Lab report — email & DNSscan/remax.net

remax.net

Scanned Sep 23, 2026 01:51 UTC · 7 checks · public report

Health grade

Solid base — two policy steps remain.

BGrade B

2 warnings4 passing1 not checkedNot-checked is by design — details inline below.

In one line

Can remax.net be spoofed?

remax.net publishes DMARC with p=none — spoofed mail is monitored but not blocked.

WarningSPF

Finding 01

SPF ends in '~all' (softfail) rather than '-all' — acceptable for DMARC (non-pass either way); hardening to '-all' is optional and only safe once every legitimate sender is in the record

10 of 10 DNS lookups used

AI explanation

Your SPF check is using a “soft fail” ending, which means mail that is not on the approved sender list is treated more gently instead of being clearly rejected. This still works with DMARC, but it is a little less strict, so it can be easier for spoofed mail to slip through. If you want tighter protection, the fix is to switch the SPF policy to a hard fail only after you have confirmed every legitimate service that sends mail for your domain is included.

Current SPF

v=spf1 include:amazonses.com include:sendgrid.net include:cvent-planner.com include:spf.securence.com include:cust-spf.exacttarget.com include:_s0.remax.net ~all

Edit your SPF record at Amazon Route 53 — step-by-step guide.

All findings — worst first

WarningDMARCDMARC is recorded but p=none (monitoring only — no protection)
Start monitoring remax.net →
- no enforcement record is recommended yet — a scan alone could not confirm that your mail aligns (valid SPF and a DKIM signature), and moving off p=none without that evidence risks silently blocking legitimate mail. Gather aggregate-report evidence first, then step up: evidence before enforcement
- p=none only monitors — it does not block spoofing
- no np= tag: non-existent subdomains fall back to sp/p — RFC 9989 §4.7's np=reject can protect them now
AI explanation
Your domain has DMARC set up, but it is only in monitoring mode, so it is not actively stopping spoofed or fake emails using your domain. This matters because scammers can still send mail that looks like it came from you, which can hurt trust and deliverability. The fix is to change DMARC from monitoring-only to an enforcement policy so failing messages are handled instead of just reported.
Current DMARC

Email me this report

One send: the full report — every finding and fix — lands in your inbox, with a free account waiting. Opening it signs you in and starts a 30-day Monitor trial. No card, and you can unsubscribe in one click.

Domain owner? Re-scan any time — or email hello@dnsdoctor.dev to have this page removed.

Running your DNS diagnostic…

Can remax.net be spoofed?

SPF ends in '~all' (softfail) rather than '-all' — acceptable for DMARC (non-pass either way); hardening to '-all' is optional and only safe once every legitimate sender is in the record

All findings — worst first