autodesk.com
Authenticated end to end and enforced. A few optional layers would make it airtight.
8 of 8 checks pass · 6 tools visible in DNS · nothing urgent
1 · Authentication and transport
SPF
PassValid, soft failAnything not on the list is accepted but marked. Google recommends ~all; with DMARC enforced it is as strong as -all.
v=spf1 include:%{i}._ip.%{h}._ehlo.%{d}._spf.vali.email ~all
DKIM
Pass11 keys foundSelectors selector1, selector2, k1, k2, k3, kl, kl2, s1, s2, hs1, hs2 publish a public key. 11 of them point at a vendor by CNAME.
selector1._domainkey, selector2._domainkey, k1._domainkey, k2._domainkey, k3._domainkey, kl._domainkey, kl2._domainkey, s1._domainkey, s2._domainkey, hs1._domainkey, hs2._domainkey
DMARC
PassPartial (p=quarantine)Failing mail goes to spam. One step from full enforcement.
v=DMARC1; p=quarantine; rua=mailto:dmarc_agg@vali.email,mailto:valimailreports@autodesk.com; ruf=mailto:Nzk4Njk=@ruf.vali.email,mailto:valimailreports@autodesk.com; fo=1
MX
Pass1 hostOne host, but it is a provider endpoint that is redundant behind the name.
10 autodesk-com.mail.protection.outlook.com
MTA-STS
PassPublishedThe DNS record is present. The policy file at https://mta-sts.<domain>/.well-known/mta-sts.txt cannot be read from a browser, so its mode is not verified here.
v=STSv1; id=20260903111846Z;
TLS-RPT
PassPublishedTLS failure reports have somewhere to go.
v=TLSRPTv1; rua=mailto:tls-report@vali.email
BIMI
PassPublishedLogo record found and DMARC qualifies. Yahoo shows it from the record; Gmail and Apple Mail also need a VMC or CMC certificate (the a= tag).
v=BIMI1; l=https://amplify.valimail.com/bimi/autodesk/Ze9xPF_6DY9-autodesk_inc.svg; a=https://amplify.valimail.com/bimi/autodesk/Ze9xPF_6DY9-autodesk_inc.pem
DNSSEC
PassValidatedThe resolver validated the zone, so the records above cannot be silently swapped in transit.
2 · Tools visible in DNS
| Layer | Tool | Evidence |
|---|---|---|
| Mailbox | Microsoft 365 | MX autodesk-com.mail.protection.outlook.com |
| Marketing | Klaviyo | DKIM kl._domainkey |
| Marketing | Mailchimp | DKIM k1._domainkey → dkim.mcsv.net |
| Marketing | HubSpot | DKIM hs1._domainkey → autodesk-com.hs01a.dkim.hubspotemail.net |
| Transactional | SendGrid | DKIM kl._domainkey → kl.domainkey.u161779.wl030.sendgrid.net |
| DMARC reporting | Valimail | DMARC rua=mailto:…@vali.email |
Only tools that leave a DNS trace appear. A shared DKIM selector is attributed only when its CNAME target names the vendor.
3 · Sender requirements (Google, Yahoo, Microsoft)
| Requirement | Applies to | Status | Note |
|---|---|---|---|
| Authenticate with SPF or DKIM | GoogleYahooMicrosoft | Verified | At least one method is in place. |
| Bulk senders: both SPF and DKIM | GoogleYahoo | Verified | Both are present. |
| Publish a DMARC record (p=none is enough) | GoogleYahooMicrosoft | Verified | Policy is p=quarantine. |
| From: domain aligns with SPF or DKIM | GoogleYahooMicrosoft | Not checkable here | Needs a real message. The Send-a-Test report will check this. |
| Valid forward and reverse DNS for sending IPs | GoogleYahoo | Not checkable here | Depends on the sending server, not the domain. |
| Encrypt in transit (TLS) | GoogleYahoo | Verified | MTA-STS shows inbound TLS is required; outbound depends on your sending tool. |
| One-click unsubscribe (RFC 8058) for marketing mail | GoogleYahoo | Not checkable here | A message header, not a DNS record. Microsoft recommends it rather than requiring it. |
| Spam complaint rate under 0.1% (0.3% is the hard limit) | GoogleYahoo | Not checkable here | Read it in Google Postmaster Tools and Yahoo Sender Hub. Google’s target is 0.1%; 0.3% is where enforcement starts. |
4 · What to fix, in order
-
P2
Finish DMARC at p=reject
Quarantine still delivers spoofed mail, just into spam.
Publish at_dmarc.autodesk.comv=DMARC1; p=reject; rua=mailto:dmarc@autodesk.com; fo=1
Appendix · Raw DNS answers
| Name | Type | Answer |
|---|---|---|
| autodesk.com | MX | 10 autodesk-com.mail.protection.outlook.com |
| autodesk.com | A | 23.21.189.113 50.19.149.4 |
| autodesk.com | TXT | v=spf1 include:%{i}._ip.%{h}._ehlo.%{d}._spf.vali.email ~all (+ 70 other TXT records: site-verification tokens and the like, omitted) |
| _dmarc.autodesk.com | TXT | v=DMARC1; p=quarantine; rua=mailto:dmarc_agg@vali.email,mailto:valimailreports@autodesk.com; ruf=mailto:Nzk4Njk=@ruf.vali.email,mailto:valimailreports@autodesk.com; fo=1 |
| <selector>._domainkey.autodesk.com | TXT | selector1 → CNAME selector1-autodesk-com._domainkey.autodesk.onmicrosoft.com selector2 → CNAME selector2-autodesk-com._domainkey.autodesk.onmicrosoft.com k1 → CNAME dkim.mcsv.net k2 → CNAME dkim2.mcsv.net k3 → CNAME dkim3.mcsv.net kl → CNAME kl.domainkey.u161779.wl030.sendgrid.net kl2 → CNAME kl2.domainkey.u161779.wl030.sendgrid.net s1 → CNAME s1.domainkey.u7507473.wl224.sendgrid.net s2 → CNAME s2.domainkey.u7507473.wl224.sendgrid.net hs1 → CNAME autodesk-com.hs01a.dkim.hubspotemail.net hs2 → CNAME autodesk-com.hs01b.dkim.hubspotemail.net |
| _mta-sts.autodesk.com | TXT | v=STSv1; id=20260903111846Z; |
| _smtp._tls.autodesk.com | TXT | v=TLSRPTv1; rua=mailto:tls-report@vali.email |
| default._bimi.autodesk.com | TXT | v=BIMI1; l=https://amplify.valimail.com/bimi/autodesk/Ze9xPF_6DY9-autodesk_inc.svg; a=https://amplify.valimail.com/bimi/autodesk/Ze9xPF_6DY9-autodesk_inc.pem |