All findings — worst first

• !WarningDMARCDMARC is recorded but p=none (monitoring only — no protection)

  Start monitoring hadafsolutions.com →

  • no enforcement record is recommended yet — a scan alone could not confirm that your mail aligns (valid SPF and a DKIM signature), and moving off p=none without that evidence risks silently blocking legitimate mail. Gather aggregate-report evidence first, then step up: evidence before enforcement
  • p=none only monitors — it does not block spoofing
  • no rua= tag: you receive no aggregate reports to measure alignment
  • no np= tag: non-existent subdomains fall back to sp/p — RFC 9989 §4.7's np=reject can protect them now
  • publish a rua= reporting address so receivers send you aggregate reports — the reports are the only evidence that can unlock a stricter policy

  AI explanation

  DMARC is set up, but it is only in monitoring mode, so it does not actually block spoofed or fake emails. This matters because attackers can still pretend to send mail from your domain, which can hurt trust and increase phishing risk. The fix is to change DMARC from monitoring-only to an enforcement mode so suspicious messages are rejected or sent to spam.

Domain owner? Re-scan any time — or email hello@dnsdoctor.dev to have this page removed.