Overview
Findings
Details
Related
AI-Generated Summary
What this means
hunter.io scored 100/100, demonstrating a strong security posture. Minor improvements are noted below.
Critical gaps in: Cookie Security. Positive signals: MX Records & Mail Provider, DNS Configuration, TLS Protocol Support all passed.
How hunter.io compares
Grade distribution across 2612 companies we've scanned. hunter.io scores better than 99% of them.
85
A+
25
A
189
A-
197
B+
75
B
362
B-
132
C+
114
C
333
C-
121
D+
95
D
256
D-
628
F
hunter.io — Grade A+ (100/100)
2612 companies scanned
Security checks
Each check inspects a different part of hunter.io's public security setup. Green means healthy, yellow needs attention, red is a problem.
Cookie Security
Strengths: 3 cookie(s) analyzed; All cookies have SameSite attribute. Issues: 1/3 cookie(s) missing Secure flag (XSRF-TOKEN); 1/3 cookie(s) missing HttpOnly flag (XSRF-TOKEN).
MTA-STS & TLS Reporting
Issues: No MTA-STS configured — email in transit is vulnerable to TLS downgrade attacks. Sending servers cannot verify that your mail server requires TLS; No TLSRPT record — TLS delivery failures won't be reported to domain owner.
DNS CAA Records
Strengths: CAA records configured (10 record(s)); Authorized CAs: comodoca.com, digicert.com; cansignhttpexchanges=yes, letsencrypt.org, pki.goog; cansignhttpexchanges=yes, ssl.com. Issues: No iodef record — CA violations won't be reported to the domain owner.
security.txt (RFC 9116)
No security.txt found. Publishing a security.txt at /.well-known/security.txt is the industry standard (RFC 9116) for vulnerability disclosure policies. Its absence may indicate a less mature security program.
MX Records & Mail Provider
Strengths: Mail handled by Google Workspace; 5 MX record(s) configured; Multiple MX records provide redundancy.
DNS Configuration
Strengths: 2 nameservers configured (gina.ns.cloudflare.com., greg.ns.cloudflare.com.); 5 MX records present; DNSSEC enabled; Zone transfers properly restricted.
TLS Protocol Support
Strengths: TLS 1.3 supported; TLS 1.2 supported; TLS 1.3 supported (strongest). Protocol support: TLS 1.3: Yes, TLS 1.2: Yes, TLS 1.1: No, TLS 1.0: No.
TLS Configuration
TLSv1.3 negotiated with TLS_AES_256_GCM_SHA384 (256-bit). Strong configuration with no deprecated protocols or weak ciphers detected.
HSTS Header
HSTS enabled: max-age=31536000s (365 days) with includeSubDomains and preload. Meets best-practice configuration.
Security Headers
4/5 security headers present. Missing: CSP.
Known Breaches
No known breaches found in public disclosure databases.
DMARC / Email Security
Strengths: DMARC policy set to reject (strongest); SPF record present with hard-fail (-all); DKIM configured (selectors: google, k1, smtpapi).
CVE Exposure
Detected technologies: cloudflare. (cloudflare detected but excluded from CVE matching — upstream infrastructure). All detected technologies are upstream CDN/proxy infrastructure. No application-level software versions exposed.
Certificate Hygiene
Strengths: Certificate valid, 89 days remaining; Issued by Let's Encrypt. Note: Wildcard certificate in use (*.domain) — covers all subdomains. Common practice; worth noting that compromise would affect all subdomains.
At a glance
Key data points from the scan.
TLS Version
TLSv1.3
TLSv1.3 negotiated with TLS_AES_256_GCM_SHA384 (256-bit). Strong configuration with no deprecated protocols or weak ciphers detected.
DMARC Policy
p=reject
Strengths: DMARC policy set to reject (strongest); SPF record present with hard-fail (-all); DKIM configured (selectors: google, k1, smtpapi).
SPF Record
Present
v=spf1 include:spf.mtasv.net include:_spf.google.com include:customeriomail.com -all
Security Headers
4/5 present
Missing: CSP
HSTS
Enabled
HSTS enabled: max-age=31536000s (365 days) with includeSubDomains and preload. Meets best-practice configuration.
SSL Certificate
Valid
Strengths: Certificate valid, 89 days remaining; Issued by Let's Encrypt. Note: Wildcard certificate in use (*.domain) — covers all subdomains. Common practice; worth noting that compromise would affect all subdomains.
DNSSEC
Enabled
Strengths: 2 nameservers configured (gina.ns.cloudflare.com., greg.ns.cloudflare.com.); 5 MX records present; DNSSEC enabled; Zone transfers properly restricted.