Lab report — email & DNSscan/twistedlemon.com.au

twistedlemon.com.au

Scanned Oct 12, 2026 15:36 UTC · 7 checks · public report

Health grade

Solid base — two policy steps remain.

BGrade B

2 warnings4 passing1 not checkedNot-checked is by design — details inline below.

In one line

Can twistedlemon.com.au be spoofed?

twistedlemon.com.au publishes DMARC with p=none — spoofed mail is monitored but not blocked.

WarningSPF

Finding 01

SPF ends in '~all' (softfail) rather than '-all' — acceptable for DMARC (non-pass either way); hardening to '-all' is optional and only safe once every legitimate sender is in the record

7 of 10 DNS lookups used

AI explanation

Your SPF setting is currently in a softer mode, which means other mail servers are told to treat unauthorized senders as suspicious but not to reject them outright. This still works for DMARC, but it is less strict and can let some spoofed mail through. If you want stronger protection, the fix is to change the ending to a hard fail only after you have confirmed that every legitimate system sending email for your domain is already included.

Current SPF

v=spf1 +a +mx +include:spf.ax.email ~all

All findings — worst first

WarningDMARCDMARC is recorded but p=none (monitoring only — no protection)
Start monitoring twistedlemon.com.au →
- no enforcement record is recommended yet — a scan alone could not confirm that your mail aligns (valid SPF and a DKIM signature), and moving off p=none without that evidence risks silently blocking legitimate mail. Gather aggregate-report evidence first, then step up: evidence before enforcement
- p=none only monitors — it does not block spoofing
- no rua= tag: you receive no aggregate reports to measure alignment
- publish a rua= reporting address so receivers send you aggregate reports — the reports are the only evidence that can unlock a stricter policy
AI explanation
DMARC is set up, but it is only in monitoring mode, so fake or spoofed emails using your domain may still get through. This matters because it leaves your domain more exposed to phishing and email impersonation. The fix is to change DMARC from monitoring to an enforcement setting so mail that fails authentication is rejected or quarantined.
Current DMARC

Email me this report

One send: the full report — every finding and fix — lands in your inbox, with a free account waiting. Opening it signs you in and starts a 14-day Monitor trial. No card, and you can unsubscribe in one click.

Domain owner? Re-scan any time — or email hello@dnsdoctor.dev to have this page removed.

Running your DNS diagnostic…

Can twistedlemon.com.au be spoofed?

SPF ends in '~all' (softfail) rather than '-all' — acceptable for DMARC (non-pass either way); hardening to '-all' is optional and only safe once every legitimate sender is in the record

All findings — worst first