All findings — worst first

• !WarningDMARCDMARC is published but p=none (monitoring only — no protection)

  Start monitoring tokenvisor.ai →

  • no enforcement record is recommended yet — a scan alone could not confirm that your mail aligns (valid SPF and a DKIM signature), and moving off p=none without that evidence risks silently blocking legitimate mail. Gather aggregate-report evidence first, then step up: evidence before enforcement
  • p=none only monitors — it does not block spoofing
  • no rua= tag: you receive no aggregate reports to measure alignment
  • no np= tag: non-existent subdomains fall back to sp/p — RFC 9989 §4.7's np=reject can protect them now
  • publish a rua= reporting address so receivers send you aggregate reports — the reports are the only evidence that can unlock a stricter policy

  AI explanation

  DMARC is set up, but it is only watching email and not enforcing any action on messages that fail the check. That means spoofed or fake emails using your domain may still get through, which can hurt your brand and make phishing easier. The fix is to change DMARC from monitoring-only to a stricter policy so receiving mail servers can reject or quarantine suspicious mail.

Domain owner? Re-scan any time — or email hello@dnsdoctor.dev to have this page removed.