Lab report — email & DNSscan/juniorsproductco.tech

juniorsproductco.tech

Scanned Sep 30, 2026 04:07 UTC · 7 checks · public report

Health grade

Solid base — two policy steps remain.

BGrade B

2 warnings3 passing2 not checkedNot-checked is by design — details inline below.

In one line

Can juniorsproductco.tech be spoofed?

juniorsproductco.tech publishes DMARC with p=none — spoofed mail is monitored but not blocked.

WarningSPF

Finding 01

SPF ends in '~all' (softfail) rather than '-all' — acceptable for DMARC (non-pass either way); hardening to '-all' is optional and only safe once every legitimate sender is in the record

4 of 10 DNS lookups used

AI explanation

Your SPF check is using a soft fail at the end, which means mail from servers not listed can still be treated as suspicious instead of being fully blocked. This is usually okay for DMARC, but it is a little less strict and can leave room for spoofed mail to slip through. The fix is to change the SPF policy to a hard fail only after you are sure every legitimate sender is already included.

Current SPF

v=spf1 include:spf.titan.email ~all

All findings — worst first

WarningDMARCDMARC is recorded but p=none (monitoring only — no protection)
Start monitoring juniorsproductco.tech →
- no enforcement record is recommended yet — a scan alone could not confirm that your mail aligns (valid SPF and a DKIM signature), and moving off p=none without that evidence risks silently blocking legitimate mail. Gather aggregate-report evidence first, then step up: evidence before enforcement
- p=none only monitors — it does not block spoofing
- pct= is deprecated by RFC 9989; receivers ignore it — remove it at your next DNS edit
- no rua= tag: you receive no aggregate reports to measure alignment
- no np= tag: non-existent subdomains fall back to sp/p — RFC 9989 §4.7's np=reject can protect them now
- publish a rua= reporting address so receivers send you aggregate reports — the reports are the only evidence that can unlock a stricter policy
AI explanation
Your domain has DMARC set up, but it is only monitoring messages and not blocking anything. That means fake or spoofed email using your domain may still get through, which can hurt trust and deliverability. To fix it, change DMARC from monitoring mode to a protective policy so failed mail is rejected or quarantined instead of just reported.

Email me this report

One send: the full report — every finding and fix — lands in your inbox, with a free account waiting. Opening it signs you in and starts a 14-day Monitor trial. No card, and you can unsubscribe in one click.

Domain owner? Re-scan any time — or email hello@dnsdoctor.dev to have this page removed.

Running your DNS diagnostic…

Can juniorsproductco.tech be spoofed?

SPF ends in '~all' (softfail) rather than '-all' — acceptable for DMARC (non-pass either way); hardening to '-all' is optional and only safe once every legitimate sender is in the record

All findings — worst first