{"sample":true,"refreshed_daily":true,"domain":"3l-groupconsulting.co.za","checked_at":"2026-10-21T18:05:28.118Z","score":90,"letter":"A","summary":"3l-groupconsulting.co.za scores 90/100 (A): 6 pass, 1 warn, 0 fail, 6 info. Not checked (retry to include): Microsoft 365 tenant. Fix first. DKIM: DKIM keys found (selector1, selector2), but one is RSA under 2048 bits: selector1 (1024-bit). Receivers still accept them, but they are weak by current standards.","checks":[{"check":"spf","label":"SPF","grade":"pass","finding":"One valid SPF record that inherits -all from redirect=3l-groupconsulting.co.za.spf.sophosdmarc.net, 2 of 10 DNS lookups.","fix":null,"detail":{"records":["v=spf1 redirect=3l-groupconsulting.co.za.spf.sophosdmarc.net"],"dns_lookups":2,"lookup_limit":10,"void_lookups":0,"void_limit":2,"all_qualifier":"-","uses_ptr":false,"errors":[]}},{"check":"dkim","label":"DKIM","grade":"warn","finding":"DKIM keys found (selector1, selector2), but one is RSA under 2048 bits: selector1 (1024-bit). Receivers still accept them, but they are weak by current standards.","fix":"Microsoft 365 (selector1): in the Microsoft Defender portal DKIM tab (https://security.microsoft.com/authentication?viewid=DKIM) select 3l-groupconsulting.co.za and choose Rotate DKIM keys, or run Rotate-DkimSigningConfig -Identity 3l-groupconsulting.co.za -KeySize 2048 in Exchange Online PowerShell. The CNAMEs stay the same.","detail":{"selectors_probed":46,"selectors_timed_out":0,"found":[{"selector":"selector1","state":"key","key_type":"rsa","bits":1024},{"selector":"selector2","state":"key","key_type":"rsa","bits":2048}]}},{"check":"dmarc","label":"DMARC","grade":"pass","finding":"DMARC enforces p=reject on 100% of mail, with reports to reports.sophosdmarc.net.","fix":null,"detail":{"policy_source":"domain","policy_domain":"3l-groupconsulting.co.za","policy":"reject","subdomain_policy":null,"effective_policy":"reject","pct":100,"rua_domains":["reports.sophosdmarc.net"],"rua_unauthorised":[],"adkim":"r","aspf":"r"}},{"check":"mx","label":"MX","grade":"pass","finding":"1 MX host, all resolvable.","fix":null,"detail":{"hosts":[{"preference":0,"host":"3lgroupconsulting-co-za0e.mail.protection.outlook.com","resolvable":true}],"null_mx":false,"provider":"microsoft365"}},{"check":"tls","label":"Website certificate (HTTPS on 443)","grade":"pass","finding":"Valid certificate from Google Trust Services WE1, 40 days left.","fix":null,"detail":{"port":443,"ip":"104.21.24.91","issuer":"Google Trust Services WE1","subject":"3l-groupconsulting.co.za","valid_to":"2026-12-01T13:38:58.000Z","days_left":40,"hostname_match":true,"chain_valid":true,"chain_error":null,"protocol":"TLSv1.3"}},{"check":"m365","label":"Microsoft 365 tenant","grade":"info","finding":"Not checked: the lookup did not complete (fetch failed). Left out of the score.","fix":null,"detail":{"error":"fetch failed","not_checked":true,"configured":false}},{"check":"registration","label":"Registration (registrar and age)","grade":"info","finding":"The .za registry publishes no RDAP service, so registrar and age cannot be read. Not graded.","fix":null,"detail":{"tld":"za","rdap":false}},{"check":"mta_sts","label":"MTA-STS","grade":"pass","finding":"MTA-STS enforced for 3lgroupconsulting-co-za0e.mail.protection.outlook.com, max_age 604800s.","fix":null,"detail":{"records":1,"policy":{"mode":"enforce","mx":["3lgroupconsulting-co-za0e.mail.protection.outlook.com"],"max_age":604800}}},{"check":"tls_rpt","label":"TLS-RPT","grade":"pass","finding":"TLS-RPT reports go to reports.sophosdmarc.net.","fix":null,"detail":{"records":1,"rua_domains":["reports.sophosdmarc.net"]}},{"check":"dnssec","label":"DNSSEC","grade":"info","finding":"DNSSEC is not enabled. DNS answers for this domain can be spoofed on the path.","fix":"Turn on DNSSEC at your DNS host, wait until it serves the DNSKEY, then publish the DS record it gives you at the registrar for 3l-groupconsulting.co.za (algorithm 13, digest type 2). Publish the DS last: a DS that does not match the zone takes the domain offline for validating resolvers until the DS TTL runs out.","detail":{"status":"unsigned","resolvers":{"cloudflare":"unsigned","google":"unsigned"},"ds_records":0,"dnskey_records":0,"algorithms":[],"ds_digest_types":[],"resolver_error":null,"parent_signed":true,"validated":false}},{"check":"caa","label":"CAA","grade":"info","finding":"No CAA record, so any public CA may issue certificates for this domain.","fix":"Publish CAA at 3l-groupconsulting.co.za: 0 issue \"pki.goog\", plus one 0 issue record for every other CA that issues for you (check your CDN, e.g. Cloudflare or AWS, and any second CA), and 0 iodef \"mailto:security@3l-groupconsulting.co.za\". A CA left off the list cannot renew. security@3l-groupconsulting.co.za is a placeholder: replace it with a real mailbox you read (create it first).","detail":{"at":null,"issue":[],"issuewild":[],"current_ca":"pki.goog"}},{"check":"bimi","label":"BIMI","grade":"info","finding":"No BIMI record (optional: shows your logo in Gmail, Apple Mail and Yahoo).","fix":"Publish TXT at default._bimi.3l-groupconsulting.co.za: \"v=BIMI1; l=https://3l-groupconsulting.co.za/bimi/logo.svg\" (SVG Tiny PS; Gmail also needs a VMC or CMC in a=).","detail":{"records":0}},{"check":"dnsbl","label":"Blocklist (UCEPROTECT Level 1)","grade":"info","finding":"Not listed on UCEPROTECT Level 1 (4 mail IPs checked).","fix":null,"detail":{"list":"dnsbl-1.uceprotect.net","checked":4,"listed":[],"lookup_errors":[],"not_checked":0,"canary_ok":true,"sources_failed":[],"about":"UCEPROTECT Level 1 lists single IPs seen hitting UCEPROTECT spamtraps or other abuse, automatically or manually; entries expire 7 days after the last incident.","notice":"Copyright © 2001-2021 UCEPROTECT-Network http://www.uceprotect.net","licence":"https://www.uceprotect.net/en/index.php?m=13&s=0"}}],"notes":["Non-intrusive: only the ordinary requests a browser or mail server makes. Public DNS over HTTPS (including blocklist lookups of the mail IPs), one TLS handshake on port 443 of the domain, the MTA-STS policy over HTTPS on port 443 (only when _mta-sts is published), the BIMI mark certificate named in a= over HTTPS on port 443 (only when published), the registry's RDAP service and Microsoft's public sign-in discovery endpoints. No other ports are touched.","DKIM can only be found at common selectors. A custom selector is invisible to DNS lookups.","Info checks (an optional feature not deployed, or no registry data) carry their fix but do not change the score.","Registration shows the registrar name and IANA ID only. Registrant and contact data are never returned.","The DomainRef app does not store queried domains; our firewall log keeps request URLs (with the domain) for about 6 months.","Blocklist data: Copyright © 2001-2021 UCEPROTECT-Network http://www.uceprotect.net, used under the UCEPROTECT licence: https://www.uceprotect.net/en/index.php?m=13&s=0. UCEPROTECT Level 1 lists single IPs seen hitting UCEPROTECT spamtraps or other abuse, automatically or manually; entries expire 7 days after the last incident."]}