Email security report card · 2026-11-07
santander.com
santander.com scores 59/100 (grade D). SPF passes; DKIM signing couldn’t be verified from public DNS alone. Forged mail “from” santander.com is refused by the big inboxes. The most valuable next step: authorize gsnetcloud.com to receive your DMARC reports.
D59/100
| Area | Check | Status | Points |
|---|---|---|---|
| Authentication | SPF and DKIMSPF passes; DKIM is unverified. SPF: SPF is managed by a dynamic SPF service, which decides per message; we can’t list its senders from DNS alone. DKIM: DKIM wasn’t found under common selector names; with DMARC enforced it very likely exists under a private one. Enter the selector to verify it. | Partly | 20/25 |
| Anti-spoofing | DMARC enforcementMail that fails your checks is refused. Reports to postmanagerdmarc@gsnetcloud.com are probably never sent: gsnetcloud.com hasn’t published the record that authorizes receiving reports for santander.com. | Partly | 27/30 |
| Delivery | Google, Yahoo and Microsoft sender rulesMet if your DKIM signing (not found under common names) is in place. | Partly | 12/15 |
| Encryption | MTA-STSWithout it, an attacker on the network path can downgrade delivery to unencrypted. | Missing | 0/8 |
| Encryption | TLS-RPTAdd a TXT record at _smtp._tls.santander.com: v=TLSRPTv1; rua=mailto:tls-reports@santander.com | Missing | 0/4 |
| DNS hardening | DNSSECNot signed. Turn on DNSSEC where your DNS is hosted; if the domain is registered elsewhere, add the DS record it gives you at your registrar. | Missing | 0/8 |
| DNS hardening | CAAAny certificate authority may issue certificates for your domain. A CAA record such as 0 issue "letsencrypt.org" limits it to the ones you use. | Missing | 0/4 |
| Brand | BIMI logoYour DMARC already qualifies. Publish an SVG logo at default._bimi.santander.com; Gmail and Apple also need a mark certificate. | Missing | 0/6 |
What if you fixed…
- The fix plan
- Build the DMARC record
- The fix plan
- Build the MTA-STS records
- What TLS-RPT needs
- Where to turn it on
- The CAA record
- The BIMI guide
Today D 59/100
Fix next
- Authorize gsnetcloud.com to receive your DMARC reports
- Confirm your DKIM selector
- Turn on MTA-STS
- Turn on DNSSEC
Exact records and where to click: full check for santander.com.
Lookalike exposure
Not scanned this time (scan limit reached). Run the lookalike radar.