Email security report card · 2026-11-07
microsoft.com
microsoft.com scores 82/100 (grade B). Legitimate mail proves where it comes from, so Gmail and Outlook trust it. Forged mail “from” microsoft.com is refused by the big inboxes. 11 lookalike domains can receive email; none registered recently. The most valuable next step: turn on DNSSEC.
B82/100
| Area | Check | Status | Points |
|---|---|---|---|
| Authentication | SPF and DKIMYes — your mail proves where it comes from. SPF: SPF lists the servers allowed to send as you. DKIM: Your mail carries a signature inboxes can verify (1024-bit, 1024-bit). 1024-bit keys still work, but 2048 bits is the current recommendation — rotate when you next touch DKIM. | Pass | 25/25 |
| Anti-spoofing | DMARC enforcementMail that fails your checks is refused. | Pass | 30/30 |
| Delivery | Google, Yahoo and Microsoft sender rulesYes — you meet the published sender requirements. | Pass | 15/15 |
| Encryption | MTA-STSEnforced: senders must use verified TLS to *.mail.protection.outlook.com. | Pass | 8/8 |
| Encryption | TLS-RPTReports are requested. | Pass | 4/4 |
| DNS hardening | DNSSECNot signed. Turn on DNSSEC where your DNS is hosted; if the domain is registered elsewhere, add the DS record it gives you at your registrar. | Missing | 0/8 |
| DNS hardening | CAAAny certificate authority may issue certificates for your domain. A CAA record such as 0 issue "letsencrypt.org" limits it to the ones you use. | Missing | 0/4 |
| Brand | BIMI logoYour DMARC already qualifies. Publish an SVG logo at default._bimi.microsoft.com; Gmail and Apple also need a mark certificate. | Missing | 0/6 |
What if you fixed…
Today B 82/100
Fix next
- Turn on DNSSEC
- Turn on BIMI logo
- Turn on CAA
Exact records and where to click: full check for microsoft.com.
Lookalike exposure
56 registered lookalikes, 11 able to receive email. Not graded: you can’t control who registers them.