Email spoofing and DNS you never configured
SPF, DMARC, CAA, and the dangling subdomain someone can claim.
Every guide in this topic
Can anyone send email that looks like it came from your domain?
Without an SPF record, a scammer can email your customers as you and it lands in the inbox. How spoofing works, how to check, and the one line that fixes it.
Your DMARC says p=none. Do you know what that allows?
p=none watches spoofed mail go out and does nothing to stop it. What the policy really means, why most domains get stuck here, and how to move to enforcement.
What is subdomain takeover, and is one of yours dangling right now?
A forgotten subdomain pointing at a dead service is a hostile page in your name. How dangling CNAME takeover works, where they hide, and how to check.
Why a missing CAA record lets the wrong authority issue your certs
Without a CAA record, any certificate authority on earth can mint a valid TLS cert for your domain. What CAA does, why it matters, and the one line to add.
Your robots.txt is telling crawlers exactly where /admin lives
Disallow: /admin doesn't hide your admin panel. It points right at it. What robots.txt is really for, what attackers read it for, and how to fix it.
MTA-STS and TLS-RPT: the email-in-transit protection you probably skipped
SPF and DMARC stop spoofing, but not a network attacker downgrading your inbound mail to plaintext. MTA-STS and TLS-RPT do. What they are, how to check, and how to publish them.
Your SPF record exists, but does it actually work? The errors that silently switch it off
An SPF record can be present and still enforce nothing: two records, more than ten lookups, dead includes. Each one is a permerror that makes receivers ignore your SPF entirely. The silent failure modes, and how to fix them.
Dead MX, private IPs, dangling nameservers: the DNS records pointing at nothing
DNS records that point at hosts which no longer exist are more than tidiness, a dead MX drops mail and invites impersonation, a private IP in public DNS leaks your internal layout, a dangling nameserver is a takeover risk. The pointers-to-nothing, explained.
One of your nameservers doesn't exist. Who answers for your domain now?
A delegated nameserver that no longer resolves is a DNS-takeover gap sitting in your zone, not a typo. How dangling NS delegation works, two real examples from sites we scanned, and how to check yours from outside.
Your DMARC says p=reject. Then sp=none reopens the door.
DMARC sp=none and pct<100 leave a record that reads p=reject wide open on subdomains and on most failing mail. The two tags a quick read skips, and how to close them.
Your DMARC reports go to a vendor. Did the vendor agree to receive them?
When DMARC rua points at a third-party domain, RFC 7489 requires that domain to publish an authorization record, or receivers silently send nothing. The reporting gap that leaves you blind, and the one DNS record that fixes it.
Your DKIM key is published in DNS. How many bits is it?
A DKIM signing key under 1024 bits is factorable, and a factored key lets an attacker sign mail as you that passes DKIM and your own DMARC. The key's size is published in DNS for anyone to read. How to check it from outside.
Your domain says it's DNSSEC-signed. Validating resolvers say it's broken.
A domain that publishes a DS record but fails DNSSEC validation goes dark for everyone behind a validating resolver, while you still reach it. The signed-but-broken outage, and how to spot it.
Find it before someone else does.
Paste your domain. The grade and issue count are free, and you'll see in a couple of minutes exactly what's reachable from outside.
External, read-only scan. We only request public URLs - never log in, never send attack traffic.