Lab report — email & DNSscan/ultimo.pl

ultimo.pl

Scanned Sep 15, 2026 10:58 UTC · 7 checks · public report

Health grade

Solid base — two policy steps remain.

BGrade B

2 warnings3 passing2 not checkedNot-checked is by design — details inline below.

In one line

Can ultimo.pl be spoofed?

ultimo.pl publishes DMARC with p=none — spoofed mail is monitored but not blocked.

WarningSPF

Finding 01

SPF ends in '~all' (softfail) rather than '-all' — acceptable for DMARC (non-pass either way); hardening to '-all' is optional and only safe once every legitimate sender is in the record

2 of 10 DNS lookups used

AI explanation

Your SPF setup is working, but it ends with a softer “fail” setting, which means some unauthorized mail may be treated less strictly than it could be. This matters because SPF helps other mail systems decide whether messages from your domain are legitimate, reducing spoofing and junk-mail risk. The only change here is optional hardening: switch to the stricter ending after you’ve confirmed every real sender is included.

Current SPF

v=spf1 mx ip4:89.25.237.232 ip4:89.25.237.233 ip4:208.73.7.100 ip4:208.73.7.101 ip4:208.73.7.102 ip4:208.73.7.103 ip4:208.73.7.104 ip4:91.216.16.205 include:spf.protection.outlook.com ~all

Edit your SPF record at Cloudflare — step-by-step guide.

All findings — worst first

WarningDMARCDMARC is recorded but p=none (monitoring only — no protection)
Start monitoring ultimo.pl →
- no enforcement record is recommended yet — a scan alone could not confirm that your mail aligns (valid SPF and a DKIM signature), and moving off p=none without that evidence risks silently blocking legitimate mail. Gather aggregate-report evidence first, then step up: evidence before enforcement
- p=none only monitors — it does not block spoofing
- no np= tag: non-existent subdomains fall back to sp/p — RFC 9989 §4.7's np=reject can protect them now
AI explanation
Your domain has DMARC set up, but it is only in monitoring mode, so it is not actively blocking spoofed or fake emails yet. This matters because attackers can still use your domain name in phishing emails, which can hurt trust and deliverability. The fix is to change DMARC from monitoring-only to an enforcing policy so receiving mail servers are instructed to reject or quarantine messages that fail authentication.
Current DMARC

Email me this report

One send: the full report — every finding and fix — lands in your inbox, with a free account waiting. Opening it signs you in and starts a 14-day Monitor trial. No card, and you can unsubscribe in one click.

Domain owner? Re-scan any time — or email [email protected] to have this page removed.

Running your DNS diagnostic…

Can ultimo.pl be spoofed?

SPF ends in '~all' (softfail) rather than '-all' — acceptable for DMARC (non-pass either way); hardening to '-all' is optional and only safe once every legitimate sender is in the record

All findings — worst first