Is image.online-convert.com safe to use as a vendor?

image.online-convert.com scored 92/100 on LynxRadar's security posture assessment. The domain meets baseline security requirements. 9 checks passed, 6 warnings, 0 critical issues across 16 passive checks including TLS, DMARC, security headers, breaches, and CVEs.

What TLS version does image.online-convert.com use?

image.online-convert.com uses TLSv1.3 with TLS_AES_256_GCM_SHA384. TLSv1.3 negotiated with TLS_AES_256_GCM_SHA384 (256-bit). Strong configuration with no deprecated protocols or weak ciphers detected.

Does image.online-convert.com have DMARC configured?

Yes. image.online-convert.com's DMARC policy is set to 'reject'. SPF record: yes. Strengths: DMARC policy set to reject (strongest); DMARC pct=100 — policy applies to all mail; Aggregate reports (rua) configured; SPF soft-fail (~all) configured; SPF DNS lookup count: 1/10 (within limit); DKIM configured (selectors: default, mandrill).

Does image.online-convert.com have SPF configured?

Yes. SPF record: v=spf1 ip4:136.243.56.162 ip4:51.68.181.87 include:spf.mandrillapp.com ~all

Does image.online-convert.com have security headers configured?

image.online-convert.com has 3 of 5 recommended security headers. Present: X-Content-Type-Options, X-Frame-Options, Referrer-Policy. Missing: CSP, Permissions-Policy.

Does image.online-convert.com use HSTS?

Yes. HSTS enabled: max-age=15552000s (180 days). includeSubDomains present. Missing preload directive.

Has image.online-convert.com been involved in a data breach?

No known breaches found. No known breaches found in public disclosure databases.

Does image.online-convert.com have known CVE vulnerabilities?

Detected technologies: cloudflare. (cloudflare detected but excluded from CVE matching — upstream infrastructure). All detected technologies are upstream CDN/proxy infrastructure. No application-level software versions exposed.

Is image.online-convert.com's SSL certificate valid?

Yes. Strengths: Certificate valid, 82 days remaining; Issued by Google Trust Services; 38 certificates logged in CT.

image.online-convert.com Security Report — Grade A- (92/100)

Q: Does image.online-convert.com have DNSSEC enabled?

No. Strengths: 2 nameservers configured (keenan.ns.cloudflare.com, donna.ns.cloudflare.com); SOA record present and MNAME consistent with NS set; 1 MX record(s) present; Zone transfers properly restricted on all nameservers; Address records present: 2 A record(s), 2 AAAA record(s). Issues: All nameservers are from a single provider (cloudflare.com) — a provider outage takes down the domain; DNSSEC not configured — DNS responses can be spoofed or tampered with in transit (DNS cache poisoning).

A-

Trust rating

Excellent · 92/100

Procurement snapshot

No critical findings. The 6 remaining items are configuration gaps, not architectural problems.

Strengths

TLS Configuration

TLS Protocol Support

DMARC / Email Security

HSTS Header

Questions to ask

Confirm backup mail server configuration

Estimated remediation effort: 1–4 days

Based on a passive external scan — supplement with vendor-provided attestations, not a replacement.

Trust Score Trend

→ No change 1 scan · Last scanned October 15, 2026

Score

100 75 50 25 0

A-

image.online-convert.com

92/100

Compliance & Certifications

Not yet verified

SOC 2 Type II

Audit report not on file

3rd party · AICPA

ISO 27001

Certificate not on file

3rd party · accredited body

GDPR

DPA not on file

Self-reported

CCPA

Self-reported

Incident History

No public breaches on record

Security Posture

6 items need attention

9 passed

Add a backup mail server record

MX Records & Mail Provider

30 minutes Medium

This is a business-continuity gap — a single point of failure for all inbound email. image.online-convert.com only has one mail server listed to receive email. If that single server has an outage, incoming email has nowhere else to go — it gets delayed or bounced back to the sender until the server recovers.

How to fix this

1Ask your email provider whether they publish a second/backup mail server address (most do).

2Add it as a second MX record in your domain's DNS settings (check with whoever manages your website or domain registration), with a higher priority number than your main one (higher number = lower priority = used only as backup).

3Confirm it worked: search "mx record checker" and enter image.online-convert.com — you should see 2 or more records.

Report unlocked.

View all 9 passed checks

TLS Configuration

TLS Protocol Support

DMARC / Email Security

HSTS Header

Cookie Security

Known Breaches

Subprocessors & Tech Stack

CVE Exposure

Certificate Hygiene

Couldn't check: Malware / Phishing Blocklist — the check didn't complete (the site blocked or timed out our scanner, or a data source was unavailable), so this isn't counted in the score.

Company Signals

Operational risk

Last funding

Employees

Trust Resources

Claim profile →

Trust Center

Not detected

DPA (Data Processing Agreement)

Subprocessors List

Similar companies

Appears in

Vendors graded A

380 companies · LynxRadar ranking

Top 10% by security score

291 companies · LynxRadar ranking

Medium Priority

Warn

Strengths: Mail handled by mx.tectrend.de; 1 MX record(s) configured. Issues: Only 1 MX record — no failover if primary mail server is unavailable.

Likelihood: ★★☆☆☆

Impact: ★★☆☆☆

Warn

Issues: No MTA-STS configured — email in transit is vulnerable to TLS downgrade attacks; sending servers cannot verify your mail server requires TLS; No TLSRPT record (_smtp._tls) — TLS delivery failures won't be reported to the domain owner.

Likelihood: ★★☆☆☆

Impact: ★★★☆☆

Not enabled

Strengths: 2 nameservers configured (keenan.ns.cloudflare.com, donna.ns.cloudflare.com); SOA record present and MNAME consistent with NS set; 1 MX record(s) present; Zone transfers properly restricted on all nameservers; Address records present: 2 A record(s), 2 AAAA record(s). Issues: All nameservers are from a single provider (cloudflare.com) — a provider outage takes down the domain; DNSSEC not configured — DNS responses can be spoofed or tampered with in transit (DNS cache poisoning).

Likelihood: ★★☆☆☆

Impact: ★★★☆☆

Best Practice

Warn

Strengths: CAA records configured at online-convert.com (10 record(s)); Authorised CAs: comodoca.com, digicert.com; cansignhttpexchanges=yes, letsencrypt.org, pki.goog; cansignhttpexchanges=yes, ssl.com; Wildcard CAs: pki.goog; cansignhttpexchanges=yes, ssl.com, comodoca.com, digicert.com; cansignhttpexchanges=yes, letsencrypt.org. Issues: No iodef record — CA violations won't be reported to the domain owner.

Likelihood: ★☆☆☆☆

Impact: ★☆☆☆☆

3/5 present

Missing: CSP, Permissions-Policy

Likelihood: ★★☆☆☆

Impact: ★☆☆☆☆

Warn

No security.txt found. Publishing a security.txt at /.well-known/security.txt is the industry standard (RFC 9116) for vulnerability disclosure policies. Its absence may indicate a less mature security program.

Likelihood: ★☆☆☆☆

Impact: ★☆☆☆☆