{"domain":"example.com","timestamp":"2026-09-13T04:15:07.239Z","resolver":"Google Public DNS","score":76,"maxScore":100,"percentage":76,"grade":"C","gradeInfo":{"grade":"C","label":"Average","color":"text-yellow-600","bgColor":"bg-yellow-500","description":"Adequate security, improvements recommended"},"categories":{"dns":{"score":55,"maxScore":65,"percentage":85,"status":"pass","checks":[{"id":"has_a_record","name":"A record present","passed":true,"score":10,"maxScore":10,"details":"2 A record(s) found","severity":"critical"},{"id":"has_aaaa_record","name":"AAAA record present","passed":true,"score":15,"maxScore":15,"details":"2 AAAA record(s) found","severity":"recommended"},{"id":"has_mx_record","name":"MX records present","passed":true,"score":10,"maxScore":10,"details":"1 MX record(s) found","severity":"recommended"},{"id":"has_ns_record","name":"NS records present","passed":true,"score":10,"maxScore":10,"details":"2 NS record(s) found","severity":"critical"},{"id":"has_soa_record","name":"SOA record present","passed":true,"score":5,"maxScore":5,"details":"SOA record found","severity":"critical"},{"id":"multiple_ns","name":"Multiple nameservers","passed":true,"score":5,"maxScore":5,"details":"2 nameservers configured ✓","severity":"recommended"},{"id":"soa_format","name":"SOA serial format","passed":true,"score":0,"maxScore":0,"details":"Serial 2413856909 (valid, managed DNS format)","severity":"info"},{"id":"soa_timers","name":"SOA timers valid","passed":true,"score":0,"maxScore":0,"details":"Refresh: 10000s ✓, Retry: 2400s ✓, Expire: 604800s ✓","severity":"info"},{"id":"no_lame_ns","name":"No lame nameservers","passed":true,"score":0,"maxScore":0,"details":"2 NS all responding ✓","severity":"info"},{"id":"glue_records","name":"Glue records present","passed":true,"score":0,"maxScore":0,"details":"No glue needed","severity":"info"},{"id":"www_record","name":"WWW record configured","passed":true,"score":0,"maxScore":0,"details":"A record matches apex","severity":"info"},{"id":"mx_ptr","name":"MX servers have PTR records","passed":false,"score":0,"maxScore":5,"details":"No MX records to check","severity":"recommended"},{"id":"mx_fcrdns","name":"MX servers have FCrDNS","passed":false,"score":0,"maxScore":5,"details":"No MX IPs to check","severity":"recommended"}]},"dnssec":{"score":145,"maxScore":145,"percentage":100,"status":"pass","checks":[{"id":"dnssec_signed","name":"DNSSEC signed","passed":true,"score":50,"maxScore":50,"details":"DNSSEC is enabled ✓","severity":"recommended"},{"id":"dnssec_valid","name":"DNSSEC validation OK","passed":true,"score":50,"maxScore":50,"details":"DNSSEC validates correctly ✓","severity":"critical"},{"id":"nsec3_rfc9276","name":"NSEC3 RFC 9276 compliant","passed":true,"score":10,"maxScore":10,"details":"Not applicable (domain uses NSEC or is not DNSSEC-signed)","severity":"recommended"},{"id":"rrsig_not_expiring","name":"RRSIG signatures valid","passed":true,"score":5,"maxScore":5,"details":"RRSIG signature expires in 1 days — renewal needed","severity":"recommended"},{"id":"dnssec_modern_algorithm","name":"Modern DNSSEC algorithm","passed":true,"score":5,"maxScore":5,"details":"ECDSA P-256 (algorithm 13) — modern ✓","severity":"optional"},{"id":"ds_digest_modern","name":"DS digest algorithm modern","passed":true,"score":5,"maxScore":5,"details":"DS digest: SHA-256 — modern ✓","severity":"recommended"},{"id":"dnskey_algo_secure","name":"DNSKEY algorithm secure","passed":true,"score":5,"maxScore":5,"details":"DNSKEY: ECDSA P-256 — modern ✓","severity":"optional"},{"id":"rrsig_ttl_safe","name":"RRSIG TTL safe","passed":true,"score":5,"maxScore":5,"details":"Record TTLs do not exceed RRSIG validity periods ✓","severity":"recommended"},{"id":"chain_of_trust_complete","name":"Chain of trust complete","passed":true,"score":10,"maxScore":10,"details":"Cryptographic chain validated to the root trust anchor with local BIND delv ✓","severity":"critical"}]},"ipv6":{"score":70,"maxScore":70,"percentage":100,"status":"pass","checks":[{"id":"ipv6_website","name":"Website reachable via IPv6","passed":true,"score":40,"maxScore":40,"details":"2 AAAA record(s) ✓","severity":"recommended"},{"id":"ipv6_mail","name":"Mail servers publish IPv6","passed":true,"score":0,"maxScore":0,"details":"Not applicable: the domain publishes an RFC 7505 Null MX and does not accept email","severity":"info"},{"id":"ipv6_nameservers","name":"Nameservers reachable via IPv6","passed":true,"score":30,"maxScore":30,"details":"2/2 NS server(s) with IPv6 ✓","severity":"recommended"}]},"email":{"score":145,"maxScore":190,"percentage":76,"status":"warning","checks":[{"id":"spf_exists","name":"SPF record present","passed":true,"score":15,"maxScore":15,"details":"v=spf1 -all","severity":"critical"},{"id":"spf_valid","name":"SPF syntax valid","passed":true,"score":10,"maxScore":10,"details":"SPF syntax is correct ✓","severity":"critical"},{"id":"spf_strict","name":"SPF policy strict (-all)","passed":true,"score":10,"maxScore":10,"details":"SPF uses -all (hard fail) ✓","severity":"recommended"},{"id":"dkim_found","name":"DKIM found","passed":true,"score":20,"maxScore":20,"details":"DKIM selector: default ✓","severity":"recommended"},{"id":"dmarc_exists","name":"DMARC record present","passed":true,"score":15,"maxScore":15,"details":"v=DMARC1;p=reject;sp=reject;adkim=s;aspf=s","severity":"recommended"},{"id":"dmarc_quarantine","name":"DMARC policy quarantine or better","passed":true,"score":10,"maxScore":10,"details":"DMARC policy: reject ✓","severity":"recommended"},{"id":"dmarc_reject","name":"DMARC policy reject","passed":true,"score":20,"maxScore":20,"details":"DMARC policy: reject ✓","severity":"optional"},{"id":"bimi_exists","name":"BIMI record present","passed":false,"score":0,"maxScore":5,"details":"No BIMI record. Add TXT at default._bimi with logo URL (requires DMARC p=quarantine+)","severity":"optional"},{"id":"bimi_valid","name":"BIMI configuration valid","passed":false,"score":0,"maxScore":5,"details":"No BIMI configured","severity":"optional"},{"id":"mta_sts_exists","name":"MTA-STS record present","passed":false,"score":0,"maxScore":5,"details":"No MTA-STS. Add TXT at _mta-sts and host policy at /.well-known/mta-sts.txt","severity":"optional"},{"id":"mta_sts_enforced","name":"MTA-STS policy enforced","passed":false,"score":0,"maxScore":10,"details":"MTA-STS not configured","severity":"optional"},{"id":"mx_valid","name":"MX records valid","passed":true,"score":0,"maxScore":0,"details":"Null MX (0 .) — domain explicitly receives no mail (RFC 7505). Not applicable","severity":"info"},{"id":"mx_dnssec_signed","name":"MX domains use DNSSEC","passed":false,"score":0,"maxScore":10,"details":"No MX domains to check","severity":"recommended"},{"id":"mx_dnssec_valid","name":"MX DNSSEC validation OK","passed":false,"score":0,"maxScore":10,"details":"No MX domains to check","severity":"recommended"},{"id":"not_blacklisted","name":"Mail servers not blacklisted","passed":true,"score":25,"maxScore":25,"details":"No MX servers to check","severity":"critical"},{"id":"no_critical_blacklist","name":"No critical blacklist listings","passed":true,"score":20,"maxScore":20,"details":"No blacklist listings ✓","severity":"critical"}]},"security":{"score":75,"maxScore":235,"percentage":32,"status":"fail","checks":[{"id":"has_caa","name":"CAA records present","passed":false,"score":0,"maxScore":10,"details":"No CAA records. Add CAA record to specify allowed certificate authorities","severity":"recommended"},{"id":"caa_strict","name":"CAA policy strict","passed":false,"score":0,"maxScore":10,"details":"CAA not strict. Add CAA 0 issue \"letsencrypt.org\" (or your CA) to restrict issuance","severity":"optional"},{"id":"has_tlsa","name":"TLSA records (DANE)","passed":false,"score":0,"maxScore":20,"details":"No TLSA/DANE records. Add TLSA at _25._tcp.mail for DANE email encryption","severity":"optional"},{"id":"tlsa_valid","name":"DANE configuration valid","passed":false,"score":0,"maxScore":15,"details":"No DANE configured","severity":"optional"},{"id":"no_txt_leakage","name":"No sensitive info in TXT","passed":true,"score":20,"maxScore":20,"details":"No sensitive data leaked ✓","severity":"critical"},{"id":"verification_records_review","name":"Verification records reviewed","passed":true,"score":5,"maxScore":5,"details":"No third-party verification records found ✓","severity":"info"},{"id":"https_available","name":"HTTPS available","passed":true,"score":25,"maxScore":25,"details":"HTTPS working (status 200) ✓","severity":"critical"},{"id":"valid_certificate","name":"Valid certificate","passed":true,"score":25,"maxScore":25,"details":"Certificate chain is valid and trusted ✓","severity":"critical"},{"id":"https_redirect","name":"HTTP redirects to HTTPS","passed":false,"score":0,"maxScore":15,"details":"HTTP does not redirect to HTTPS. Add redirect in web server config","severity":"critical"},{"id":"hsts_enabled","name":"HSTS enabled","passed":false,"score":0,"maxScore":15,"details":"No HSTS header. Add Strict-Transport-Security header with max-age of at least 31536000 (1 year)","severity":"recommended"},{"id":"hsts_long_max_age","name":"HSTS max-age >= 1 year","passed":false,"score":0,"maxScore":10,"details":"HSTS not enabled","severity":"optional"},{"id":"x_frame_options","name":"X-Frame-Options header","passed":false,"score":0,"maxScore":10,"details":"No X-Frame-Options header. Add X-Frame-Options: DENY or SAMEORIGIN to prevent clickjacking","severity":"recommended"},{"id":"x_content_type_options","name":"X-Content-Type-Options header","passed":false,"score":0,"maxScore":10,"details":"No X-Content-Type-Options header. Add X-Content-Type-Options: nosniff to prevent MIME sniffing","severity":"recommended"},{"id":"content_security_policy","name":"Content-Security-Policy header","passed":false,"score":0,"maxScore":15,"details":"No Content-Security-Policy header. Add CSP to prevent XSS and other injection attacks","severity":"recommended"},{"id":"referrer_policy","name":"Referrer-Policy header","passed":false,"score":0,"maxScore":10,"details":"No Referrer-Policy header. Add Referrer-Policy: strict-origin-when-cross-origin","severity":"recommended"},{"id":"security_txt_exists","name":"security.txt present","passed":false,"score":0,"maxScore":5,"details":"No security.txt. Create /.well-known/security.txt with Contact and Expires fields (RFC 9116)","severity":"optional"},{"id":"security_txt_valid","name":"security.txt valid","passed":false,"score":0,"maxScore":5,"details":"No security.txt configured","severity":"optional"},{"id":"http3_supported","name":"HTTP/3 (QUIC) supported","passed":false,"score":0,"maxScore":5,"details":"No HTTP/3 support detected\n\nNo h3 in Alt-Svc header\nHTTPS DNS record exists but no h3 ALPN\nQUIC probe inconclusive (Inconclusive - no QUIC reply (trigger may be dropped or UDP/443 filtered)) — not a negative signal","severity":"optional"},{"id":"http3_quic_reachable","name":"QUIC UDP reachable","passed":true,"score":0,"maxScore":0,"details":"QUIC probe inconclusive (no reply — trigger may be dropped or UDP/443 filtered). Not a negative signal; h3 is judged from Alt-Svc / HTTPS record","severity":"info"},{"id":"https_dns_record","name":"HTTPS DNS record (SVCB)","passed":false,"score":0,"maxScore":5,"details":"HTTPS record found but no h3 ALPN (h2)","severity":"optional"}]}},"issues":[{"citationUrl":"https://intodns.ai/citations/email-authentication-best-practices","apiUrl":"https://intodns.ai/api/scan/quick?domain=example.com","id":"mx_ptr_missing","severity":"warning","category":"dns","title":"Mail server reverse DNS missing","description":"One or more MX server IPs do not have a PTR record. Mail receivers treat missing reverse DNS as a deliverability risk.","fixable":true},{"citationUrl":"https://intodns.ai/citations/how-to-check-domain-email-security","apiUrl":"https://intodns.ai/api/dns/lookup?type=CAA&domain=example.com","id":"no_caa","severity":"warning","category":"security","title":"No CAA records","description":"CAA records determine which Certificate Authorities may issue SSL certificates","fixable":true},{"citationUrl":"https://intodns.ai/citations/how-to-check-domain-email-security","apiUrl":"https://intodns.ai/api/scan/quick?domain=example.com","id":"no_http3","severity":"info","category":"security","title":"No HTTP/3 (QUIC) support","description":"HTTP/3 uses QUIC for faster, more resilient connections. Enable it on your web server and open UDP/443 in your firewall","fixable":true}],"recommendations":[{"citationUrl":"https://intodns.ai/citations/email-authentication-best-practices","apiUrl":"https://intodns.ai/api/scan/quick?domain=example.com","id":"mx_ptr_missing","priority":5,"title":"Configure reverse DNS for mail servers","description":"Ask the owner of each mail server IP address to set a PTR record, for example 203.0.113.10 -> mail.yourdomain.com.","impact":"Improves mail-server trust signals and reduces deliverability risk"},{"citationUrl":"https://intodns.ai/citations/how-to-check-domain-email-security","apiUrl":"https://intodns.ai/api/dns/lookup?type=CAA&domain=example.com","id":"no_caa","priority":6,"title":"Add CAA records","description":"Define which Certificate Authorities may issue SSL certificates, for example: \"0 issue letsencrypt.org\"","impact":"Prevents unauthorized certificate issuance"},{"citationUrl":"https://intodns.ai/citations/how-to-check-domain-email-security","apiUrl":"https://intodns.ai/api/scan/quick?domain=example.com","id":"no_http3","priority":10,"title":"Enable HTTP/3 (QUIC)","description":"Enable HTTP/3 for faster page loads and improved connection resilience.\n\nNginx: add \"listen 443 quic reuseport;\" and \"add_header Alt-Svc 'h3=\":443\"; ma=86400'\".\nCaddy: HTTP/3 is enabled by default.\nCloudflare: Enable under Speed → Protocol Optimization.\n\nAlso add an HTTPS DNS record: example.com IN HTTPS 1 . alpn=\"h3,h2\"\nEnsure UDP port 443 is open in your firewall (QUIC uses UDP, not TCP).","impact":"Faster page loads (0-RTT), better mobile performance, and connection migration between networks"}],"domainInfo":{"apexDomain":"example.com","isSubdomain":false},"mailInheritedFromApex":false}