Email security report card · 2026-11-07
zalando.com
zalando.com scores 76/100 (grade B). Legitimate mail proves where it comes from, so Gmail and Outlook trust it. Forged mail “from” zalando.com is refused by the big inboxes. 9 lookalike domains can receive email; none registered recently. The most valuable next step: turn on MTA-STS.
B76/100
| Area | Check | Status | Points |
|---|---|---|---|
| Authentication | SPF and DKIMYes — your mail proves where it comes from. SPF: SPF lists the servers allowed to send as you. DKIM: Your mail carries a signature inboxes can verify (2048-bit). | Pass | 25/25 |
| Anti-spoofing | DMARC enforcementMail that fails your checks is refused. | Pass | 30/30 |
| Delivery | Google, Yahoo and Microsoft sender rulesYes — you meet the published sender requirements. | Pass | 15/15 |
| Encryption | MTA-STSWithout it, an attacker on the network path can downgrade delivery to unencrypted. | Missing | 0/8 |
| Encryption | TLS-RPTAdd a TXT record at _smtp._tls.zalando.com: v=TLSRPTv1; rua=mailto:tls-reports@zalando.com | Missing | 0/4 |
| DNS hardening | DNSSECNot signed. Turn on DNSSEC at Amazon Route 53; if the domain is registered elsewhere, add the DS record it gives you at your registrar. | Missing | 0/8 |
| DNS hardening | CAAAny certificate authority may issue certificates for your domain. A CAA record such as 0 issue "letsencrypt.org" limits it to the ones you use. | Missing | 0/4 |
| Brand | BIMI logoLogo and VMC published (issued by DigiCert, Inc., valid until 2027-02-12). Gmail, Apple Mail and Yahoo can show it. | Pass | 6/6 |
What if you fixed…
Today B 76/100
Fix next
- Turn on MTA-STS
- Turn on DNSSEC
- Turn on TLS-RPT
- Turn on CAA
Exact records and where to click: full check for zalando.com.
Lookalike exposure
42 registered lookalikes, 9 able to receive email. Not graded: you can’t control who registers them.