• Info: Only one MX host

  All mail for autodesk.com goes to autodesk-com.mail.protection.outlook.com. Most hosted providers make that one name highly available; if you run your own server, consider a backup MX.

• Info: SPF ends in softfail (~all)

  "~all" is common and works well with DMARC. "-all" is stricter; switch when you are sure every sender is listed.

• Warning: DKIM key shorter than 2048 bits

  k1 (1024-bit), s2 (1024-bit) uses an RSA key below 2048 bits. Short keys can be factored and some receivers treat them as weak. Rotate to a 2048-bit key at your sending provider.

• Pass: DKIM key published

  autodesk.com publishes a DKIM key under selector1, selector2, k1, k2, k3, s1, s2.

• Info: DMARC policy is quarantine; consider reject

  Failing mail goes to spam rather than being refused. When reports show no legitimate failures, reject gives the strongest protection.

  How to fix this

• Info: SPF alignment is unknown

  The SPF record of autodesk.com authorizes no sender (no +ip4, +ip6, +a, +mx, +exists or +ptr term, include of a record that has one, or +all before all), so SPF never passes and cannot align. That is correct for a domain that sends no mail; otherwise DMARC depends on DKIM alone.

Nothing to report.

• Info: MTA-STS is in testing mode

  Senders report TLS failures (with TLS-RPT) but still deliver. Switch to mode: enforce once the reports are clean.

• Pass: TLS-RPT is configured

  TLS reports will be sent to mailto:tls-report@vali.email.