Email and website security check: example-client.com
Sample from a real check, contact details replaced.
Checked 2026-11-12 02:37 UTC from public DNS and one HTTPS connection, the same view any mail server or browser has. No access to your accounts was used.
Summary: 4 item(s) to fix or review.
| Area | Status | What we found |
|---|---|---|
| SPF | OK | 0 issue(s), 2 pass |
| DKIM | OK | 0 issue(s), 1 pass |
| DMARC | Fix | 1 issue(s), 1 pass |
| MX / MTA-STS / TLS-RPT | Optional | 2 issue(s), 1 pass |
| Website TLS + headers | Fix | 1 issue(s), 2 pass |
SPF
- Published:
v=spf1 mx include:_spf.example-mailhost.net include:spf.protection.outlook.com -all - ✅ 7 of 10 DNS lookups used.
- ✅ Ends in -all.
DKIM
- Selector
dkim - ✅ Keys found: dkim.
DMARC
- Published:
v=DMARC1; p=none; rua=mailto:reports@example.com - ✅ Aggregate reports go to mailto:reports@example.com.
- ❌ p=none: monitoring only. Spoofed mail using this domain is still delivered.
MX / MTA-STS / TLS-RPT
- Published:
0 mx1.example-mailhost.net. - ✅ 1 MX record(s).
- ❌ No MTA-STS (optional): incoming mail can be downgraded to unencrypted by an attacker on the path.
- ❌ No TLS-RPT (optional): you get no reports when other servers fail to deliver to you over TLS.
Website TLS + headers
- Certificate: issuer Let's Encrypt, expires 2026-12-29 (47 days), names: example-client.com
- Protocols accepted: TLS 1.0 no, TLS 1.1 no, TLS 1.2 yes, TLS 1.3 yes
- HSTS:
max-age=31536000 - Content-Security-Policy: missing
- X-Content-Type-Options:
nosniff - X-Frame-Options:
SAMEORIGIN - Referrer-Policy:
strict-origin-when-cross-origin - Permissions-Policy: missing
- Cross-Origin-Opener-Policy: missing
- Cross-Origin-Resource-Policy: missing
- ✅ Certificate valid and chain trusted (issuer Let's Encrypt), expires 2026-12-29 (47 days).
- ✅ http:// redirects to https:// (308).
- ❌ 4 of 8 security headers missing: Content-Security-Policy, Permissions-Policy, Cross-Origin-Opener-Policy, Cross-Origin-Resource-Policy.
Exact changes to make
DMARC (TXT at _dmarc.example-client.com), after reports show every sender passing
v=DMARC1; p=quarantine; rua=mailto:reports@example.com; fo=1
Then p=reject once quarantine has run clean for 2 weeks.
TLS-RPT (TXT at _smtp._tls.example-client.com)
v=TLSRPTv1; rua=mailto:reports@example.com
Optional, safe to add any time.
Nginx (server block); Apache/Cloudflare equivalents in the delivery notes
add_header Content-Security-Policy-Report-Only "default-src 'self'; frame-ancestors 'self'" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
add_header Cross-Origin-Opener-Policy "same-origin" always;
add_header Cross-Origin-Resource-Policy "same-origin" always;
CSP can break pages: ship it as Report-Only first.
After the fix
We re-run this same check and send one live test message, then read its headers (spf=, dkim=, dmarc= results as the receiving server recorded them). If the re-test still fails, you don't pay.