Rafael Pfister
+41 58 510 22 08 Consulting

Accarda

accarda.com

Industry
Financial services
Headquarters
Wangen-Brüttisellen, Zurich
Type
private
Employees (approx.)
200
Checked on
19 October 2026
61/100Grade C

Protection against forged senders: not protected (monitoring only)

Points per criterion

  • MX 10 / 10
  • SPF 13 / 15
  • DKIM 20 / 20
  • DMARC 6 / 25
  • DNSSEC 0 / 10
  • Transport (MTA-STS/DANE) 12 / 15
  • TLS-RPT 0 / 5

Findings

  • ✕DMARC in monitoring mode only (p=none)

    p=none provides reports but does not reject a single forgery. The goal is p=reject.

  • !SPF close to the 10-lookup limit (8)

    One more sending service can break the limit. Flattening or subdomains for third parties create headroom.

  • !External report receiver not authorised

    The authorisation record for an external rua domain is missing (RFC 7489 §7.1); many receivers then send no reports.

  • !DKIM key below 2048 bits

    RSA-1024 is considered too weak (RFC 8301, M3AAWG). Rotate to 2048-bit keys.

  • !DNSSEC not enabled

    Without DNSSEC, DNS answers can be forged in transit. DANE requires DNSSEC.

  • !No MTA-STS

    Without MTA-STS (or DANE) inbound encryption is not enforced; an attacker on the path can downgrade to plain text.

  • !No TLS reporting (TLS-RPT)

    Without TLS-RPT the organisation does not learn when senders fail to deliver encrypted.

  • iDANE active (TLSA with DNSSEC)

    All MX hosts publish TLSA records secured by DNSSEC.

Check live in the Mail DNS Check →

Who runs the mail?

Mailbox provider
Microsoft 365
Upstream gateway
Cloudflare Email Security
Provider jurisdiction
USA · MX: US
Detection confidence
88 / 100
Microsoft tenant
Federated · accarda.com
Tenant region
EU
Federated via
fs.accarda.com
Signals (3)
SPFMicrosoft 365include:spf.protection.outlook.com
DKIMGoogle Workspacegoogle
Entra IDMicrosoft 365Entra-ID-Tenant (Federated)

MX servers

PrefHostIPNetworkCountryTLSA
12 route2.mx.cloudflare.net 162.159.205.18 AS13335 CLOUDFLARENET - Cloudflare, Inc. US ✓ DNSSEC
162.159.205.19 AS13335 CLOUDFLARENET - Cloudflare, Inc. US
162.159.205.17 AS13335 CLOUDFLARENET - Cloudflare, Inc. US
16 route3.mx.cloudflare.net 162.159.205.23 AS13335 CLOUDFLARENET - Cloudflare, Inc. US ✓ DNSSEC
162.159.205.24 AS13335 CLOUDFLARENET - Cloudflare, Inc. US
162.159.205.25 AS13335 CLOUDFLARENET - Cloudflare, Inc. US
29 route1.mx.cloudflare.net 162.159.205.13 AS13335 CLOUDFLARENET - Cloudflare, Inc. US ✓ DNSSEC
162.159.205.11 AS13335 CLOUDFLARENET - Cloudflare, Inc. US
162.159.205.12 AS13335 CLOUDFLARENET - Cloudflare, Inc. US

SPF

v=spf1 include:singeropinions.com include:_spf.mx.cloudflare.net ~all
all
~all
DNS lookups
8 / 10
Includes
singeropinions.com_spf.mx.cloudflare.net
Detected sending services
Microsoft 365

DMARC

v=DMARC1; p=none; rua=mailto:dmarc_rua@innerhost.ehost-services165.com; ruf=mailto:dmarc_ruf@innerhost.ehost-services165.com; fo=1;
Policy
p=none
Subdomains (sp)
inherits p=none
Share (pct)
100 %
Alignment DKIM/SPF
relaxed / relaxed
Aggregate reports (rua)
dmarc_rua@innerhost.ehost-services165.com
Forensic reports (ruf)
dmarc_ruf@innerhost.ehost-services165.com

DKIM

SelectorKeydelegated to
20161025 RSA 1024 –
202301 RSA 512 –
20230601 RSA 1024 –
2024 RSA 512 –
202401 RSA 1024 –
2025 RSA 1024 –
a1 RSA 1024 –
brevo RSA 1024 –
cisco RSA 1024 –
cm RSA 1024 –
crm RSA 1024 –
ctct1 RSA 1024 –
ctct2 RSA 1024 –
default RSA 1024 –
dk RSA 1024 –
dkim RSA 1024 –
dkim-selector RSA 1024 –
dkim1 RSA 1024 –
dkim2 RSA 1024 –
ed25519 RSA 1024 –
em RSA 1024 –
everlytickey1 RSA 1024 –
everlytickey2 RSA 1024 –
eversrv RSA 512 –
fm1 RSA 1024 –
fm2 RSA 1024 –
fm3 RSA 1024 –
google RSA 1024 –
google2048 RSA 1024 –
hin RSA 1024 –
hornet RSA 1024 –
hornetsecurity RSA 1024 –
hs1 RSA 1024 –
hs2 RSA 512 –
infomaniak RSA 1024 –
iphmx RSA 1024 –
k1 RSA 512 –
k2 RSA 1024 –
k3 RSA 512 –
key1 RSA 512 –
key2 RSA 1024 –
kiteworks RSA 1024 –
m1 RSA 1024 –
m2 RSA 512 –
mail RSA 1024 –
mail2 RSA 1024 –
mailjet RSA 512 –
mailo RSA 1024 –
mandrill RSA 1024 –
marketing RSA 1024 –
mimecast RSA 1024 –
mimecast20190104 RSA 1024 –
mkto RSA 1024 –
ml RSA 1024 –
ms RSA 1024 –
mta RSA 1024 –
mte RSA 1024 –
mx RSA 1024 –
mxvault RSA 1024 –
newsletter RSA 512 –
nl RSA 1024 –
pm RSA 1024 –
pm-bounces RSA 1024 –
pp RSA 1024 –
ppd1 RSA 1024 –
proofpoint RSA 1024 –
protonmail RSA 1024 –
protonmail2 RSA 512 –
protonmail3 RSA 1024 –
retarus RSA 1024 –
rsa RSA 512 –
s1 RSA 1024 –
s1024 RSA 1024 –
s2 RSA 1024 –
s2048 RSA 1024 –
s3 RSA 1024 –
s4 RSA 1024 –
salesforce RSA 1024 –
scph0920 RSA 1024 –
sel1 RSA 1024 –
sel2 RSA 1024 –
selector1 RSA 512 –
selector2 RSA 1024 –
sendgrid RSA 1024 –
seppmail RSA 512 –
seppmail1 RSA 1024 –
sf1 RSA 1024 –
sf2 RSA 512 –
sfdc RSA 512 –
sig1 RSA 1024 –
sm RSA 1024 –
smtp RSA 1024 –
smtpapi RSA 1024 –
spop1024 RSA 1024 –
swisscom RSA 1024 –
totemo RSA 1024 –
turbo-smtp RSA 1024 –
x RSA 1024 –
y RSA 1024 –
zoho RSA 1024 –

Checked: 100 common selectors. Keys under custom selectors remain invisible.

Transport encryption

MTA-STS
missing
DANE
active
DNSSEC
missing
TLS-RPT
missing
BIMI
missing

History

  • Score 61 · DMARC none

All changes of this organisation in the change log →

Raw data 
accarda.com. IN MX 12 route2.mx.cloudflare.net.
accarda.com. IN MX 16 route3.mx.cloudflare.net.
accarda.com. IN MX 29 route1.mx.cloudflare.net.
accarda.com. IN TXT "v=spf1 include:singeropinions.com include:_spf.mx.cloudflare.net ~all"
_dmarc.accarda.com. IN TXT "v=DMARC1; p=none; rua=mailto:dmarc_rua@innerhost.ehost-services165.com; ruf=mailto:dmarc_ruf@innerhost.ehost-services165.com; fo=1;"

More from this industry

← Back to overview