A-
92/100
1
Enable DNSSEC on your domain
DNS Configuration
Without DNSSEC, DNS responses for hotcleaner.com can be spoofed, potentially redirecting users to malicious sites. This requires coordination with your domain registrar to publish DS records. Also consider adding a secondary DNS provider.
NIST 800-53SC-20
Secure name/address resolution service
How to fix this
1Check if your DNS provider supports DNSSEC (Cloudflare, Route53, etc.)
2Enable DNSSEC signing in your DNS provider dashboard
3Add the DS record to your registrar for .com TLD
4Verify: dig +dnssec hotcleaner.com
At a glance
Full data from this scan
TLS Version
TLSv1.3
TLSv1.3 negotiated with TLS_AES_256_GCM_SHA384 (256-bit). Strong configuration with no deprecated protocols or weak ciphers detected.
DMARC Policy
p=reject
Strengths: DMARC policy set to reject (strongest); DMARC pct=100 — policy applies to all mail; DKIM alignment: strict (adkim=s); SPF alignment: strict (aspf=s); Aggregate reports (rua) configured; Forensic reports (ruf) configured; SPF soft-fail (~all) configured; SPF DNS lookup count: 1/10 (within limit); DKIM configured (selectors: google).
SPF Record
Present
v=spf1 include:_spf.google.com ~all
Security Headers
3/5 present
Missing: Referrer-Policy, Permissions-Policy
HSTS
Enabled
HSTS enabled: max-age=31536000s (365 days). includeSubDomains present. Missing preload directive.
SSL Certificate
Valid
Strengths: Certificate valid, 53 days remaining; Issued by Google Trust Services.
DNSSEC
Not enabled
Strengths: 2 nameservers configured (ns27.domaincontrol.com, ns28.domaincontrol.com); SOA record present and MNAME consistent with NS set; 5 MX record(s) present; Zone transfers properly restricted on all nameservers; Address records present: 1 A record(s), 1 AAAA record(s). Issues: All nameservers are from a single provider (domaincontrol.com) — a provider outage takes down the domain; DNSSEC not configured — DNS responses can be spoofed or tampered with in transit (DNS cache poisoning).
Similar companies
