Every check, and what it means

Email authentication

• MX present — whether the domain receives mail. Informational; it changes how we read the other email findings.
• SPF present — a record listing who may send as this domain.
• SPF duplicates — two v=spf1 records is a permanent error and disables SPF entirely.
• SPF lookup count — we follow every include: and redirect= and count the DNS lookups. Over ten and receivers return permerror, so SPF stops protecting the domain while still looking correct in the DNS panel.
• SPF all mechanism — +all authorises the entire internet and is worse than no record.
• DMARC present / policy / reporting / subdomain — whether a policy exists, whether it is actually enforcing, whether reports are collected, and whether subdomains are exempted.
• DKIM — we probe twenty selectors used by the major mail platforms. A custom selector cannot be discovered from outside, so a negative result here is reported as "not found", not "absent".
• MTA-STS and TLS-RPT — protection against an attacker stripping encryption from inbound mail.

Certificates and encryption

• HTTPS available, expiry (escalating inside 30 / 14 / 7 days), chain trust, hostname coverage, and obsolete protocol support (TLS 1.0 / 1.1).

DNS and domain

• DNSSEC, nameserver redundancy, CAA records, and **dangling records that allow subdomain takeover**.

Subdomain takeover deserves a note: we check a fixed list of common hostnames for CNAMEs pointing

at third-party services, and we only report a takeover when the service itself responds saying

the resource no longer exists. An unreachable host is ambiguous and we do not report it. A false

takeover claim in a client-facing report is far more damaging than a missed one.

Website hardening

• HTTP to HTTPS redirect, HSTS (including a max-age that is long enough to matter), Content Security Policy, clickjacking protection, MIME sniffing protection, Referrer-Policy, and cookie Secure / HttpOnly flags.

Exposed surface

• Server version disclosure and CMS identification run on any scan, from the homepage.
• Exposed configuration files — .env, .git/config, database dumps, phpinfo, debug logs, server-status, and directory listings — run only on verified domains.

Every one of those probes confirms content before reporting: we do not report an exposed .env

because a request returned 200, only when the response actually looks like an environment file.

This keeps soft-404 pages out of client reports.