Email security report card · 2026-11-07
apple.com
apple.com scores 76/100 (grade B). Legitimate mail proves where it comes from, so Gmail and Outlook trust it. Forged mail “from” apple.com is sent to spam by the big inboxes. The most valuable next step: turn on MTA-STS.
B76/100
| Area | Check | Status | Points |
|---|---|---|---|
| Authentication | SPF and DKIMYes — your mail proves where it comes from. SPF: SPF lists the servers allowed to send as you. DKIM: Your mail carries a signature inboxes can verify (1024-bit, 1024-bit). 1024-bit keys still work, but 2048 bits is the current recommendation — rotate when you next touch DKIM. | Pass | 25/25 |
| Anti-spoofing | DMARC enforcementMail that fails your checks goes to spam. | Pass | 26/30 |
| Delivery | Google, Yahoo and Microsoft sender rulesYes — you meet the published sender requirements. | Pass | 15/15 |
| Encryption | MTA-STSWithout it, an attacker on the network path can downgrade delivery to unencrypted. | Missing | 0/8 |
| Encryption | TLS-RPTAdd a TXT record at _smtp._tls.apple.com: v=TLSRPTv1; rua=mailto:tls-reports@apple.com | Missing | 0/4 |
| DNS hardening | DNSSECNot signed. Turn on DNSSEC where your DNS is hosted; if the domain is registered elsewhere, add the DS record it gives you at your registrar. | Missing | 0/8 |
| DNS hardening | CAAOnly pki.apple.com may issue certificates. | Pass | 4/4 |
| Brand | BIMI logoLogo and VMC published (issued by DigiCert, Inc., valid until 2027-04-11). Gmail, Apple Mail and Yahoo can show it. | Pass | 6/6 |
What if you fixed…
Today B 76/100
Fix next
- Turn on MTA-STS
- Turn on DNSSEC
- Turn on TLS-RPT
Exact records and where to click: full check for apple.com.
Lookalike exposure
Not scanned this time (scan limit reached). Run the lookalike radar.