Public email posture · checked 2026-09-23

hicloudcam.com: DMARC, SPF and MX report

What public DNS says about how hicloudcam.com authenticates and routes email — read the way a receiving mail server reads it, with every change recorded since 2026-09-22.

grade C · monitoring only or weak SPFTranco rank 251 snapshot
Observed configurationPublic DNS only. Nothing here required access to hicloudcam.com.
DMARCp=none
SPF-all
SPF lookups6/10
MX3
DKIM selectors0
MTA-STSno
RecordValue
MX5 mxn.mxhichina.com · 10 mx01.dm.aliyun.com · 10 mxw.mxhichina.com
SPFv=spf1 include:spfdm-ap-southeast-1.aliyun.com include:spf.mxhichina.com -all
DMARCv=DMARC1; p=none; rua=mailto:dmarc_agg@ibesecurity.com;
DKIM selectorsnone of the common names resolve
MTA-STS / TLS-RPT / BIMIno / no / no
Providersinbound: Self-hosted or other
Nameserversdns13.hichina.com, dns14.hichina.com
Run a live DMARC checkBuild the digital twinLive tools re-query DNS now; this report is the 2026-09-23 snapshot.

What this configuration means

Each section below is shown because the observed records match its condition. The explanations are reviewed text selected by the data, not generated from it.

DMARC is in monitoring mode

The effective policy for hicloudcam.com is p=none. Receivers evaluate alignment and send aggregate reports to the address in the record, yet they take no action on failures. Monitoring is the correct first stage; it becomes a gap when it lasts indefinitely, because spoofed mail is still delivered. Moving to quarantine and then reject, once reports show every legitimate sender aligns, is what turns the record into protection.

No common DKIM selectors found

None of the selector names commonly used by major platforms resolve under _domainkey.hicloudcam.com. DKIM has no enumeration mechanism, so the domain may sign with a selector this check does not try; absence here is not proof that DKIM is unused. It does mean no platform with a conventional selector is publicly visible.

No transport-security policy

hicloudcam.com does not publish MTA-STS, so senders negotiate TLS opportunistically and fall back to clear text if an attacker strips the upgrade. Publishing TLS-RPT first, then MTA-STS in testing mode, adds transport protection for inbound mail without risk to delivery.

Change history

No change has been observed since the first snapshot on 2026-09-22. The domain is re-checked regularly and a new entry appears here when any record above changes.

How to read this report

The grade summarizes two records only: A means an enforcing DMARC policy with SPF hard fail; B enforcing DMARC with SPF; C monitoring-only DMARC or a weak SPF qualifier; D one of SPF or DMARC missing; F neither published. It is a prioritization aid for the public control plane, not a statement about deliverability, reputation or the security of the organization behind the domain.

DMARC policy is discovered with the RFC 9989 DNS tree walk, so a subdomain with no record of its own is reported with the organizational policy it inherits. DKIM selectors are discovered from common names only; a domain may sign with selectors this check does not try. Everything on this page comes from public DNS as observed on 2026-09-23; caches and split-horizon DNS can show different values elsewhere.

If you operate hicloudcam.com and want a record corrected or the report removed, contact Mailybox.