Blog
Contact
Sign in
Scan complete
D
64/100
dns.pl
Changed · score unchanged
Compare
1 critical issue needs immediate attention.
10/10
checks
30
passed
finished
Scan timestamps
Created
Jul 13, 2026, 9:28 AM
Started
Jul 13, 2026, 9:28 AM
Finished
Jul 13, 2026, 9:28 AM
Updated
Jul 13, 2026, 9:28 AM
Export PDF
Re-scan
Findings by severity
37 results
1
Critical
4
High
0
Medium
2
Low
30
Pass
Report coverage
97%
16 skipped - these limit completeness.
16 skipped
All
53
Critical
1
High
4
Low
2
Pass
30
Skipped
16
Email
96%
Domain Alignment (DMARC)
Learn how it works
Info
3/7 pass
Domain Alignment (DMARC)
DMARC policy is monitoring only
The DMARC policy uses p=none and does not ask receivers to block or quarantine failing mail.
High
Domain Alignment (DMARC)
DMARC subdomain policy is weak
Subdomains are not protected by an enforcement policy.
High
Domain Alignment (DMARC)
DMARC alignment is relaxed
The DMARC record allows relaxed identifier alignment for DKIM or SPF.
Low
Certificate Binding (DANE)
Learn how it works
Info
1/5 pass
Certificate Binding (DANE)
No MX host TLSA zone is protected by DNSSEC
None of the MX hosts have DNSSEC on their TLSA lookup zones. DANE SMTP cannot function without DNSSEC, as sending servers will ignore TLSA records from unsigned zones.
Critical
Transport Policy (MTA-STS)
Learn how it works
Info
1/6 pass
Transport Policy (MTA-STS)
MTA-STS DNS record is missing
The domain does not publish an MTA-STS TXT record, so sending servers cannot discover or enforce an MTA-STS policy.
High
TLS Reporting (TLS-RPT)
Learn how it works
Info
1/4 pass
TLS Reporting (TLS-RPT)
No TLS-RPT record found
The domain does not publish a TLS-RPT record. Sending servers cannot report TLS errors to this domain.
High
DNS
100%
DNS Integrity (DNSSEC)
Learn how it works
Info
5/6 pass
DNS Integrity (DNSSEC)
Some DS records do not match DNSKEY records
DNSSEC has at least one valid DS/DNSKEY path, but some DS records appear to be stale.
Low
Feedback
