Email security report card · 2026-11-07
cloudflare.com
cloudflare.com scores 86/100 (grade B). Legitimate mail proves where it comes from, so Gmail and Outlook trust it. Forged mail “from” cloudflare.com is refused by the big inboxes. The most valuable next step: turn on MTA-STS.
B86/100
| Area | Check | Status | Points |
|---|---|---|---|
| Authentication | SPF and DKIMYes — your mail proves where it comes from. SPF: SPF lists the servers allowed to send as you. DKIM: Your mail carries a signature inboxes can verify (1024-bit, 2048-bit, 1024-bit, 1024-bit). | Pass | 25/25 |
| Anti-spoofing | DMARC enforcementMail that fails your checks is refused. | Pass | 30/30 |
| Delivery | Google, Yahoo and Microsoft sender rulesYes — you meet the published sender requirements. | Pass | 15/15 |
| Encryption | MTA-STSThe _mta-sts record is published, but mta-sts.cloudflare.com doesn’t resolve, so the policy file can’t be fetched and senders ignore MTA-STS. | Missing | 0/8 |
| Encryption | TLS-RPTReports are requested. | Pass | 4/4 |
| DNS hardening | DNSSECYour DNS is signed and validates. | Pass | 8/8 |
| DNS hardening | CAAOnly comodoca.com, digicert.com, letsencrypt.org, pki.goog, ssl.com may issue certificates. | Pass | 4/4 |
| Brand | BIMI logoThe BIMI record is published, but inboxes won’t show the logo: see the problems below. | Missing | 0/6 |
What if you fixed…
Today B 86/100
Fix next
- Turn on MTA-STS
- Turn on BIMI logo
Exact records and where to click: full check for cloudflare.com.
Lookalike exposure
Not scanned this time (scan limit reached). Run the lookalike radar.