atlassian.com
The three core checks pass. What is missing is the transport and trust layer around them.
5 of 8 checks pass · 5 tools visible in DNS · nothing urgent
1 · Authentication and transport
SPF
PassValid, soft failAnything not on the list is accepted but marked. Google recommends ~all; with DMARC enforced it is as strong as -all.
v=spf1 ip4:54.85.255.245 ip4:54.241.191.3 include:_spf.google.com include:cust-spf.exacttarget.com include:spf-001d9801.pphosted.com include:amazonses.com include:spf1.atlassian.com include:spf3.atlassian.com ip4:54.71.147.74 ip4:54.71.63.106 ip4:54.70.13.32 ~all
DKIM
Pass4 keys foundSelectors google, s1, s2, mandrill publish a public key.
google._domainkey, s1._domainkey, s2._domainkey, mandrill._domainkey
DMARC
PassEnforced (p=reject)Failing mail is rejected. This is the finish line.
v=DMARC1; p=reject; fo=1; pct=100; adkim=r; aspf=r; rua=mailto:dmarc_rua@emaildefense.proofpoint.com,mailto:dmarc-rua@abuse.atlassian.com; ruf=mailto:dmarc_ruf@emaildefense.proofpoint.com,mailto:dmarc-ruf@abuse.atlassian.com
MX
Pass2 hostsMore than one receiving server, so a single outage does not bounce mail.
10 mxa-001d9801.gslb.pphosted.com 20 mxb-001d9801.gslb.pphosted.com
MTA-STS
ReviewNot publishedSending servers cannot tell that this domain requires TLS, so inbound mail can be downgraded to plain text by anyone on the path.
TLS-RPT
OptionalNot publishedNobody is told when TLS to this domain fails. Cheap to add once MTA-STS is in place.
BIMI
PassPublishedLogo record found and DMARC qualifies. Yahoo shows it from the record; Gmail and Apple Mail also need a VMC or CMC certificate (the a= tag).
v=BIMI1; l=https://vmc.digicert.com/ad1c2acd-2d54-462c-a78d-57351f374742.svg; a=https://vmc.digicert.com/ad1c2acd-2d54-462c-a78d-57351f374742.pem
DNSSEC
OptionalNot signedOptional. Signing the zone protects every record in this report from tampering.
2 · Tools visible in DNS
| Layer | Tool | Evidence |
|---|---|---|
| Mailbox | Google Workspace | SPF include:_spf.google.com |
| Gateway | Proofpoint | MX mxa-001d9801.gslb.pphosted.com |
| Marketing | Mailchimp | DKIM mandrill._domainkey |
| Marketing | Salesforce Marketing Cloud | SPF include:cust-spf.exacttarget.com |
| Transactional | Amazon SES | SPF include:amazonses.com |
Only tools that leave a DNS trace appear. A shared DKIM selector is attributed only when its CNAME target names the vendor.
3 · Sender requirements (Google, Yahoo, Microsoft)
| Requirement | Applies to | Status | Note |
|---|---|---|---|
| Authenticate with SPF or DKIM | GoogleYahooMicrosoft | Verified | At least one method is in place. |
| Bulk senders: both SPF and DKIM | GoogleYahoo | Verified | Both are present. |
| Publish a DMARC record (p=none is enough) | GoogleYahooMicrosoft | Verified | Policy is p=reject. |
| From: domain aligns with SPF or DKIM | GoogleYahooMicrosoft | Not checkable here | Needs a real message. The Send-a-Test report will check this. |
| Valid forward and reverse DNS for sending IPs | GoogleYahoo | Not checkable here | Depends on the sending server, not the domain. |
| Encrypt in transit (TLS) | GoogleYahoo | Not checkable here | Outbound TLS depends on your sending tool; MTA-STS would cover inbound. |
| One-click unsubscribe (RFC 8058) for marketing mail | GoogleYahoo | Not checkable here | A message header, not a DNS record. Microsoft recommends it rather than requiring it. |
| Spam complaint rate under 0.1% (0.3% is the hard limit) | GoogleYahoo | Not checkable here | Read it in Google Postmaster Tools and Yahoo Sender Hub. Google’s target is 0.1%; 0.3% is where enforcement starts. |
4 · What to fix, in order
-
P3
Publish MTA-STS (record and policy file)
Tells sending servers to require TLS to your MX hosts, which prevents downgrade attacks. The TXT record alone does nothing: the policy file must be served over HTTPS at mta-sts.atlassian.com. Start in testing mode, watch TLS-RPT, then switch to enforce.
Publish at_mta-sts.atlassian.com and https://mta-sts.atlassian.com/.well-known/mta-sts.txtTXT v=STSv1; id=2026100401 mta-sts.txt: version: STSv1 mode: testing mx: mxa-001d9801.gslb.pphosted.com mx: mxb-001d9801.gslb.pphosted.com max_age: 86400
-
P3
Publish TLS-RPT
You get a report when TLS delivery to your domain fails; this is what notices a downgrade that MTA-STS is meant to prevent. The address must exist.
Publish at_smtp._tls.atlassian.comv=TLSRPTv1; rua=mailto:tls-rpt@atlassian.com
-
P3
Sign the zone with DNSSEC
Protects every record in this report from being swapped in transit. Two steps: enable signing at your DNS host (one switch at Cloudflare and most others), then add the DS record it gives you at your registrar.
Publish atatlassian.com
Appendix · Raw DNS answers
| Name | Type | Answer |
|---|---|---|
| atlassian.com | MX | 10 mxa-001d9801.gslb.pphosted.com 20 mxb-001d9801.gslb.pphosted.com |
| atlassian.com | A | 18.67.195.121 18.67.195.125 18.67.195.56 18.67.195.79 |
| atlassian.com | TXT | v=spf1 ip4:54.85.255.245 ip4:54.241.191.3 include:_spf.google.com include:cust-spf.exacttarget.com include:spf-001d9801.pphosted.com include:amazonses.com include:spf1.atlassian.com include:spf3.atlassian.com ip4:54.71.147.74 ip4:54.71.63.106 ip4:54.70.13.32 ~all (+ 95 other TXT records: site-verification tokens and the like, omitted) |
| _dmarc.atlassian.com | TXT | v=DMARC1; p=reject; fo=1; pct=100; adkim=r; aspf=r; rua=mailto:dmarc_rua@emaildefense.proofpoint.com,mailto:dmarc-rua@abuse.atlassian.com; ruf=mailto:dmarc_ruf@emaildefense.proofpoint.com,mailto:dmarc-ruf@abuse.atlassian.com |
| <selector>._domainkey.atlassian.com | TXT | google → key published s1 → key published s2 → key published mandrill → key published |
| _mta-sts.atlassian.com | TXT | no record |
| _smtp._tls.atlassian.com | TXT | no record |
| default._bimi.atlassian.com | TXT | v=BIMI1; l=https://vmc.digicert.com/ad1c2acd-2d54-462c-a78d-57351f374742.svg; a=https://vmc.digicert.com/ad1c2acd-2d54-462c-a78d-57351f374742.pem |