usi.ch

Email authentication

Email authentication is well configured.

4Pass
0Warning
0Fail
2Not set

SPF

Pass

Authorizes which servers may send mail for the domain

SPF is published and within limits.

Policy: -all
DNS lookups: 6 / 10

Ends in -all (hardfail): unauthorized senders are rejected.
Uses 6 of 10 allowed DNS lookups.

v=spf1 ip4:195.176.176.141 ip4:195.176.176.153 ip4:195.176.176.170 ip4:195.176.176.171 ip4:195.176.178.11 include:spf.protection.outlook.com include:servers.mcsv.net include:_spf.qualtrics.com include:spf-eu.exlibrisgroup.com include:hubspotemail.net include:_spf.xurrent.com ip4:94.23.120.168 ip4:195.176.55.19 ip4:195.176.55.54 ip4:195.176.55.57 ip4:195.176.55.106 -all

DKIM

Pass

Cryptographically signs outgoing mail (best-effort selector probe)

DKIM key published for 2 known selectors.

Selectors: selector1, k1

Found a DKIM key at selector1._domainkey.usi.ch
Found a DKIM key at k1._domainkey.usi.ch

DMARC

Pass

Tells receivers what to do with mail that fails SPF and DKIM

DMARC is enforced.

Policy: p=quarantine
Subdomains: sp=quarantine
Coverage: 100%

Policy p=quarantine: failing mail is sent to spam.
Aggregate reports (rua) are configured.

v=DMARC1; p=quarantine; sp=quarantine; rua=mailto:[email protected]; ruf=mailto:[email protected]; adkim=r; aspf=r; fo=1; rf=afrf; ri=86400

MTA-STS

Not set

Enforces TLS for inbound mail and prevents downgrade attacks

No MTA-STS policy. Inbound mail can be delivered without TLS.

TLS-RPT

Not set

Receives reports about TLS delivery failures

No TLS-RPT record. You get no reports about failed TLS delivery.

BIMI

Pass

Displays your verified brand logo in supporting inboxes

BIMI is published.

Logo: https://dnsrec.usi.ch/bimi-usi.svg
VMC: https://dnsrec.usi.ch/bimi-usi.pem

A logo (l=) is published.
A Verified Mark Certificate (a=) is referenced.

v=BIMI1; l=https://dnsrec.usi.ch/bimi-usi.svg; a=https://dnsrec.usi.ch/bimi-usi.pem; avp=brand;

Checks query live DNS over Cloudflare and the public MTA-STS policy endpoint. DKIM selectors cannot be listed from DNS, so DKIM detection probes common provider selectors only.