Apex, subdomain, or URL. We figure it out.
Results for
allianz.com
Email authentication
The basics are in place but can be hardened.
- 4Pass
- 1Warning
- 0Fail
- 1Not set
SPF
WarningAuthorizes which servers may send mail for the domain
SPF is published but could be tightened.
- Policy
- ~all
- DNS lookups
- 8 / 10
- Ends in ~all (softfail): unauthorized senders are marked, not rejected.
- Uses 8 of 10 allowed DNS lookups. Close to the limit.
v=spf1 include:spf.allianz.com include:_spf.allianz.com include:_spf2.allianz.com include:_spf3.allianz.com ip4:87.106.1.21 ip4:208.86.168.7 ip4:135.84.68.123 ip4:193.240.14.113 ip4:204.93.80.116 ip4:204.93.80.117 ip4:85.236.55.224/27 ~allDKIM
PassCryptographically signs outgoing mail (best-effort selector probe)
DKIM key published for 3 known selectors.
- Selectors
- s1, s2, k1
- Found a DKIM key at s1._domainkey.allianz.com
- Found a DKIM key at s2._domainkey.allianz.com
- Found a DKIM key at k1._domainkey.allianz.com
DMARC
PassTells receivers what to do with mail that fails SPF and DKIM
DMARC is enforced.
- Policy
- p=reject
- Coverage
- 100%
- Policy p=reject: failing mail is rejected outright.
- Aggregate reports (rua) are configured.
v=DMARC1; p=reject; fo=1; ri=3600; rua=mailto:[email protected]; ruf=mailto:[email protected]MTA-STS
PassEnforces TLS for inbound mail and prevents downgrade attacks
MTA-STS is enforcing TLS.
- Mode
- enforce
- Max age
- 604800s
- Policy mode is enforce: TLS is required for inbound mail.
v=STSv1; id=20250728T010000TLS-RPT
PassReceives reports about TLS delivery failures
TLS reporting is configured.
- Reports to
- mailto:[email protected]
- TLS delivery failure reports are being collected.
v=TLSRPTv1;rua=mailto:[email protected]BIMI
Not setDisplays your verified brand logo in supporting inboxes
No BIMI record. No brand logo is published for inboxes.
Checks query live DNS over Cloudflare and the public MTA-STS policy endpoint. DKIM selectors cannot be listed from DNS, so DKIM detection probes common provider selectors only.