orange.com email security: SPF, DKIM & DMARC

Is orange.com spoofable? See orange.com's SPF, DKIM, DMARC and MTA-STS records and find out if this domain is protected against email spoofing.

Last updated: June 3, 2026

73B

This domain is vulnerable to spoofing

SPF

v=spf1 include:spffed-ip.orange.com include:spffed-mm.orange.com include:_spf1.orange.com include:_spf2.orange.com include:spfe.orange.com include:spff.orange.com include:spf6a.orange.com -all

DKIM

Selectors: cm

DMARC

Warning

v=DMARC1; p=none; sp=none; pct=100; fo=1; ri=3600; rua=mailto:rua.dmarc@orange.com; ruf=mailto:ruf.dmarc@orange.com;

Read the guide

MX

smtp-ina.orange.com, smtp-inb.orange.com

MTA-STS

Missing

No record found

Read the guide

Recommendations

1Change your DMARC policy from p=none to p=reject to block spoofing
With p=none, your DMARC record only monitors — it doesn't actually block spoofed emails. Attackers can still send emails as your domain and they'll be delivered normally. Switching to p=reject instructs receiving servers to drop fraudulent messages before they reach the inbox.
2Add MTA-STS to enforce TLS encryption for incoming emails
Without MTA-STS, an attacker performing a man-in-the-middle attack can downgrade the connection between mail servers to plaintext, intercepting emails in transit. MTA-STS tells sending servers to only deliver via TLS with a valid certificate, preventing downgrade attacks.

Need help securing your domain?

If you're not sure how to apply these fixes, get in touch and we'll help you out.

Run a live analysis

The results above are updated daily. For an instant check of orange.com, run a live analysis.

Analyze orange.com live

Frequently asked questions about orange.com

Is orange.com spoofable?

Yes. orange.com does not enforce a strong DMARC policy, so attackers may be able to send emails that appear to come from orange.com. Email security score: 73/100 (grade B).