Email security report card · 2026-11-07
wsj.com
wsj.com scores 66/100 (grade C). Legitimate mail proves where it comes from, so Gmail and Outlook trust it. Forged mail “from” wsj.com is sent to spam by the big inboxes. The most valuable next step: turn on MTA-STS.
C66/100
| Area | Check | Status | Points |
|---|---|---|---|
| Authentication | SPF and DKIMYes — your mail proves where it comes from. SPF: SPF is managed by a dynamic SPF service, which decides per message; we can’t list its senders from DNS alone. DKIM: Your mail carries a signature inboxes can verify (1024-bit, 2048-bit, 2048-bit, 2048-bit, 2048-bit, 2048-bit). | Pass | 25/25 |
| Anti-spoofing | DMARC enforcementMail that fails your checks goes to spam. | Pass | 26/30 |
| Delivery | Google, Yahoo and Microsoft sender rulesYes — you meet the published sender requirements. | Pass | 15/15 |
| Encryption | MTA-STSWithout it, an attacker on the network path can downgrade delivery to unencrypted. | Missing | 0/8 |
| Encryption | TLS-RPTAdd a TXT record at _smtp._tls.wsj.com: v=TLSRPTv1; rua=mailto:tls-reports@wsj.com | Missing | 0/4 |
| DNS hardening | DNSSECNot signed. Turn on DNSSEC at Amazon Route 53; if the domain is registered elsewhere, add the DS record it gives you at your registrar. | Missing | 0/8 |
| DNS hardening | CAAAny certificate authority may issue certificates for your domain. A CAA record such as 0 issue "letsencrypt.org" limits it to the ones you use. | Missing | 0/4 |
| Brand | BIMI logoYour DMARC already qualifies. Publish an SVG logo at default._bimi.wsj.com; Gmail and Apple also need a mark certificate. | Missing | 0/6 |
What if you fixed…
- Build the DMARC record
- Build the MTA-STS records
- What TLS-RPT needs
- Where to turn it on
- The CAA record
- The BIMI guide
Today C 66/100
Fix next
- Turn on MTA-STS
- Turn on DNSSEC
- Turn on BIMI logo
- Turn on TLS-RPT
Exact records and where to click: full check for wsj.com.
Lookalike exposure
Not scanned this time (scan limit reached). Run the lookalike radar.