Is undercoverist.org safe to use as a vendor?

undercoverist.org scored 62/100 on LynxRadar's security posture assessment. The domain partially meets security requirements with some gaps to address. 7 checks passed, 4 warnings, 3 critical issues across 14 passive checks including TLS, DMARC, security headers, breaches, and CVEs.

Does undercoverist.org have SPF configured?

Yes. SPF record: v=spf1 +a +mx +ip4:185.136.166.115 include:zohomail.in ~all

Does undercoverist.org have security headers configured?

undercoverist.org has 0 of 5 recommended security headers. Missing: CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy.

undercoverist.org Security Report — Grade D- (62/100)

Q: What TLS version does undercoverist.org use?

undercoverist.org uses TLSv1.3 with TLS_AES_256_GCM_SHA384. TLSv1.3 negotiated with TLS_AES_256_GCM_SHA384 (256-bit). Strong configuration with no deprecated protocols or weak ciphers detected.

Q: Does undercoverist.org have DMARC configured?

Yes. undercoverist.org's DMARC policy is set to 'none'. SPF record: yes. Strengths: SPF record present with soft-fail (~all). Issues: DMARC policy is 'none' (monitoring only, no enforcement); No DKIM records found for common selectors (domain may use custom selectors — this is not a confirmed gap).

Q: Does undercoverist.org use HSTS?

No. Strict-Transport-Security header is missing. Connections can be downgraded to HTTP via man-in-the-middle attacks.

Q: Is undercoverist.org's SSL certificate valid?

Yes. Strengths: Certificate valid, 76 days remaining; Issued by Google Trust Services. Note: Wildcard certificate in use (*.domain) — covers all subdomains. Common practice; worth noting that compromise would affect all subdomains.

Q: Does undercoverist.org have DNSSEC enabled?

No. Strengths: 2 nameservers configured (gail.ns.cloudflare.com., felipe.ns.cloudflare.com.); 3 MX records present; Zone transfers properly restricted. Issues: DNSSEC not configured — DNS responses can be spoofed.

D-

62/100

undercoverist.org

May 07, 2026 ·

1 Critical 0+ Warnings 7 Passed

AI Summary

undercoverist.org scored 62/100, meeting baseline requirements but with 4 findings that require attention. The vendor can proceed with a remediation timeline agreement.

Critical gaps in: HSTS Header, Security Headers, DMARC / Email Security. Positive signals: MX Records & Mail Provider, TLS Configuration, TLS Protocol Support all passed.

4 action items identified, including 1 critical. The issues are configuration gaps, not architectural problems. A focused remediation effort of 2–5 days could address all findings.

Better than 25% of 2677 companies scanned.

025th pct100

A+

A-

B+

B-

C+

C-

D+

D-

DMARC / Email Security

HSTS Header

Security Headers

MTA-STS & TLS Reporting

DNS CAA Records

DNS Configuration

security.txt (RFC 9116)

MX Records & Mail Provider

TLS Configuration

TLS Protocol Support

Known Breaches

Certificate Hygiene

Cookie Security

CVE Exposure

D-

undercoverist.org

62/100

0 of 1 fixed

All 1 critical issue marked as fixed

Re-scan to confirm and update your score.

Set up email authentication (DKIM)

1–2 days

Without email authentication, anyone can send emails that appear to come from undercoverist.org. This is the most common vector for phishing attacks targeting employees and customers. DKIM is not configured.

NIST CSFPR.AC-7

Email authentication is a required access control

ISO 27001A.13.2.1

Information transfer policies require email security controls

HIPAA§164.312(e)

Transmission security for electronic PHI

How to fix this

1Add SPF record to DNS: v=spf1 include:_spf.google.com ~all (adjust for your email provider)

2Configure DKIM signing with your email provider and publish the public key in DNS

3Add DMARC record: v=DMARC1; p=quarantine; rua=mailto:[email protected]

4Monitor DMARC reports for 2–4 weeks, then upgrade policy to p=reject

At a glance

Full data from this scan

TLS Version

TLSv1.3

TLSv1.3 negotiated with TLS_AES_256_GCM_SHA384 (256-bit). Strong configuration with no deprecated protocols or weak ciphers detected.

DMARC Policy

p=none

Strengths: SPF record present with soft-fail (~all). Issues: DMARC policy is 'none' (monitoring only, no enforcement); No DKIM records found for common selectors (domain may use custom selectors — this is not a confirmed gap).

SPF Record

Present

v=spf1 +a +mx +ip4:185.136.166.115 include:zohomail.in ~all

Security Headers

0/5 present

Missing: CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy

HSTS

Not enabled

Strict-Transport-Security header is missing. Connections can be downgraded to HTTP via man-in-the-middle attacks.

SSL Certificate

Valid

Strengths: Certificate valid, 76 days remaining; Issued by Google Trust Services. Note: Wildcard certificate in use (*.domain) — covers all subdomains. Common practice; worth noting that compromise would affect all subdomains.

DNSSEC

Not enabled

Strengths: 2 nameservers configured (gail.ns.cloudflare.com., felipe.ns.cloudflare.com.); 3 MX records present; Zone transfers properly restricted. Issues: DNSSEC not configured — DNS responses can be spoofed.

Similar companies

Other domains with comparable security profiles.