Rafael Pfister
+41 58 510 22 08 Consulting

Roche

roche.com

Industry
Pharma & biotech
Headquarters
Basel, Basel-City
Type
listed
Employees (approx.)
103,000
Checked on
19 October 2026
87/100Grade A

Protection against forged senders: protected

Points per criterion

  • MX 10 / 10
  • SPF 15 / 15
  • DKIM 20 / 20
  • DMARC 25 / 25
  • DNSSEC 0 / 10
  • Transport (MTA-STS/DANE) 12 / 15
  • TLS-RPT 5 / 5

Findings

  • !DKIM key below 2048 bits

    RSA-1024 is considered too weak (RFC 8301, M3AAWG). Rotate to 2048-bit keys.

  • !DNSSEC not enabled

    Without DNSSEC, DNS answers can be forged in transit. DANE requires DNSSEC.

Check live in the Mail DNS Check →

Who runs the mail?

Mailbox provider
Google Workspace
Provider jurisdiction
USA · MX: US
Detection confidence
55 / 100
Microsoft tenant
Federated · Roche
Tenant region
EU
Federated via
wam.roche.com
Signals (6)
AutodiscoverMicrosoft 365autodiscover.outlook.com
Domain verificationMicrosoft 365MS=ms69073391
DKIMGoogle Workspacegoogle
Domain verificationGoogle Workspacegoogle-site-verification=SJJ805ZcxRDNZfS
Domain verificationAmazonamazonses:1cIIVg8rf/SdQ1nCzlWdanYKXJa+fz
Entra IDMicrosoft 365Entra-ID-Tenant (Federated)

MX servers

PrefHostIPNetworkCountryTLSA
30 rkamtaext01.roche.com 198.21.20.189 AS2047 ASN-ROCHE-BASLE - Hoffmann - La Roche Ltd. US –
30 rmumtaext02.roche.com 198.21.20.185 AS2047 ASN-ROCHE-BASLE - Hoffmann - La Roche Ltd. US –
30 rmumtaext01.roche.com 198.21.20.184 AS2047 ASN-ROCHE-BASLE - Hoffmann - La Roche Ltd. US –
30 rkamtaext02.roche.com 198.21.20.190 AS2047 ASN-ROCHE-BASLE - Hoffmann - La Roche Ltd. US –
40 ridesmtaext02.roche.com 198.21.25.78 AS2047 ASN-ROCHE-BASLE - Hoffmann - La Roche Ltd. US –
40 sc1esmtaext02.gene.com 192.12.78.22 AS2047 ASN-ROCHE-BASLE - Hoffmann - La Roche Ltd. US –

SPF

v=spf1 redirect=roche.com.hosted.spf-report.com
all
-all
DNS lookups
3 / 10
Includes
roche.com.hosted.spf-report.comroche_com_3ded9124_0.flat.spf-report.com

DMARC

v=DMARC1; p=reject; rua=mailto:88a488cb@mxtoolbox.dmarc-report.com,mailto:dmarc@ayba8dhs.uriports.com; ruf=mailto:88a488cb@forensics.dmarc-report.com,mailto:dmarc@ayba8dhs.uriports.com; fo=1; pct=100
Policy
p=reject
Subdomains (sp)
inherits p=reject
Share (pct)
100 %
Alignment DKIM/SPF
relaxed / relaxed
Aggregate reports (rua)
88a488cb@mxtoolbox.dmarc-report.comdmarc@ayba8dhs.uriports.com
Forensic reports (ruf)
88a488cb@forensics.dmarc-report.comdmarc@ayba8dhs.uriports.com
Report services
URIports

DKIM

SelectorKeydelegated to
cm RSA 1024 –
dk RSA 1024 –
google RSA 1024 –
key2 RSA 2048 key2.domainkey.u24229919.wl170.sendgrid.net
mail RSA 1024 –
mandrill RSA 1024 –
mx RSA 1024 –
s2 RSA 2048 s2.domainkey.u21765927.wl178.sendgrid.net
smtp RSA 2048 –

Checked: 100 common selectors. Keys under custom selectors remain invisible.

Transport encryption

MTA-STS
Mode: enforce · max_age: 2,419,200 s · covers all MX: yes
mx
mtaalt1.roche.comridesmtaext02.roche.comsc1esmtaext02.gene.commtaalt3.roche.commtaalt2.roche.comrmumtaext01.roche.comrkamtaext01.roche.comrkamtaext02.roche.comrmumtaext02.roche.comsc1esmtaext01.gene.comridesmtaext01.roche.commtaalt4.roche.com
DANE
missing
DNSSEC
missing
TLS-RPT
mailto:tlsrpt@ayba8dhs.uriports.com
BIMI
missing

Verified services

From verification records in the domain TXT: services where the domain is verified.

Microsoft 365GoogleAtlassianDocuSignAdobeAmazon SESGlobalSignOneTrustBrevoTwilio/SendGridSmartsheet

History

  • Score 87 · DMARC reject

All changes of this organisation in the change log →

Raw data 
roche.com. IN MX 30 rkamtaext01.roche.com.
roche.com. IN MX 30 rmumtaext02.roche.com.
roche.com. IN MX 30 rmumtaext01.roche.com.
roche.com. IN MX 30 rkamtaext02.roche.com.
roche.com. IN MX 40 ridesmtaext02.roche.com.
roche.com. IN MX 40 sc1esmtaext02.gene.com.
roche.com. IN TXT "v=spf1 redirect=roche.com.hosted.spf-report.com"
_dmarc.roche.com. IN TXT "v=DMARC1; p=reject; rua=mailto:88a488cb@mxtoolbox.dmarc-report.com,mailto:dmarc@ayba8dhs.uriports.com; ruf=mailto:88a488cb@forensics.dmarc-report.com,mailto:dmarc@ayba8dhs.uriports.com; fo=1; pct=100"
_mta-sts.roche.com. IN TXT "v=STSv1; id=20230822081612Z"
_smtp._tls.roche.com. IN TXT "v=TLSRPTv1; rua=mailto:tlsrpt@ayba8dhs.uriports.com"

More from this industry

← Back to overview