Skip to content
← New scan

archaius.net

Scanned 7/8/2026, 6:19:38 PM

Email security grade

/ 100

A few gaps still let attackers forge or snoop on your email.

Safer than 45% of the domains we've scanned.

Fix these first

  1. 1Can your email be tampered with in transit?Publish DKIM keys for the selectors your mail provider uses. Most providers (Google, Microsoft 365, Mailchimp, etc.) publish setup instructions when you add your domain.Check DKIM →
  2. 2Is the email people send you encrypted?Publish an MTA-STS DNS record at `_mta-sts.<your-domain>` (`v=STSv1; id=<unique-id>`) and serve a policy at `https://mta-sts.<your-domain>/.well-known/mta-sts.txt`. Start with `mode: testing`, then promote to `mode: enforce`.Set up MTA-STS →
  3. 3Content-Security-PolicyAdopt a baseline CSP. At minimum: `default-src 'self'; object-src 'none'; base-uri 'self'`. Tighten from there.
Protected

Can someone send email as archaius.net?

Your domain is protected from impersonation

An enforcing DMARC policy plus working SPF/DKIM means receivers will reject or quarantine mail that forges your domain.

What continuous monitoring would catch

What changes on archaius.net would you want to know about?

These are examples built from your live results — your setup passes these today. A one-time scan can't tell you if any of them slip later. Starter re-checks archaius.net every day and emails you the moment one does.

  • ExampleIf — SPF is now failing

    e.g. PASS → FAIL — Review your SPF record — confirm every legitimate sender is included and you're within the 10 DNS-lookup limit.

    Fix now → Analyze & fix SPF
  • ExampleIf — DMARC policy is now failing

    e.g. quarantine → none — Restore DMARC enforcement (p=quarantine or p=reject) so spoofed mail is rejected, not just monitored.

    Fix now → Build a DMARC record

Daily re-checks + instant drift alerts on one domain — Starter.

Watch archaius.net for $19/mo →

Save this report for archaius.net

Create a free account to save this report and get your step-by-step fix-it checklist.

Track it free →

The full breakdown

pass

Can strangers send email as you?

SPF

100/100

SPF lists which servers are allowed to send mail from your domain. Without it, anyone can forge your address in phishing emails.

Technical evidence
{
  "record": "v=spf1 include:spf.protection.outlook.com -all",
  "mechanisms": [
    "v=spf1",
    "include:spf.protection.outlook.com",
    "-all"
  ],
  "lookupCount": 1,
  "disagreement": false,
  "exceedsLookupLimit": false,
  "lookupMechanismCount": 1
}
fail

Can your email be tampered with in transit?

DKIM

0/100

DKIM signs your messages so receivers can tell a genuine email from a forged or altered copy.

What to do: Publish DKIM keys for the selectors your mail provider uses. Most providers (Google, Microsoft 365, Mailchimp, etc.) publish setup instructions when you add your domain.

Technical evidence
{
  "message": "No DKIM records found at any common selector. The domain may use a custom selector this probe doesn't know about, or DKIM may genuinely be unconfigured.",
  "probedSelectors": [
    "google",
    "selector1",
    "selector2",
    "k1",
    "k2",
    "s1",
    "s2",
    "mandrill",
    "default",
    "dkim",
    "mail",
    "smtp"
  ]
}
pass

Are forged emails actually getting blocked?

DMARC

80/100

DMARC tells inboxes to reject mail that fails your checks — the difference between stopping impersonation and just hoping.

What to do: Once you've confirmed no legitimate mail is being quarantined, tighten the policy to `p=reject`.

Technical evidence
{
  "pct": 100,
  "tags": {
    "p": "quarantine",
    "v": "DMARC1",
    "fo": "1",
    "sp": "quarantine",
    "rua": "mailto:[email protected]"
  },
  "policy": "quarantine",
  "record": "v=DMARC1; p=quarantine; sp=quarantine; rua=mailto:[email protected]; fo=1",
  "disagreement": false,
  "subdomainPolicy": "quarantine"
}
warn

Is your email delivery set up correctly?

MX

70/100

MX records point the world to your mail servers. Mistakes here can silently drop or delay your email.

What to do: Only one MX record found. Add at least one backup MX with a higher priority value for redundancy.

Technical evidence
{
  "records": [
    {
      "exchange": "archaius-net.mail.protection.outlook.com",
      "priority": 0
    }
  ],
  "disagreement": false
}
fail

Is the email people send you encrypted?

MTA-STS

0/100

MTA-STS forces other servers to use encryption when they email you, so messages can't be quietly downgraded or intercepted.

What to do: Publish an MTA-STS DNS record at `_mta-sts.<your-domain>` (`v=STSv1; id=<unique-id>`) and serve a policy at `https://mta-sts.<your-domain>/.well-known/mta-sts.txt`. Start with `mode: testing`, then promote to `mode: enforce`.

Technical evidence
{
  "dnsAnyOk": false,
  "dnsDisagreement": false
}
warn

Would you hear about mail-delivery failures?

TLS-RPT

50/100

TLS-RPT sends you a report when someone can't deliver mail to you securely — an early warning before customers notice.

What to do: Publish a TLS-RPT record at `_smtp._tls.<your-domain>` so SMTP servers can report TLS connection failures back to you.

Technical evidence
{
  "reason": "no DNS response"
}
info

Does your logo show up next to your emails?

BIMI

0/100

BIMI displays your verified logo in the inbox — a trust signal customers notice, and proof your DMARC is enforced.

What to do: BIMI is optional — it lets your brand logo appear in supporting inboxes. Requires DMARC at p=quarantine or stronger.

Technical evidence
{
  "reason": "no DNS response"
}
warn

Can someone hijack your domain's DNS?

DNSSEC

30/100

DNSSEC stops attackers from forging DNS answers to reroute your email or website to themselves.

What to do: DNSSEC is not enabled for this domain. Enable it at your DNS provider — most major providers (Cloudflare, Route 53, Google Cloud DNS) offer one-click DNSSEC. After enabling, paste the DS records into your registrar.

Technical evidence
{
  "adFlag": false,
  "resolverResults": {
    "google": {
      "AD": false,
      "CD": false,
      "RA": true,
      "RD": true,
      "TC": false,
      "Answer": [
        {
          "TTL": 3600,
          "data": "31.43.160.6",
          "name": "archaius.net.",
          "type": 1
        },
        {
          "TTL": 3600,
          "data": "31.43.161.6",
          "name": "archaius.net.",
          "type": 1
        }
      ],
      "Status": 0,
      "Comment": "Response from 173.201.71.14.",
      "Question": [
        {
          "name": "archaius.net.",
          "type": 1
        }
      ]
    },
    "cloudflare": {
      "AD": false,
      "CD": false,
      "RA": true,
      "RD": true,
      "TC": false,
      "Answer": [
        {
          "TTL": 3600,
          "data": "31.43.161.6",
          "name": "archaius.net",
          "type": 1
        },
        {
          "TTL": 3600,
          "data": "31.43.160.6",
          "name": "archaius.net",
          "type": 1
        }
      ],
      "Status": 0,
      "Question": [
        {
          "name": "archaius.net",
          "type": 1
        }
      ]
    }
  }
}
info

TLS posture

TLS posture

97/100

Technical evidence
{
  "cipher": "TLS_AES_128_GCM_SHA256",
  "issuer": "YE1",
  "validTo": "2026-09-04T04:12:21.000Z",
  "protocol": "TLSv1.3",
  "subChecks": [
    {
      "name": "chain",
      "score": 100,
      "detail": "Chain validates against Node's CA bundle.",
      "status": "pass"
    },
    {
      "name": "expiry",
      "score": 100,
      "detail": "Certificate valid for another 57 days (until 2026-09-04T04:12:21.000Z).",
      "status": "pass"
    },
    {
      "name": "protocol",
      "score": 100,
      "detail": "Negotiated TLSv1.3 — modern and forward-secret.",
      "status": "pass"
    },
    {
      "name": "publickey",
      "score": 100,
      "detail": "EC 256 bits — strong, compact.",
      "status": "pass"
    },
    {
      "name": "sigalg",
      "score": 70,
      "detail": "Couldn't determine signature algorithm.",
      "status": "info"
    }
  ],
  "chainTrusted": true
}
fail

Security headers

Security headers

50/100

What to do: Frame protection: Send CSP `frame-ancestors 'self'` or X-Frame-Options: DENY. · Referrer-Policy: Set `Referrer-Policy: strict-origin-when-cross-origin` (the modern default). · Permissions-Policy: Send `Permissions-Policy: geolocation=(), camera=(), microphone=()` if your app doesn't use them. · Server identification: Strip or generalize Server / X-Powered-By in your reverse proxy.

Technical evidence
{
  "url": "https://www.archaius.net/",
  "subChecks": [
    {
      "name": "hsts",
      "score": 80,
      "detail": "max-age=31536000, includeSubDomains=false, preload=false",
      "status": "pass",
      "observedValue": "max-age=31536000"
    },
    {
      "name": "x-content-type-options",
      "score": 100,
      "detail": "nosniff prevents MIME-type confusion attacks.",
      "status": "pass",
      "observedValue": "nosniff"
    },
    {
      "name": "frame-options",
      "score": 0,
      "detail": "Page can be embedded in arbitrary iframes (clickjacking risk).",
      "status": "fail",
      "observedValue": null
    },
    {
      "name": "referrer-policy",
      "score": 30,
      "detail": "No policy — browsers will send full Referer cross-origin.",
      "status": "warn",
      "observedValue": null
    },
    {
      "name": "permissions-policy",
      "score": 0,
      "detail": "No Permissions-Policy. Modern browsers default-deny most powerful APIs, but explicit policy is safer.",
      "status": "info",
      "observedValue": null
    },
    {
      "name": "server-leakage",
      "score": 70,
      "detail": "Server software version is advertised. Low risk on its own, but useful intel for attackers.",
      "status": "info",
      "observedValue": "Server: Framer/1a1b925"
    }
  ],
  "httpStatus": 200
}
fail

Content-Security-Policy

Content-Security-Policy

0/100

What to do: Adopt a baseline CSP. At minimum: `default-src 'self'; object-src 'none'; base-uri 'self'`. Tighten from there.

Technical evidence
{
  "url": "https://www.archaius.net/",
  "detail": "No CSP. The browser will execute any script the page asks it to.",
  "observedValue": null
}

Share this report

Anyone with this link can view the results — no login required.

Get a PDF copy

We'll email you a printable PDF of this report.