Recommendations

1. 1Upgrade your DMARC policy from p=quarantine to p=reject for full blocking▾

   With p=quarantine, spoofed emails are sent to spam instead of being blocked outright. Some recipients still check spam folders, and sophisticated attacks can be flagged as legitimate by users. p=reject ensures fraudulent emails never reach any folder.

2. 2Switch your MTA-STS policy from testing to enforce mode▾

   In testing mode, MTA-STS only reports TLS failures without blocking delivery. Switching to enforce mode ensures that emails are only delivered over encrypted connections, providing real protection against interception.