Security Brief
Acme Dental
acme.com
email spoofing not blocked
If these items were fixed
Fix these 5 items to move from C to A.
This is a projection from the same scoring used on this brief, assuming the listed fail and warning checks would pass. It is not a guarantee.
acme.com received grade C (61/100). This brief lists every issue this scan recorded, starting with DMARC (email spoofing protection).
HTTPS redirect: Visitors are sent to the locked connection.
Email that can be impersonated
What this means: Public mail records for this domain are missing or weak, so outsiders can more easily send messages that look like they came from the company.
Why it matters: Staff and vendors often act on email that appears to come from a known name. Tightening these records makes fake invoices and fake password resets harder to pull off. This is a configuration gap, not evidence that anyone has already been impersonated.
No DMARC record is published for this domain.
The SPF record ends in a soft fail, so unauthorized senders are still accepted.
Domain and certificate controls
What this means: Public DNS settings that help prove this site is genuine are missing, or the domain registration is close to expiring.
Why it matters: A lapsed domain or missing issuance controls can let someone else put up a lookalike site. Renewing on time and locking who may issue certificates are routine maintenance, not a claim that a lookalike exists today.
DNSSEC is not enabled on this domain.
No CAA record limits who may issue certificates.
Website visitor protections
What this means: The public homepage is missing basic protections visitors expect: a forced locked connection, a healthy certificate, or standard browser security headers.
Why it matters: Customers and partners look for a locked connection before they type anything in. These are fixable website settings. This brief does not claim the site has been broken into.
The homepage is missing HSTS.
Client Posture only reports what is visible on the public internet. Items we could not confirm are not scored and are not listed as problems.
Not tested — a deeper review covers these
These controls sit inside the business. A deeper review from your IT provider can cover them.
- Multi-factor authentication
Whether staff use MFA on email, remote access, or admin logins cannot be seen from public DNS or the homepage.
- Backups and restore tests
Backup systems and restore tests are internal. They do not show on the public internet.
- Endpoint detection and response
EDR and 24/7 monitoring live on devices, not on public DNS.
- Patching and supported systems
Internal servers and workstations — and whether they are patched — are not visible from a homepage visit.
- Separate administrator accounts
How admin access is separated inside email and cloud accounts cannot be seen from outside.
- Device encryption
Laptop and phone encryption cannot be observed from public data.
- Security awareness training
Staff training is a process, not a public record.
- Incident response plan
Written plans and tabletop tests are internal.
- Payment-change verification
How invoice and bank-detail changes are confirmed is an internal process.
These items are not failures. Public DNS and the homepage cannot prove them, so they are listed as things to confirm and improve.
No extra strengthening opportunities were visible from public DNS on this scan.
These are the services we typically use to close the gaps above. This is not a quote. Prices are discussed separately.
Email security setup (SPF, DKIM, DMARC, filtering)
Set up or tighten email authentication and filtering so outsiders cannot easily send mail that looks like yours.
Covers: DMARC (email spoofing protection), SPF (authorized email senders)
Website & domain security fixes
Fix public website encryption, headers, and domain settings that visitors and mail systems rely on.
Covers: DNSSEC (protection against fake sites), Security headers, CAA (certificate issuance control)
For your IT person
Technical evidence and recommended configuration changes. Share this section with whoever manages email, DNS, and the website.
DMARC (email spoofing protection)
Evidence. No TXT record at _dmarc.acme.com
Fix. Publish a DMARC record in Monitoring Mode (p=none with rua), then raise policy with t=y.
SPF (authorized email senders)
Evidence. v=spf1 include:_spf.google.com ~all
Fix. Tighten the SPF record to ~all or -all after listing every legitimate sender.
DNSSEC (protection against fake sites)
Evidence. No DS record
Fix. Turn on DNSSEC at the registrar.
CAA (certificate issuance control)
Evidence. No CAA record
Fix. Add a CAA record naming your certificate issuer.
Security headers
Evidence. HSTS missing
Fix. Add Strict-Transport-Security on the homepage.
Northwind IT can walk you through these findings, make the configuration changes, and re-check the public posture so you can see the grade move.
Contact Northwind IT
This Security Brief is based on publicly observable configuration of acme.com as of Oct 8, 2026. It is not a penetration test and does not claim that a breach has occurred.
Put your name on a brief like this.
Scan any prospect domain. Send the Security Brief under your logo. You'll know when they open it. Quote the fixes on Pro.