Prepared for Acme Dental
Security Posture Report
acme-dental.example
email spoofing not blocked
Executive Summary
What looks good: HTTPS redirect; TLS certificate.
WHAT THIS MEANS
acme-dental.example has a strong external posture (grade B, 80/100). The highest-value improvement is DMARC (email spoofing protection).
Without DMARC, anyone can send email that looks like it came from Acme Dental. That is how phishing and invoice fraud usually start.
Their SPF record effectively allows any server to send as the practice. Attackers can abuse that trust.
The website is missing basic browser protections. That makes session theft and clickjacking easier than they need to be.
Without DMARC, anyone can send email that looks like it came from Acme Dental. That is how phishing and invoice fraud usually start.
Evidence: No DMARC record found at _dmarc.acme-dental.example
Recommended fix: Publish a DMARC record in Monitoring Mode (p=none with rua), then raise to quarantine/reject with t=y once reports look clean.
Their SPF record effectively allows any server to send as the practice. Attackers can abuse that trust.
Evidence: v=spf1 +all (overly permissive)
Recommended fix: Replace +all with ~all or -all and list only the mail services Acme Dental actually uses.
The website is missing basic browser protections. That makes session theft and clickjacking easier than they need to be.
Evidence: Missing: Content-Security-Policy, Strict-Transport-Security, X-Frame-Options
Recommended fix: Add HSTS, CSP, and clickjacking protections on the public website and patient portal.
DNSSEC is off, so a network attacker could redirect visitors to a fake lookalike site more easily.
Evidence: DNSSEC not enabled for acme-dental.example
Recommended fix: Enable DNSSEC at the DNS host so DNS answers cannot be quietly swapped in transit.
Old staging and portal hostnames are still visible publicly. Forgotten subdomains are a common way attackers get a foothold.
Evidence: Public CT logs list unused hosts: old-portal.acme-dental.example, staging.acme-dental.example
Recommended fix: Decommission unused subdomains or put them behind authentication and monitoring.
Any certificate authority could issue a TLS cert for this domain. CAA locks that down to the ones you trust.
Evidence: No CAA records published
Recommended fix: Publish CAA records that allow only your chosen certificate authority.
These items are not failures. Public DNS and the homepage cannot prove them, so they are listed as things to confirm and improve.
Public records show room to tighten email authentication reporting: DMARC reports are not being sent anywhere; no BIMI logo is published. Confirm the current setup with your IT provider before changing production mail.
What this means: DMARC reporting, encrypted-delivery policy, or a verified brand logo can be tightened without treating the current setup as a failure.
Client Posture only reports what is visible on the public internet. Items we could not confirm are not scored and are not listed as problems.
Not tested — a deeper review covers these
These controls sit inside the business. A deeper review from your IT provider can cover them.
- Multi-factor authentication
Whether staff use MFA on email, remote access, or admin logins cannot be seen from public DNS or the homepage.
- Backups and restore tests
Backup systems and restore tests are internal. They do not show on the public internet.
- Endpoint detection and response
EDR and 24/7 monitoring live on devices, not on public DNS.
- Patching and supported systems
Internal servers and workstations — and whether they are patched — are not visible from a homepage visit.
- Separate administrator accounts
How admin access is separated inside email and cloud accounts cannot be seen from outside.
- Device encryption
Laptop and phone encryption cannot be observed from public data.
- Security awareness training
Staff training is a process, not a public record.
- Incident response plan
Written plans and tabletop tests are internal.
- Payment-change verification
How invoice and bank-detail changes are confirmed is an internal process.
Checks use public signals only: DNS (including DNS-over-HTTPS), certificate transparency, RDAP, and a normal homepage HTTPS fetch. No port scans, no login attempts, no vulnerability probes.
Fails deduct more than warnings. A domain can still earn a B or A with a few lower-severity issues — the grade is a weighted posture score, not “zero fails or F.”
Grade bands
- A: 90–100
- B: 80–89
- C: 70–79
- D: 60–69
- F: Below 60
Category weights
- Email (35%): SPF, DMARC, DKIM, mail TLS reporting. Opportunity checks are not scored.
- Web TLS (30%): HTTPS, certificates, security headers
- DNS (20%): DNSSEC, CAA, domain expiry
- Attack surface (15%): Public subdomains and exposure signals
This domain already has a strong external posture. The remaining items in this report are the highest-value improvements. Northwind IT can help you close them and re-scan to show progress.
Contact Northwind IT
Sample report only. Generated to demonstrate Client Posture output under fictional MSP branding. Point-in-time passive scan — not a penetration test or compliance certification.
For prospects, send a shorter Security Brief with a projected grade and your booking link. You'll know when they open the link. On Pro, attach a Good / Better / Best proposal they accept online.
See a sample Security Brief →Put your logo on this report.
Scan any client or prospect domain. Send the report or a Security Brief under your name. Quote the fixes on Pro.