Email security report card · 2026-11-07
wellsfargo.com
wellsfargo.com scores 68/100 (grade C). SPF passes; DKIM signing couldn’t be verified from public DNS alone. Forged mail “from” wellsfargo.com is refused by the big inboxes. The most valuable next step: confirm your DKIM selector.
C68/100
| Area | Check | Status | Points |
|---|---|---|---|
| Authentication | SPF and DKIMSPF passes; DKIM is unverified. SPF: SPF is managed by a dynamic SPF service, which decides per message; we can’t list its senders from DNS alone. DKIM: DKIM wasn’t found under common selector names; with DMARC enforced it very likely exists under a private one. Enter the selector to verify it. | Partly | 20/25 |
| Anti-spoofing | DMARC enforcementMail that fails your checks is refused. | Pass | 30/30 |
| Delivery | Google, Yahoo and Microsoft sender rulesMet if your DKIM signing (not found under common names) is in place. | Partly | 12/15 |
| Encryption | MTA-STSWithout it, an attacker on the network path can downgrade delivery to unencrypted. | Missing | 0/8 |
| Encryption | TLS-RPTAdd a TXT record at _smtp._tls.wellsfargo.com: v=TLSRPTv1; rua=mailto:tls-reports@wellsfargo.com | Missing | 0/4 |
| DNS hardening | DNSSECNot signed. Turn on DNSSEC where your DNS is hosted; if the domain is registered elsewhere, add the DS record it gives you at your registrar. | Missing | 0/8 |
| DNS hardening | CAAAny certificate authority may issue certificates for your domain. A CAA record such as 0 issue "letsencrypt.org" limits it to the ones you use. | Missing | 0/4 |
| Brand | BIMI logoLogo and VMC published (issued by DigiCert, Inc., valid until 2027-08-25). Gmail, Apple Mail and Yahoo can show it. | Pass | 6/6 |
What if you fixed…
- The fix plan
- The fix plan
- Build the MTA-STS records
- What TLS-RPT needs
- Where to turn it on
- The CAA record
Today C 68/100
Fix next
- Confirm your DKIM selector
- Turn on MTA-STS
- Turn on DNSSEC
- Turn on TLS-RPT
Exact records and where to click: full check for wellsfargo.com.
Lookalike exposure
Not scanned this time (scan limit reached). Run the lookalike radar.