intel.com
Receivers are asked to report on mail claiming to be this domain, and told to deliver it whether or not it authenticates.
Aggregate reports are requested, so receivers that send them will show you who is sending as your domain -- but receivers are told to deliver mail that fails authentication. This is the right place to start and the wrong place to stop.
Score capped: DMARC is at p=none, which monitors but does not protect.
129 DNS queries · 6116 ms
- 1No DKIM key found at 111 selectorsAdd your selectors manually -- your provider's DNS setup page names them. Connecting aggregate reports is better still: they name the exact selector used by every source that signs mail as you.
- 2No CAA recordPublish a CAA record naming your certificate authority, for example: 0 issue "letsencrypt.org"
- 3No MTA-STS policyPublish a TXT record at _mta-sts.intel.com and a policy file at https://mta-sts.intel.com/.well-known/mta-sts.txt.
- 4No TLS-RPT recordPublish 'v=TLSRPTv1; rua=mailto:<address>' at _smtp._tls.intel.com.
Identity ·DMARC
- Policy
- none
- Coverage
- 100%
- Alignment
- dkim=r spf=r
Identity ·DKIM
111 selectors probed
No key at the 111 selectors we tried. Selectors cannot be listed from DNS, so this is not proof DKIM is missing.
Identity ·SPF
Worst-case evaluation across every include.
- include:_spf.intel.com
- include:_spf1.intel.com
- include:_spf2.intel.com
Findings (6)
HighDMARC policy is p=none (monitoring only)›
Receivers are told to take no action on mail that fails authentication, so mail forging this domain is still delivered. p=none is for observing, not protecting.
Use your aggregate reports to confirm every legitimate sender aligns, then move to p=quarantine, then p=reject.
RFC 7489 s6.3
LowNo DKIM key found at 111 selectors›
Selectors cannot be enumerated from DNS, and we could not fingerprint a known sending service from your SPF or MX records, so we had only a generic wordlist to go on. This is not proof that DKIM is missing. A deep scan additionally tries long-tail and date-stamped selector names.
Add your selectors manually -- your provider's DNS setup page names them. Connecting aggregate reports is better still: they name the exact selector used by every source that signs mail as you.
RFC 6376 s3.6.2.1
LowNo MTA-STS policy›
Without MTA-STS, mail to your domain can be downgraded to plaintext by an active network attacker, because SMTP's STARTTLS is opportunistic by default.
Publish a TXT record at _mta-sts.intel.com and a policy file at https://mta-sts.intel.com/.well-known/mta-sts.txt.
RFC 8461
LowNo TLS-RPT record›
Sending servers have no address to report TLS failures on mail to your domain, so transport problems stay invisible to you until someone complains.
Publish 'v=TLSRPTv1; rua=mailto:<address>' at _smtp._tls.intel.com.
RFC 8460
LowNo CAA record›
Any certificate authority in the world may issue a certificate for this domain. A mis-issued certificate can be used to intercept mail on the wire and to impersonate your domain over HTTPS.
Publish a CAA record naming your certificate authority, for example: 0 issue "letsencrypt.org"
RFC 8659
InfoZone is not signed with DNSSEC›
This is the common case and not a misconfiguration -- most working mail domains are unsigned. It is worth knowing because your authentication records are only as trustworthy as the DNS answers carrying them, and because DNSSEC is the prerequisite for DANE.
If your DNS provider supports one-click DNSSEC, enabling it is low risk. If it does not, this is not worth changing providers over.
RFC 4033
Show 3 passing checks
PassAggregate reporting is configured›
Aggregate reports are requested at: [email protected].
PassSPF lookup count is healthy (3/10)›
Worst-case evaluation stays within the limit with headroom to spare.
PassSPF ends in '-all' (hard fail)›
Unauthorised hosts are explicitly rejected. This is the correct end state.
Transport and zone
Where your mail lands, and whether the DNS carrying your records can be trusted.
This is the configuration. It is not the whole picture.
A DNS scan cannot tell you whether intel.com’s mail actually aligns, because alignment is decided per message at the receiver. Collect DMARC aggregate reports to see every source sending as this domain.