sap.com
Receivers are told to reject mail that fails authentication for this domain.
Receivers are told to reject mail that fails authentication for this domain. Keep watching aggregate reports so a new sending service does not silently start failing.
Score held up: DMARC is enforcing at p=reject, so nobody else can send as this domain. That is the hard part, and it is done. What is left below is about your own mail arriving, not about anyone spoofing you.
130 DNS queries · 671 ms
- 1No CAA recordPublish a CAA record naming your certificate authority, for example: 0 issue "letsencrypt.org"
- 2No explicit subdomain policy (sp=)Consider adding 'sp=reject' if no subdomain sends mail.
- 3No MTA-STS policyPublish a TXT record at _mta-sts.sap.com and a policy file at https://mta-sts.sap.com/.well-known/mta-sts.txt.
- 4Strict SPF alignment is enabled (aspf=s)Use aspf=r (relaxed) unless you have a specific reason not to.
Identity ·Sending services detected
Read from your SPF includes and MX hosts, then checked for a published DKIM key.
Identity ·DMARC
- Policy
- reject
- Coverage
- 100%
- Alignment
- dkim=s spf=s
Identity ·DKIM
111 selectors probed
selector1Microsoft 365RSA 2048selector2Microsoft 365RSA 2048Identity ·SPF
Worst-case evaluation across every include.
- include:_spf.sap.com
- include:spf.protection.outlook.com
Findings (6)
LowNo explicit subdomain policy (sp=)›
Subdomains inherit p=, which is usually what you want. Setting 'sp=reject' explicitly protects unused subdomains even while the parent is still at p=none.
Consider adding 'sp=reject' if no subdomain sends mail.
LowNo MTA-STS policy›
Without MTA-STS, mail to your domain can be downgraded to plaintext by an active network attacker, because SMTP's STARTTLS is opportunistic by default.
Publish a TXT record at _mta-sts.sap.com and a policy file at https://mta-sts.sap.com/.well-known/mta-sts.txt.
RFC 8461
LowNo CAA record›
Any certificate authority in the world may issue a certificate for this domain. A mis-issued certificate can be used to intercept mail on the wire and to impersonate your domain over HTTPS.
Publish a CAA record naming your certificate authority, for example: 0 issue "letsencrypt.org"
RFC 8659
LowStrict SPF alignment is enabled (aspf=s)›
With aspf=s, the envelope sender domain must match the From domain exactly. Subdomain bounce addresses, which most ESPs use by default, will fail alignment.
Use aspf=r (relaxed) unless you have a specific reason not to.
InfoEligible for BIMI›
Your DMARC policy is already enforcing, which is the hard prerequisite for BIMI. Publishing a logo is now largely a branding exercise.
Publish an SVG Tiny PS logo plus a VMC, then add a default._bimi record.
InfoZone is not signed with DNSSEC›
This is the common case and not a misconfiguration -- most working mail domains are unsigned. It is worth knowing because your authentication records are only as trustworthy as the DNS answers carrying them, and because DNSSEC is the prerequisite for DANE.
If your DNS provider supports one-click DNSSEC, enabling it is low risk. If it does not, this is not worth changing providers over.
RFC 4033
Show 8 passing checks
PassAggregate reporting is configured›
Aggregate reports are requested at: [email protected].
PassDMARC policy is p=reject›
Mail failing authentication is rejected outright. This is the correct end state.
PassSPF lookup count is healthy (2/10)›
Worst-case evaluation stays within the limit with headroom to spare.
PassMicrosoft 365's DKIM keys are published at selector1._domainkey, selector2._domainkey›
Detected via SPF include:spf.protection.outlook.com, MX sap-com.mail.protection.outlook.com. A valid public key for this service is published at selector1._domainkey.sap.com, selector2._domainkey.sap.com.
Pass2 DKIM key(s) published›
Found at: selector1, selector2.
PassSelector 'selector1' uses a 2048-bit RSA key›
Key length meets current guidance.
PassSelector 'selector2' uses a 2048-bit RSA key›
Key length meets current guidance.
PassTLS reporting is configured›
A TLS-RPT record at _smtp._tls.sap.com asks sending servers that support TLS reporting to send reports on failed TLS connections to mailto:[email protected].
Transport and zone
Where your mail lands, and whether the DNS carrying your records can be trusted.
This is the configuration. It is not the whole picture.
A DNS scan cannot tell you whether sap.com’s mail actually aligns, because alignment is decided per message at the receiver. Collect DMARC aggregate reports to see every source sending as this domain.