ddnss.de

ddnss.de · Last checked 2026-10-04 02:17 UTC

ddnss.de

Needs work, with 2 things to fix

ddnss.de scored 62/100 (grade C). The main issues are no DMARC record and DKIM key shorter than 2048 bits.

Checked 2026-10-04 02:17 UTC · fresh check

2 passed1 needs attention1 failing4 for information
Fix this firstThe change with the biggest effect

Publish a DMARC record

Starts DMARC in monitoring mode (p=none), so you can see who sends as ddnss.de before enforcing a policy. Move to quarantine once the reports show only your own services.

TypeTXT
Name / Host
_dmarc.ddnss.de

Some DNS providers want just “_dmarc” here.

Value
v=DMARC1; p=none; adkim=r; aspf=r

How to apply it

  1. Sign in where your domain’s DNS is managed. This is often where you bought the domain, such as Cloudflare, GoDaddy or Namecheap.
  2. Add a new TXT record with the name and value above.
  3. Save, then come back and re-check. DNS changes can take up to a few hours to show.

All checks

MXCan servers find your inbox?Only one MX hostInfo
  • Info: Only one MX host

    All mail for ddnss.de goes to mail.mc-p.de. Most hosted providers make that one name highly available; if you run your own server, consider a backup MX.

SPFWho may send as you?No issues foundPass

Nothing to report.

DKIMAre your emails signed?DKIM key shorter than 2048 bitsNeeds attention
  • Warning: DKIM key shorter than 2048 bits

    default (1024-bit) uses an RSA key below 2048 bits. Short keys can be factored and some receivers treat them as weak. Rotate to a 2048-bit key at your sending provider.

  • Pass: DKIM key published

    ddnss.de publishes a DKIM key under default.

DMARCWhat happens to fakes?No DMARC recordFailing
  • Fail: No DMARC record

    There is no v=DMARC1 TXT record at _dmarc.ddnss.de. Without DMARC, receivers have no policy for mail that fails SPF and DKIM, and Gmail and Yahoo require one for bulk senders. Start with p=none and a rua address to collect reports.

    How to fix this
AlignmentDoes it match your From?No issues foundPass

Nothing to report.

BIMICan inboxes show your logo?No BIMI recordInfo
  • Info: No BIMI record

    No BIMI record at default._bimi.ddnss.de. BIMI is optional: it shows your logo next to your mail in supporting inboxes once DMARC is enforced.

    How to fix this
MTA-STSIs mail to you encrypted?No MTA-STS recordInfo
  • Info: No MTA-STS record

    No MTA-STS record at _mta-sts.ddnss.de. MTA-STS (RFC 8461) makes sending servers require TLS and a valid certificate when delivering to you, which blocks downgrade attacks.

    How to fix this
TLS-RPTWill you hear about failures?No TLS-RPT recordInfo
  • Info: No TLS-RPT record

    No TLS reporting record at _smtp._tls.ddnss.de. TLS-RPT (RFC 8460) tells senders where to send daily reports about failed encrypted deliveries to you.

    How to fix this

Other fixes

Publish the MTA-STS recordTXT

Tells sending servers that ddnss.de publishes an MTA-STS policy at https://mta-sts.ddnss.de/.well-known/mta-sts.txt. Change the id whenever the policy file changes.

TypeTXT
Name / Host
_mta-sts.ddnss.de

Some DNS providers want just “_mta-sts” here.

Value
v=STSv1; id=202610040217

Host the MTA-STS policy filepolicy-file

Serve this file over HTTPS with a valid certificate for mta-sts.ddnss.de. It lists your MX hosts and starts in testing mode; switch to mode: enforce once TLS-RPT reports show no failures.

Location
https://mta-sts.ddnss.de/.well-known/mta-sts.txt
Contents
version: STSv1
mode: testing
mx: mail.mc-p.de
max_age: 604800

Set up a TLS report addressinstruction

Sending servers will report TLS failures when delivering to ddnss.de, which you need before enforcing MTA-STS. The address must accept TLS reports; a DMARC report address does not necessarily do so.

Applies to: _smtp._tls.ddnss.de

  1. Pick an address that will receive TLS reports: a mailbox you read (for example tls-reports@ddnss.de, created first) or a TLS reporting service. 2. Publish a TXT record at _smtp._tls.ddnss.de with the value v=TLSRPTv1; rua=mailto:<that address>.

Prepare BIMIinstruction

BIMI shows your logo next to messages in supporting inboxes, but only for mail that passes DMARC under an enforced policy.

Applies to: default._bimi.ddnss.de

  1. Enforce DMARC first: p=quarantine or p=reject at 100% (no pct below 100). 2. Convert your logo to an SVG Tiny PS file and host it over HTTPS, for example https://ddnss.de/bimi/logo.svg. 3. For Gmail and Apple Mail, obtain a VMC or CMC certificate for the logo. 4. Publish a TXT record at default._bimi.ddnss.de with v=BIMI1, l= set to the logo URL and a= set to the certificate URL.