STS policy endpoint from any other authority would be a mis-issuance. Wildcard certificates are limited separately, to amazon.com, digicert.com, emsign.com.
RFC 8659
Transport and zone
Where your mail lands, and whether the DNS carrying your records can be trusted.
This is the configuration. It is not the whole picture.
A DNS scan cannot tell you whether infosys.com’s mail actually aligns, because alignment is decided per message at the receiver. Collect DMARC aggregate reports to see every source sending as this domain.