Deliverability and security
These records are published in public DNS, so you can check every one yourself. The status page re-checks the live host every 5 minutes.
Sender authentication
| Mechanism | Published setting |
|---|
| SPF | v=spf1 ip4:45.61.56.219 -all: only this host may send for cbmoon.com, and everything else fails. |
| DKIM | 2048-bit RSA key at s1._domainkey.cbmoon.com. Every outgoing message is signed. |
| DMARC | p=reject with strict alignment (adkim=s; aspf=s). Unauthenticated mail claiming to be from cbmoon.com should be rejected. |
| Reverse DNS | Forward DNS mx.cbmoon.com → 45.61.56.219. Matching reverse DNS (PTR) is requested from the network provider. |
Transport security
| Item | Setting |
|---|
| STARTTLS | Offered on port 25 with a publicly trusted Let's Encrypt certificate for mx.cbmoon.com, renewed automatically. |
| MTA-STS | Policy published at mta-sts.cbmoon.com/.well-known/mta-sts.txt. It currently runs in testing mode while TLS reports are reviewed, and will move to enforce. |
| TLS reporting | _smtp._tls.cbmoon.com: reports go to tlsrpt@cbmoon.com. |
| Outbound TLS | Outgoing mail uses TLS with every receiving server that offers it. |
| Website | HTTPS only, with HSTS. No cookies, no scripts, no third-party resources. |
Access
- Mailbox (IMAP) access and the management interface listen only on a private network. They are not reachable from the public internet.
- Administrative access is restricted to the operator.
- Submission from outside is not offered, so the host cannot be used as a relay.
Check it yourself
dig +short TXT cbmoon.com
dig +short TXT s1._domainkey.cbmoon.com
dig +short TXT _dmarc.cbmoon.com
dig +short TXT _mta-sts.cbmoon.com
openssl s_client -starttls smtp -connect mx.cbmoon.com:25 -servername mx.cbmoon.com