Blog
Contact
Sign in
Scan complete
F
45/100
stop-scrolling.pl
11 high-risk issues to fix.
16/16
checks
27
passed
finished
Scan timestamps
Created
Jul 22, 2026, 8:11 AM
Started
Jul 22, 2026, 8:11 AM
Finished
Jul 22, 2026, 8:11 AM
Updated
Jul 22, 2026, 8:11 AM
Export PDF
Re-scan
Findings by severity
47 results
0
Critical
11
High
5
Medium
4
Low
27
Pass
Report coverage
87.73%
48 skipped - these limit completeness.
48 skipped
All
95
High
11
Medium
5
Low
4
Pass
27
Skipped
48
Email
69%
Sender Authentication (SPF)
Learn how it works
Info
0/7 pass
Sender Authentication (SPF)
No SPF record found
The domain does not publish an SPF policy.
High
Domain Alignment (DMARC)
Learn how it works
Info
0/7 pass
Domain Alignment (DMARC)
No DMARC record found
The domain does not publish a DMARC policy.
High
Transport Encryption (SMTP TLS)
Learn how it works
Info
0/5 pass
Transport Encryption (SMTP TLS)
Mail servers are unreachable
No mail exchanger for the domain accepts SMTP connections on port 25, so inbound mail cannot be delivered.
High
Certificate Binding (DANE)
Learn how it works
Info
0/5 pass
Certificate Binding (DANE)
Mail servers are unreachable
No mail exchanger for the domain accepts SMTP connections on port 25, so inbound mail cannot be delivered.
High
Mail Servers (MX)
Learn how it works
Info
0/4 pass
Mail Servers (MX)
No MX records found
The domain does not publish MX records. Sending MTAs fall back to the A record, which is not a substitute for a proper MX configuration.
High
Mail Servers (MX)
Mail servers are unreachable
No mail exchanger for the domain accepts SMTP connections on port 25, so inbound mail cannot be delivered.
High
Transport Policy (MTA-STS)
Learn how it works
Info
0/6 pass
Transport Policy (MTA-STS)
Mail servers are unreachable
No mail exchanger for the domain accepts SMTP connections on port 25, so inbound mail cannot be delivered.
High
Transport Policy (MTA-STS)
MTA-STS DNS record is missing
The domain does not publish an MTA-STS TXT record, so sending servers cannot discover or enforce an MTA-STS policy.
High
TLS Reporting (TLS-RPT)
Learn how it works
Info
0/4 pass
TLS Reporting (TLS-RPT)
Mail servers are unreachable
No mail exchanger for the domain accepts SMTP connections on port 25, so inbound mail cannot be delivered.
High
TLS Reporting (TLS-RPT)
No TLS-RPT record found
The domain does not publish a TLS-RPT record. Sending servers cannot report TLS errors to this domain.
High
DNS
100%
DNS Integrity (DNSSEC)
Learn how it works
Info
0/7 pass
DNS Integrity (DNSSEC)
DNSSEC is not enabled
The parent zone does not publish a DS record for this domain.
Medium
DNS Health (Delegation & Exposure)
Learn how it works
Info
7/8 pass
DNS Health (Delegation & Exposure)
SOA serial does not use the recommended format
The SOA record is otherwise valid, but the serial number does not follow the recommended YYYYMMDDnn date format.
Low
CAA and Certificate Issuance Surface
Learn how it works
Info
1/6 pass
CAA and Certificate Issuance Surface
No CAA record is published
The domain does not publish a CAA record, so any publicly trusted certificate authority may issue certificates for it after standard validation.
Low
TLS
100%
TLS Configuration
Learn how it works
Info
5/6 pass
TLS Configuration
TLS 1.3 early data (0-RTT) enabled
The server accepts 0-RTT early data. Requests sent as early data can be replayed by an attacker without detection unless the application implements its own anti-replay protection. This is safe only for idempotent requests.
Low
Web
100%
Disclosure Policy (security.txt)
Learn how it works
Info
0/4 pass
Disclosure Policy (security.txt)
security.txt is not present or not usable
The domain does not publish a usable security.txt file. Either both /.well-known/security.txt and /security.txt returned no file (404/401/403/410), or the location responded with HTTP 200 but non-text/plain content (typically an application page) or a body that is not valid UTF-8.
Medium
HTTP Security Headers
Learn how it works
Info
2/7 pass
HTTP Security Headers
HSTS max-age is too short
The site sends Strict-Transport-Security, but max-age is below the recommended 6-month (15768000 second) minimum, so browsers stop enforcing HTTPS sooner than recommended.
Medium
HTTP Security Headers
Content-Security-Policy is weak and bypass-prone
The CSP allows inline script execution without a nonce or hash, a wildcard or http:/data: script source, or does not restrict script sources at all. Such policies are commonly reported as bypassable in independent CSP research.
High
HTTP Security Headers
Referrer-Policy is not declared
The site does not send a Referrer-Policy header. Modern browsers default to a reasonably safe behavior, but the site does not explicitly guarantee it.
Medium
HTTP Security Headers
Permissions-Policy is missing or ineffective
The site either does not send a Permissions-Policy header, or the header only lists directives with a wildcard allowlist that does not restrict anything.
Medium
HTTP Security Headers
Deprecated security headers are present
The response sends one or more deprecated headers (X-XSS-Protection, Expect-CT, or Public-Key-Pins) that modern browsers ignore or that carry their own operational risk (HPKP).
Low
Feedback
