Free email security report

Here's how graute.de protects its email

Checked August 01, 2026 20:30

90 Good

Core protections

SPF

Protected

A strict SPF policy is in place — servers not on the approved list are rejected outright.

Show raw DNS record 
v=spf1 +a +mx ip4:217.91.21.116 include:_spf_eucentral1.prod.hydra.sophos.com -all

DKIM

Protected

A DKIM signing key was found — outgoing mail can be cryptographically verified as genuinely from this domain.

Show raw DNS record 
s1

DMARC

Protected

DMARC is set to reject — mail that fails SPF/DKIM alignment is blocked before it ever reaches an inbox.

  • No aggregate reporting is configured — the domain owner has no visibility into who's sending on their behalf.
Show raw DNS record 
v=DMARC1;p=reject;rua=mailto:edv@graute.de;ruf=mailto:edv@graute.de;adkim=r;

Advanced protections

MTA-STS Not found TLS-RPT Not found DNSSEC Present BIMI Not found CAA {pass: "Protected", warn: "Partial", fail: "At risk", none: "Not configured", present: "Present", absent: "Not found"}

Want this level of protection for your own attachments?

Adlerwacht adds passkey-verified, end-to-end secured delivery on top of whatever your domain already has configured.

Start free trial Talk to sales

What do these mean?

What is SPF?

SPF (Sender Policy Framework) is a DNS record listing which mail servers are allowed to send email for a domain. Without it, anyone can forge the "From" address.

What is DKIM?

DKIM (DomainKeys Identified Mail) cryptographically signs outgoing email, letting the receiving server verify it wasn't altered in transit and really came from this domain.

What is DMARC?

DMARC tells receiving mail servers what to do with messages that fail SPF or DKIM checks — ignore them, quarantine them, or reject them outright.

What is MTA-STS?

MTA-STS forces incoming mail to this domain to travel over an encrypted, certificate-verified connection, closing off a common way attackers intercept mail in transit.

What is CAA?

A CAA record lists which Certificate Authorities are allowed to issue TLS certificates for a domain, making it harder for an attacker to get a fraudulent certificate issued elsewhere.