Email security report card · 2026-11-07
etsy.com
etsy.com scores 42/100 (grade D). Legitimate mail can’t fully prove where it comes from, so some of it is likely to land in spam. Forged mail “from” etsy.com is refused by the big inboxes. The most valuable next step: correct your SPF record.
D42/100
| Area | Check | Status | Points |
|---|---|---|---|
| Authentication | SPF and DKIMPartly. One of the two proofs is missing or weak. SPF: The SPF record needs 11 lookups; the limit is 10, so checks fail. DKIM: Your mail carries a signature inboxes can verify (1024-bit, 1024-bit, 2048-bit, 1024-bit, 1024-bit). | Partly | 12/25 |
| Anti-spoofing | DMARC enforcementMail that fails your checks is refused. | Pass | 30/30 |
| Delivery | Google, Yahoo and Microsoft sender rulesNot yet. High-volume mail needs SPF, DKIM and DMARC together. | Missing | 0/15 |
| Encryption | MTA-STSWithout it, an attacker on the network path can downgrade delivery to unencrypted. | Missing | 0/8 |
| Encryption | TLS-RPTAdd a TXT record at _smtp._tls.etsy.com: v=TLSRPTv1; rua=mailto:tls-reports@etsy.com | Missing | 0/4 |
| DNS hardening | DNSSECNot signed. Turn on DNSSEC at Amazon Route 53; if the domain is registered elsewhere, add the DS record it gives you at your registrar. | Missing | 0/8 |
| DNS hardening | CAAAny certificate authority may issue certificates for your domain. A CAA record such as 0 issue "letsencrypt.org" limits it to the ones you use. | Missing | 0/4 |
| Brand | BIMI logoYour DMARC already qualifies. Publish an SVG logo at default._bimi.etsy.com; Gmail and Apple also need a mark certificate. | Missing | 0/6 |
What if you fixed…
- The fix plan
- The fix plan
- Build the MTA-STS records
- What TLS-RPT needs
- Where to turn it on
- The CAA record
- The BIMI guide
Today D 42/100
Fix next
- Correct your SPF record
- Turn on MTA-STS
- Turn on DNSSEC
- Turn on BIMI logo
Exact records and where to click: full check for etsy.com.
Lookalike exposure
Not scanned this time (scan limit reached). Run the lookalike radar.