B80/100

wipro.com

Receivers are told to send to spam mail that fails authentication for this domain.

Partial enforcement

Forged mail is being filtered to spam rather than rejected, or the policy applies to only a share of messages. Most of the protection is there; the last step is not.

Score held up: DMARC is enforcing at p=quarantine, so nobody else can send as this domain. That is the hard part, and it is done. What is left below is about your own mail arriving, not about anyone spoofing you.

134 DNS queries · 2926 ms

Fix these first

1
Could not verify DKIM signing for Adobe Marketo
Confirm DKIM is switched on in Adobe Marketo, then add your selector here so every future scan can verify it directly.
2
Could not verify DKIM signing for Salesforce Marketing Cloud
Confirm DKIM is switched on in Salesforce Marketing Cloud, then add your selector here so every future scan can verify it directly.
3
Could not verify DKIM signing for Salesforce Pardot
Confirm DKIM is switched on in Salesforce Pardot, then add your selector here so every future scan can verify it directly.
4
SPF is close to the lookup limit (9/10)
Trim unused senders now, before a provider's change pushes you over.

Identity ·Sending services detected

Read from your SPF includes and MX hosts, then checked for a published DKIM key.

Adobe MarketoSPF include:mktomail.comno DKIM key at its selectors

Google WorkspaceSPF include:_netblocks.google.com · SPF include:_netblocks2.google.com · SPF include:_netblocks3.google.comkey published · google

Microsoft 365SPF include:spf.protection.outlook.com · MX wipro-com.mail.protection.outlook.comkey published · selector1, selector2

Salesforce Marketing CloudSPF include:_spf.salesforce.comno DKIM key at its selectors

Salesforce PardotSPF include:et._spf.pardot.comno DKIM key at its selectors

Identity ·DMARC

v=DMARC1; p=quarantine; fo=1; pct=100; ri=3600; rua=mailto:[email protected];ruf=mailto:[email protected]

Policy: quarantine
Coverage: 100%
Alignment: dkim=r spf=r

Identity ·DKIM

111 selectors probed

googleGoogle WorkspaceRSA 2048

selector1Microsoft 365RSA 2048

selector2Microsoft 365RSA 2048

mte1Mailchimp TransactionalRSA 2048

mte2Mailchimp TransactionalRSA 2048

Identity ·SPF

Worst-case evaluation across every include.

v=spf1 include:spf.protection.outlook.com include:et._spf.pardot.com include:_netblocks.google.com include:_netblocks2.google.com include:_netblocks3.google.com include:mktomail.com include:_spf.salesforce.com include:spf-eu.csodmail.com -all

DNS lookup budget9 / 10

include:spf.protection.outlook.com
include:et._spf.pardot.com
include:_netblocks.google.com
include:_netblocks2.google.com
include:_netblocks3.google.com
include:mktomail.com
include:_spf.salesforce.com
include:spf-eu.csodmail.com

Findings (11)

MediumDMARC policy is p=quarantine›

Failing mail is delivered to spam rather than rejected. A meaningful improvement over none, but spoofed mail still reaches the recipient's mailbox.

What to do

Move to p=reject once reports show no legitimate mail failing.

MediumSPF is close to the lookup limit (9/10)›

You have little headroom. Providers change their own include trees without notice, so a record at 8 or 9 lookups can break without you touching it.

What to do

Trim unused senders now, before a provider's change pushes you over.

RFC 7208 s4.6.4

MediumCould not verify DKIM signing for Adobe Marketo›

Adobe Marketo was detected via SPF include:mktomail.com, so it is authorised to send mail as wipro.com. We checked the selectors it uses by default (m1, mktomail) and found no key. Adobe Marketo lets you choose your own selector name, so this may simply mean yours is custom. If signing genuinely is not enabled, mail through this service will fail DMARC once forwarded.

What to do

Confirm DKIM is switched on in Adobe Marketo, then add your selector here so every future scan can verify it directly.

RFC 6376

MediumCould not verify DKIM signing for Salesforce Marketing Cloud›

Salesforce Marketing Cloud was detected via SPF include:_spf.salesforce.com, so it is authorised to send mail as wipro.com. We checked the selectors it uses by default (sfmc1, sfmc2, exacttarget) and found no key. Salesforce Marketing Cloud lets you choose your own selector name, so this may simply mean yours is custom. If signing genuinely is not enabled, mail through this service will fail DMARC once forwarded.

What to do

Confirm DKIM is switched on in Salesforce Marketing Cloud, then add your selector here so every future scan can verify it directly.

RFC 6376

MediumCould not verify DKIM signing for Salesforce Pardot›

Salesforce Pardot was detected via SPF include:et._spf.pardot.com, so it is authorised to send mail as wipro.com. We checked the selectors it uses by default (pardot) and found no key. Salesforce Pardot lets you choose your own selector name, so this may simply mean yours is custom. If signing genuinely is not enabled, mail through this service will fail DMARC once forwarded.

What to do

Confirm DKIM is switched on in Salesforce Pardot, then add your selector here so every future scan can verify it directly.

RFC 6376

LowNo explicit subdomain policy (sp=)›

Subdomains inherit p=, which is usually what you want. Setting 'sp=reject' explicitly protects unused subdomains even while the parent is still at p=none.

What to do

Consider adding 'sp=reject' if no subdomain sends mail.

LowNo MTA-STS policy›

Without MTA-STS, mail to your domain can be downgraded to plaintext by an active network attacker, because SMTP's STARTTLS is opportunistic by default.

What to do

Publish a TXT record at _mta-sts.wipro.com and a policy file at https://mta-sts.wipro.com/.well-known/mta-sts.txt.

RFC 8461

LowNo TLS-RPT record›

Sending servers have no address to report TLS failures on mail to your domain, so transport problems stay invisible to you until someone complains.

What to do

Publish 'v=TLSRPTv1; rua=mailto:<address>' at _smtp._tls.wipro.com.

RFC 8460

LowNo CAA record›

Any certificate authority in the world may issue a certificate for this domain. A mis-issued certificate can be used to intercept mail on the wire and to impersonate your domain over HTTPS.

What to do

Publish a CAA record naming your certificate authority, for example: 0 issue "letsencrypt.org"

RFC 8659

InfoEligible for BIMI›

Your DMARC policy is already enforcing, which is the hard prerequisite for BIMI. Publishing a logo is now largely a branding exercise.

What to do

Publish an SVG Tiny PS logo plus a VMC, then add a default._bimi record.

InfoEligible for DANE›

Your zone is signed, which is the hard prerequisite for DANE. Publishing TLSA records for your MX hosts would let sending servers pin your certificates without relying on the public CA system.

What to do

Publish a TLSA record at _25._tcp.<each MX host> matching your MX certificate.

RFC 7672

Show 11 passing checks

PassAggregate reporting is configured›

Aggregate reports are requested at: [email protected].

PassSPF ends in '-all' (hard fail)›

Unauthorised hosts are explicitly rejected. This is the correct end state.

PassGoogle Workspace's DKIM key is published at google._domainkey›

Detected via SPF include:_netblocks.google.com, SPF include:_netblocks2.google.com, SPF include:_netblocks3.google.com. A valid public key for this service is published at google._domainkey.wipro.com.

PassMicrosoft 365's DKIM keys are published at selector1._domainkey, selector2._domainkey›

Detected via SPF include:spf.protection.outlook.com, MX wipro-com.mail.protection.outlook.com. A valid public key for this service is published at selector1._domainkey.wipro.com, selector2._domainkey.wipro.com.

Pass5 DKIM key(s) published›

Found at: google, mte1, mte2, selector1, selector2.

PassSelector 'google' uses a 2048-bit RSA key›