Is krungsri.com safe to use as a vendor?

krungsri.com scored 80/100 on LynxRadar's security posture assessment. The domain meets baseline security requirements. 7 checks passed, 7 warnings, 0 critical issues across 14 passive checks including TLS, DMARC, security headers, breaches, and CVEs.

Does krungsri.com have security headers configured?

krungsri.com has 3 of 5 recommended security headers. Present: CSP, X-Content-Type-Options, X-Frame-Options. Missing: Referrer-Policy, Permissions-Policy.

krungsri.com Security Report — Grade B- (80/100)

Q: What TLS version does krungsri.com use?

krungsri.com uses TLSv1.3 with TLS_AES_128_GCM_SHA256. TLSv1.3 negotiated with TLS_AES_128_GCM_SHA256 (128-bit). Strong configuration with no deprecated protocols or weak ciphers detected.

Q: Does krungsri.com have DMARC configured?

Yes. krungsri.com's DMARC policy is set to 'quarantine'. SPF record: yes. Strengths: DMARC policy set to quarantine; DMARC pct=100 — policy applies to all mail; Aggregate reports (rua) configured; Forensic reports (ruf) configured; SPF hard-fail (-all) configured; SPF DNS lookup count: 6/10 (within limit); DKIM configured (selectors: selector1, selector2). Issues: DMARC policy is 'quarantine', not 'reject' — spoofed mail is moved to spam rather than blocked outright.

Q: Does krungsri.com use HSTS?

Yes. HSTS enabled: max-age=63072000s (730 days) with includeSubDomains and preload. Meets best-practice configuration.

Q: Is krungsri.com's SSL certificate valid?

Issues detected. Strengths: Certificate valid, 77 days remaining; Issued by DigiCert Inc; 1056 certificates logged in CT. Issues: Certificates issued by 9 different CAs (threshold: 8 for 1056 logged certs) — possible misconfiguration or shadow IT.

Q: Does krungsri.com have DNSSEC enabled?

No. Strengths: 2 nameservers configured (ns.bay.co.th, ns1.bay.co.th); SOA record present and MNAME consistent with NS set; 2 MX record(s) present; DNSSEC enabled: zone signed (DNSKEY present) and chain of trust intact (DS record in parent zone); Zone transfers properly restricted on all nameservers; Address records present: 2 A record(s). Issues: All nameservers are from a single provider (co.th) — a provider outage takes down the domain.

B- 80/100

krungsri.com

July 03, 2026 ·

1+ Warnings 7 Passed

Better than 64% of 2702 companies scanned.

064th pct100

A+

A-

B+

B-

C+

C-

D+

D-

DNS CAA Records

MTA-STS & TLS Reporting

DNS Configuration

Security Headers

security.txt (RFC 9116)

DMARC / Email Security

Certificate Hygiene

B-

krungsri.com

80/100

Strengthen email authentication configuration

DMARC / Email Security

2–4 hours

Email authentication is partially configured for krungsri.com but has gaps. Actions needed: . Until DMARC enforcement is active, spoofed emails may still reach recipients.

NIST CSFPR.AC-7

Email authentication is a required access control

How to fix this

1Verify with: nslookup -type=txt _dmarc.krungsri.com

At a glance

Full data from this scan

TLS Version

TLSv1.3

TLSv1.3 negotiated with TLS_AES_128_GCM_SHA256 (128-bit). Strong configuration with no deprecated protocols or weak ciphers detected.

DMARC Policy

p=quarantine

Strengths: DMARC policy set to quarantine; DMARC pct=100 — policy applies to all mail; Aggregate reports (rua) configured; Forensic reports (ruf) configured; SPF hard-fail (-all) configured; SPF DNS lookup count: 6/10 (within limit); DKIM configured (selectors: selector1, selector2). Issues: DMARC policy is 'quarantine', not 'reject' — spoofed mail is moved to spam rather than blocked outright.

SPF Record

Present

v=spf1 ip4:103.216.96.0/23 ip4:103.219.196.0/24 ip4:103.93.166.0/24 ip4:58.64.42.0/24 include:spfOth

Security Headers

3/5 present

Missing: Referrer-Policy, Permissions-Policy

HSTS

Enabled

HSTS enabled: max-age=63072000s (730 days) with includeSubDomains and preload. Meets best-practice configuration.

SSL Certificate

Issues

Strengths: Certificate valid, 77 days remaining; Issued by DigiCert Inc; 1056 certificates logged in CT. Issues: Certificates issued by 9 different CAs (threshold: 8 for 1056 logged certs) — possible misconfiguration or shadow IT.

DNSSEC

Not enabled

Strengths: 2 nameservers configured (ns.bay.co.th, ns1.bay.co.th); SOA record present and MNAME consistent with NS set; 2 MX record(s) present; DNSSEC enabled: zone signed (DNSKEY present) and chain of trust intact (DS record in parent zone); Zone transfers properly restricted on all nameservers; Address records present: 2 A record(s). Issues: All nameservers are from a single provider (co.th) — a provider outage takes down the domain.

Similar companies