Security audit
Email authentication records
Audit id: security.email_authentication.
Checks
- Sender record missing or duplicated
- Sender record allows too many senders
- Sender record needs too many lookups
- No policy for failed email checks
- Failed emails are not blocked or quarantined
- Email signing keys found
- Email servers must use secure connections
- Email signing key is too short
- Email policy applies to only some messages
- Secure email policy in test mode or invalid
- Secure email policy omits a mail server
- No reports on secure email delivery problems
Findings
- A DKIM key is 1024 bits or shorter
- DMARC is missing or not enforced; DKIM and MTA-STS were not found
- The DMARC policy applies to only part of the failing mail
- The MTA-STS policy is in testing mode, broken, misses a mail host, or has no TLS reporting
- The SPF record is missing, duplicated, too permissive or too long