mozilla.com

mozilla.com · Last checked 2026-10-04 02:08 UTC

mozilla.com

Excellent, with 1 thing to fix

mozilla.com scored 92/100 (grade A). The main issue is DKIM key shorter than 2048 bits. Detected senders: Google Workspace.

Checked 2026-10-04 02:08 UTC · fresh check

5 passed1 needs attention0 failing2 for informationDetected senders: Google Workspace

All checks

MXCan servers find your inbox?No issues foundPass

Nothing to report.

SPFWho may send as you?SPF ends in softfail (~all)Info
  • Info: SPF ends in softfail (~all)

    "~all" is common and works well with DMARC. "-all" is stricter; switch when you are sure every sender is listed.

DKIMAre your emails signed?DKIM key shorter than 2048 bitsNeeds attention
  • Warning: DKIM key shorter than 2048 bits

    google (1024-bit), k1 (1024-bit) uses an RSA key below 2048 bits. Short keys can be factored and some receivers treat them as weak. Rotate to a 2048-bit key at your sending provider.

  • Pass: DKIM key published

    mozilla.com publishes a DKIM key under google, k1, k2, k3, s1, s2.

DMARCWhat happens to fakes?No issues foundPass

Nothing to report.

AlignmentDoes it match your From?No issues foundPass

Nothing to report.

BIMICan inboxes show your logo?No issues foundPass

Nothing to report.

MTA-STSIs mail to you encrypted?No MTA-STS recordInfo
  • Info: No MTA-STS record

    No MTA-STS record at _mta-sts.mozilla.com. MTA-STS (RFC 8461) makes sending servers require TLS and a valid certificate when delivering to you, which blocks downgrade attacks.

    How to fix this
TLS-RPTWill you hear about failures?TLS-RPT is configuredPass
  • Pass: TLS-RPT is configured

    TLS reports will be sent to mailto:tls-report@vali.email.

How to fix it

Publish the MTA-STS recordTXT

Tells sending servers that mozilla.com publishes an MTA-STS policy at https://mta-sts.mozilla.com/.well-known/mta-sts.txt. Change the id whenever the policy file changes.

TypeTXT
Name / Host
_mta-sts.mozilla.com

Some DNS providers want just “_mta-sts” here.

Value
v=STSv1; id=202610040208

Host the MTA-STS policy filepolicy-file

Serve this file over HTTPS with a valid certificate for mta-sts.mozilla.com. It lists your MX hosts and starts in testing mode; switch to mode: enforce once TLS-RPT reports show no failures.

Location
https://mta-sts.mozilla.com/.well-known/mta-sts.txt
Contents
version: STSv1
mode: testing
mx: aspmx.l.google.com
mx: alt1.aspmx.l.google.com
mx: alt2.aspmx.l.google.com
mx: aspmx3.googlemail.com
max_age: 604800