sophos.com
Excellent, with 1 thing to fix
sophos.com scored 92/100 (grade A). The main issue is DKIM key shorter than 2048 bits. Detected senders: Microsoft 365.
Checked 2026-10-04 02:15 UTC · fresh check
All checks
MXCan servers find your inbox?No issues foundPass
Nothing to report.
SPFWho may send as you?SPF ends in softfail (~all)Info
- Info: SPF ends in softfail (~all)
"~all" is common and works well with DMARC. "-all" is stricter; switch when you are sure every sender is listed.
DKIMAre your emails signed?DKIM key shorter than 2048 bitsNeeds attention
- Warning: DKIM key shorter than 2048 bits
k1 (1024-bit) uses an RSA key below 2048 bits. Short keys can be factored and some receivers treat them as weak. Rotate to a 2048-bit key at your sending provider.
- Pass: DKIM key published
sophos.com publishes a DKIM key under selector1, k1, k2, k3.
DMARCWhat happens to fakes?DMARC policy is quarantine; consider rejectInfo
- Info: DMARC policy is quarantine; consider reject
Failing mail goes to spam rather than being refused. When reports show no legitimate failures, reject gives the strongest protection.
How to fix this
AlignmentDoes it match your From?No issues foundPass
Nothing to report.
BIMICan inboxes show your logo?No issues foundPass
Nothing to report.
MTA-STSIs mail to you encrypted?MTA-STS is in testing modeInfo
- Info: MTA-STS is in testing mode
Senders report TLS failures (with TLS-RPT) but still deliver. Switch to mode: enforce once the reports are clean.
TLS-RPTWill you hear about failures?TLS-RPT is configuredPass
- Pass: TLS-RPT is configured
TLS reports will be sent to mailto:reports@reports.sophosdmarc.net.
How to fix it
Strengthen the DMARC policyTXT
Rejects mail that fails DMARC, the strongest protection against spoofing.
_dmarc.sophos.com
Some DNS providers want just “_dmarc” here.
v=DMARC1; p=reject; rua=mailto:a.z2zesduo@reports.sophosdmarc.net,mailto:dmarc_rua@sophos.com; adkim=r; aspf=r
v=DMARC1; p=quarantine; pct=100; fo=0:s; rua=mailto:a.z2zesduo@reports.sophosdmarc.net,mailto:dmarc_rua@sophos.com; ruf=mailto:dmarc_ruf@sophos.com