DNS A/AAAA Resolution
Pass C01 · A/AAAA resolutionThe reserved domain resolves to public anycast addresses over IPv4 and IPv6.
Resolved example.com -> 104.20.23.154, 172.66.147.243, 2606:4700:10::ac42:93f3, 2606:4700:10::6814:179a
Sample report
A complete report, published in full.
This is the recorded SMB Scanner Lite assessment of example.com from 28 October 2026. Nothing is redacted for marketing and nothing is added: the score, findings, evidence, metadata and consent receipt are exactly what the run produced.
Public Sandbox Edition (5-Domain Locked)
Recorded, not live
example.com — external posture assessment
86
Posture score
Grade B · Strong
Executive summary
example.com demonstrates strong DNSSEC, SPF (-all) and DMARC enforcement, with informational web security header gaps typical of a minimal RFC reference site.
What this result means
Eight controls completed and none returned an inconclusive answer, so the score covers every check that ran. DNS, email authentication and transport are strong. The two warnings are informational browser-header gaps typical of a minimal reference site.
What it does not mean
A grade B is not a statement that the domain is secure. It means the controls that were measured met their expectations, subject to the limitations of external observation. No application, identity system or internal network was examined.
Scope
External and read-only. The assessment queried public DNS records, completed TLS handshakes, read HTTP response headers, and made no authentication attempt of any kind.
Eight findings, ordered as recorded. Each carries a status, the control it maps to and the observation behind it.
DNSSEC Validation
Pass C02 · DNSSEC validationThe zone is signed and the chain of trust validates against the parent.
Zone signed with validated RRSIG and parent DS delegation.
SPF Hard-Fail Policy
Pass C06 · SPF enforcementSPF is published and set to a strict no-mail policy.
v=spf1 -all (strict no-mail policy for reserved domain).
DMARC Enforcement
Pass C08 · DMARC policyUnauthorised senders are rejected at the receiving mail server.
v=DMARC1; p=reject; sp=reject; adkim=s; aspf=s
RFC 7505 Null MX
Pass C10 · MX routingThe domain publishes a null MX, signalling that it does not accept mail.
MX 0 . published indicating domain does not accept e-mail.
TLS 1.2/1.3 & Certificate
Pass C12 · CertificateTLS 1.3 is offered with a certificate that covers the domain.
Valid X.509 certificate covering example.com over TLS 1.3.
HTTP Strict-Transport-Security
Warning C15 · HSTSHSTS is not enforced on the reference landing page.
Strict-Transport-Security header not enforced on reference landing page.
RecommendedAdd Strict-Transport-Security: max-age=31536000; includeSubDomains.
Content-Security-Policy
Warning C16 · CSPA content security policy is not set on the static reference response.
Content-Security-Policy header absent on static reference response.
RecommendedPublish a restrictive Content-Security-Policy (default-src 'self'; object-src 'none').
The literal observations recorded during the run. Copy any line and re-run the equivalent query from outside your own network; if the answer differs, the finding is stale or specific to the assessment vantage point.
Resolved example.com -> 104.20.23.154, 172.66.147.243, 2606:4700:10::ac42:93f3, 2606:4700:10::6814:179a
Zone signed with validated RRSIG and parent DS delegation.
v=spf1 -all (strict no-mail policy for reserved domain).
v=DMARC1; p=reject; sp=reject; adkim=s; aspf=s
MX 0 . published indicating domain does not accept e-mail.
Valid X.509 certificate covering example.com over TLS 1.3.
Strict-Transport-Security header not enforced on reference landing page.
Content-Security-Policy header absent on static reference response.
| Grade | Score | Band | Interpretation |
|---|---|---|---|
| A | 90-100 | Strong | Every control that completed meets its published expectation, or is one minor gap away. |
| B | 80-89 | Strong | Well configured overall. The gaps are informational or low-impact hardening items. |
| C | 65-79 | Fair | Meaningful gaps in at least one category. Worth a planned fix, not an emergency. |
| D | 50-64 | Needs work | Several controls are missing or weak across more than one category. |
| F | 0-49 | Urgent | Core controls are absent. Start with the highest-severity findings and work down. |
Recommendations are limited to the findings in this run. They are configuration changes with a published basis, not a remediation project plan.
C15 · Strict-Transport-Security
Warning
HTTP Strict-Transport-Security
Add Strict-Transport-Security: max-age=31536000; includeSubDomains.
Strict-Transport-Security header not enforced on reference landing page.
C16 · Content-Security-Policy
Warning
Content-Security-Policy
Publish a restrictive Content-Security-Policy (default-src 'self'; object-src 'none').
Content-Security-Policy header absent on static reference response.
A failed control is not a confirmed vulnerability. It means a published expectation was not met. Confirm the observation yourself before treating any finding as a defect, and prioritise by the exposure it creates rather than by the colour of a dot.
Why a consent receipt is in a report
Before any run, the operator accepts the privacy policy and signs a receipt that is hash-chained to the previous one. The receipt is embedded in the report so the authorisation behind the result travels with it. It is stored on the machine that ran the assessment, not on this website.
Download this report
The same recorded assessment in four formats. The data is sanitised: it contains no internal hostnames, no operator identity beyond the demo label, and no private infrastructure detail.
Reproduce it locally
Install the public sandbox and run the same reserved domain on your own machine. The documented commands and expected output are on the documentation page.
Installation guideUnderstand the score
Weights, status credit and grade bands are documented. The score is a weighted summary of what completed — nothing else.
Scoring methodologyCheck the limits
What an external assessment cannot establish is written down, because a credible tool states the boundary of its own evidence.
Assessment limitationsWant this report for a domain you own?
Request an assessment and the same structure is produced for your infrastructure — after scope and written authorisation are agreed.