DMARC is missing or at p=none on the checked domain.
Spoofed mail can look like it came from your domain.
Sample scan · fictional company
Nordlicht Sample AG
Complete example result for nordlicht-sample.example — score 0–1000, findings by category, Close it actions, and a monitoring subscribe offer. Fixture only; no live probe.
850/ 1000
Category
Mail authentication
2 findings
SPF allows a broad include chain; softfail is not enforced.
Forged envelopes may still be accepted by some receivers.
Category
Web posture
1 finding
HSTS is not advertised on the homepage response.
First visits can stay on cleartext HTTP longer than needed.
Category
Attack surface
1 finding
Certificate transparency lists a staging hostname still resolving.
Forgotten hosts are common entry points for credential stuffing.
Category
Look-alike domains
1 finding
A typo permutation of the domain has an MX record.
Look-alike mail can phish staff or customers.
Category
Visible emails
1 finding
A role inbox is exposed in public HTML footer markup.
Role addresses attract spam and social-engineering probes.
Monitoring upsell
Keep watching this footprint
Weekly re-scan · alert only on new appearances · full fix plan · 7 days free, then CHF 49/month — cancel anytime.
What this check did not do
- Sample demo for a fictional company — public-signal style only; no live probe and no paid breach API.
- Directional check only; not a security guarantee or investigative dossier.
Directional public-signal sample by STARTEND GmbH, Switzerland · fictional company · not a security guarantee · Imprint