DMARC is missing or at p=none on the checked domain.
Spoofed mail can look like it came from your domain.
AI agents checking your public footprint
fixture.example
Score dial, findings grouped by category, then Close it or Monitor — demo uses fixture data when live APIs are absent.
85/ 100
Category
Mail authentication
2 findings
SPF allows a broad include chain; softfail is not enforced.
Forged envelopes may still be accepted by some receivers.
Category
Web posture
1 finding
HSTS is not advertised on the homepage response.
First visits can stay on cleartext HTTP longer than needed.
Category
Attack surface
1 finding
Certificate transparency lists a staging hostname still resolving.
Forgotten hosts are common entry points for credential stuffing.
Category
Look-alike domains
1 finding
A typo permutation of the domain has an MX record.
Look-alike mail can phish staff or customers.
Category
Visible emails
1 finding
A role inbox is exposed in public HTML footer markup.
Role addresses attract spam and social-engineering probes.
What this check did not do
- Demo fixture for /results — public-signal style only; no live probe and no paid breach API.
- Directional check only; not a security guarantee or investigative dossier.
Directional public-signal check by STARTEND GmbH, Switzerland · not a security guarantee · Imprint