Blog
Contact
Sign in
Scan complete
E
51/100
charewicz.net
1 critical issue needs immediate attention.
16/16
checks
26
passed
finished
Scan timestamps
Created
Oct 8, 2026, 9:16 AM
Started
Oct 8, 2026, 9:16 AM
Finished
Oct 8, 2026, 9:16 AM
Updated
Oct 8, 2026, 9:16 AM
Export PDF
Re-scan
Findings by severity
34 results
1
Critical
4
High
1
Medium
2
Low
26
Pass
Report coverage
61.03%
1 couldn’t be evaluated · 60 skipped - these limit completeness.
1 error
60 skipped
All
95
Critical
1
High
4
Medium
1
Low
2
Pass
26
Error
1
Skipped
60
Email
96%
Sender Authentication (SPF)
Learn how it works
Info
6/7 pass
Sender Authentication (SPF)
SPF policy does not use strict fail mode
The SPF policy does not fully reject unauthorized senders.
Medium
Domain Alignment (DMARC)
Learn how it works
Info
0/7 pass
Domain Alignment (DMARC)
No DMARC record found
The domain does not publish a DMARC policy.
High
Certificate Binding (DANE)
Learn how it works
Info
1/5 pass
Certificate Binding (DANE)
No MX host TLSA zone is protected by DNSSEC
None of the MX hosts have DNSSEC on their TLSA lookup zones. DANE SMTP cannot function without DNSSEC, as sending servers will ignore TLSA records from unsigned zones.
Critical
Transport Policy (MTA-STS)
Learn how it works
Info
1/6 pass
Transport Policy (MTA-STS)
MTA-STS DNS record is missing
The domain does not publish an MTA-STS TXT record, so sending servers cannot discover or enforce an MTA-STS policy.
High
TLS Reporting (TLS-RPT)
Learn how it works
Info
1/4 pass
TLS Reporting (TLS-RPT)
No TLS-RPT record found
The domain does not publish a TLS-RPT record. Sending servers cannot report TLS errors to this domain.
High
DNS
100%
DNS Integrity (DNSSEC)
Learn how it works
Info
0/7 pass
DNS Integrity (DNSSEC)
DNSSEC is misconfigured (broken chain of trust)
The domain publishes DNSKEY records but the parent zone has no DS record, so the chain of trust is broken and validators treat the zone as insecure.
High
DNS Health (Delegation & Exposure)
Learn how it works
Info
7/8 pass
DNS Health (Delegation & Exposure)
SOA serial does not use the recommended format
The SOA record is otherwise valid, but the serial number does not follow the recommended YYYYMMDDnn date format.
Low
CAA and Certificate Issuance Surface
Learn how it works
Info
1/6 pass
CAA and Certificate Issuance Surface
No CAA record is published
The domain does not publish a CAA record, so any publicly trusted certificate authority may issue certificates for it after standard validation.
Low
Web
Disclosure Policy (security.txt)
Learn how it works
Info
0/4 pass
Disclosure Policy (security.txt)
security.txt could not be retrieved
The security.txt endpoint could not be reached due to a network, TLS, or DNS error.
Doesn’t affect score · lowers coverage
Error
Feedback
