Basellandschaftliche Gebäudeversicherung
bgv.ch
- Industry
- Public enterprises
- Headquarters
- Liestal, Basel-Country
- Type
- public
- Employees (approx.)
- 60
- Checked on
- 19 October 2026
87/100Grade A
Protection against forged senders: protected
Points per criterion
- MX 10 / 10
- SPF 15 / 15
- DKIM 20 / 20
- DMARC 25 / 25
- DNSSEC 0 / 10
- Transport (MTA-STS/DANE) 12 / 15
- TLS-RPT 5 / 5
- Industry avg.: 64.5 ▲ 22.5
- Canton avg.: 56.1 ▲ 30.9
- Overall avg.: 53.5 ▲ 33.5
- Rank 1 of 10 in the industry
Findings
-
!SPF authorises very large IP ranges (157,755)
The SPF record itself lists IPv4 ranges with more than 65,000 addresses. The wider the range, the easier it is for third parties to send from an authorised network.
-
!DKIM key below 2048 bits
RSA-1024 is considered too weak (RFC 8301, M3AAWG). Rotate to 2048-bit keys.
-
!DNSSEC not enabled
Without DNSSEC, DNS answers can be forged in transit. DANE requires DNSSEC.
-
iBIMI with mark certificate (VMC/CMC)
Logo with a verified mark certificate, shown by Gmail and Apple Mail among others. Requires DMARC enforcement.
Who runs the mail?
- Mailbox provider
- Microsoft 365
- Upstream gateway
- Proofpoint
- Provider jurisdiction
- USA · MX: GB, US
- Detection confidence
- 88 / 100
- Microsoft tenant
- Managed · BGV
- Tenant region
- EU
Signals (3)
| DKIM | Microsoft 365 | selector1 → selector1-bgv-ch._domainkey.hsnbgv.onmicrosoft.com |
|---|---|---|
| Domain verification | Google Workspace | google-site-verification=C51OGLW0Lxq2zgX |
| Entra ID | Microsoft 365 | Entra-ID-Tenant (Managed) |
MX servers
| Pref | Host | IP | Network | Country | TLSA |
|---|---|---|---|---|---|
| 10 | mx2-eu1.ppe-hosted.com | 185.132.181.17 | AS52129 PROOFPOINT-ASN-EU - Proofpoint, Inc. | GB | – |
91.209.104.156 | AS52129 PROOFPOINT-ASN-EU - Proofpoint, Inc. | US | |||
| 10 | mx1-eu1.ppe-hosted.com | 91.209.104.155 | AS52129 PROOFPOINT-ASN-EU - Proofpoint, Inc. | US | – |
185.132.181.16 | AS52129 PROOFPOINT-ASN-EU - Proofpoint, Inc. | GB |
SPF
v=spf1 redirect=bgv.ch.spf.sophosdmarc.net- all
-all- DNS lookups
- 3 / 10
- Includes
bgv.ch.spf.sophosdmarc.netbgv.ch0.spf.sophosdmarc.net- IPv4
- 157,755 addresses authorised directly
DMARC
v=DMARC1; p=reject; rua=mailto:a.rsvz2082@reports.sophosdmarc.net; ruf=mailto:f.rsvz2082@reports.sophosdmarc.net- Policy
- p=reject
- Subdomains (sp)
- inherits p=reject
- Share (pct)
- 100 %
- Alignment DKIM/SPF
- relaxed / relaxed
- Aggregate reports (rua)
a.rsvz2082@reports.sophosdmarc.net- Forensic reports (ruf)
f.rsvz2082@reports.sophosdmarc.net
DKIM
| Selector | Key | delegated to |
|---|---|---|
selector1 | RSA 1024 | selector1-bgv-ch._domainkey.hsnbgv.onmicrosoft.com |
selector2 | RSA 1024 | selector2-bgv-ch._domainkey.hsnbgv.onmicrosoft.com |
Checked: 100 common selectors. Keys under custom selectors remain invisible.
Transport encryption
- MTA-STS
- Mode: enforce · max_age: 604,800 s · covers all MX: yes
- mx
mx1-eu1.ppe-hosted.commx2-eu1.ppe-hosted.com- DANE
- missing
- DNSSEC
- missing
- TLS-RPT
mailto:reports@reports.sophosdmarc.netmailto:martin.blattner@bgv.ch- BIMI
- VMC/CMC ✓ · Logo
Verified services
From verification records in the domain TXT: services where the domain is verified.
GoogleAppleAtlassianCisco WebexGlobalSign
History
- Score 87 · DMARC reject
Raw data
bgv.ch. IN MX 10 mx2-eu1.ppe-hosted.com.
bgv.ch. IN MX 10 mx1-eu1.ppe-hosted.com.
bgv.ch. IN TXT "v=spf1 redirect=bgv.ch.spf.sophosdmarc.net"
_dmarc.bgv.ch. IN TXT "v=DMARC1; p=reject; rua=mailto:a.rsvz2082@reports.sophosdmarc.net; ruf=mailto:f.rsvz2082@reports.sophosdmarc.net"
_mta-sts.bgv.ch. IN TXT "v=STSv1; id=1774455622"
_smtp._tls.bgv.ch. IN TXT "v=TLSRPTv1; rua=mailto:reports@reports.sophosdmarc.net,mailto:martin.blattner@bgv.ch"
default._bimi.bgv.ch. IN TXT "v=BIMI1; l=https://portal.sophosdmarc.com/storage/domains/bimi/avjJmKj7ErjqOLQ4jnRAO84mm3LJMwoPalS1vLtA.svg; a=…"