Northwind Studio · Website and email configuration report

Period 01 Aug 2026 to 31 Aug 2026 · checked every six hours · generated 2026-09-01 00:00 UTC

What this report is. A dated record of externally observable configuration for 3 domains: DNS records, permitted email senders (SPF), DKIM selectors, DMARC policy, HTTPS certificate, redirect and security headers. It records what was observed and when. It does not test email delivery, scan for vulnerabilities, or assess compliance, and it does not state that maintenance was performed or that any incident was prevented.

7review changes

2certificate actions

2registration actions

1expected changes

14configuration notes

1coverage gaps

3pending confirmation

Acme Bakery · acme-bakery.test

Review changes (3)

Check	What changed	Observed
SPF permitted senders	New SPF senders ip4 192.0.2.128/25 (via spf.marketingtool.test) include _spf.mtool-sub.test (via spf.marketingtool.test > _spf.mtool-sub.test) What to do Identify which tool or provider added itself to the SPF record, using the include named above. If the client uses that tool, mark the change as expected; if not, remove the include from the SPF record.	first seen 2026-08-10 06:00 UTC confirmed 2026-08-10 12:00 UTC
Security headers	Content-Security-Policy: directive frame-ancestors removed was: 'none' What to do Restore the header in the web server, CDN or application configuration. It was most likely dropped during a deployment.	first seen 2026-08-10 06:00 UTC confirmed 2026-08-10 12:00 UTC
Certificate transparency	Certificate issued by an authority not seen before Budget Certs Inc (newest 2026-08-22T09:14:00) What to do Find out who asked for it. If the client or their host moved to a new certificate authority, or turned on a CDN or a new hosting platform, this is expected: mark it so. If nobody recognises it, treat it as urgent: someone may have proved control of the domain or a subdomain. Check the DNS zone and the registrar account for changes, and who has access to both.	first seen 2026-08-22 00:00 UTC confirmed 2026-08-23 00:00 UTC

Expected change (1)

Check	What changed	Observed
Mail servers (MX)	MX records changed added: 10 aspmx.bigmail.test, 20 alt1.aspmx.bigmail.test removed: 10 mx1.mailhost.test, 20 mx2.mailhost.test	first seen 2026-08-10 06:00 UTC confirmed 2026-08-10 12:00 UTC

Configuration notes (2)

Check	What changed	Observed
Certificate transparency	Certificate authorities recorded Example CA: 3 certificate(s) What to do No action needed. This is a record of which authorities have issued for the domain.	first seen 2026-08-01 00:00 UTC
Website address (A)	A records changed added: 192.0.2.12, 192.0.2.13 removed: 192.0.2.10, 192.0.2.11 What to do Address changes are normal for hosts behind a CDN. If the site is not on a CDN, confirm the new address with the hosting provider.	first seen 2026-08-03 00:00 UTC

Current configuration at period end

Check	Observed value
Website address (A)	192.0.2.12, 192.0.2.13
Blocklist status	(none)
Alias targets (CNAME)	(none)
DNSSEC	(none)
Mail servers (MX)	10 aspmx.bigmail.test, 20 alt1.aspmx.bigmail.test
Nameservers	ns1.dnshost.test, ns2.dnshost.test
Domain registration	expires 2027-04-18T00:00:00Z; registrar Example Registrar Ltd; locked
DKIM selector mh1	present, rsa 2048 bits
DMARC policy	p=quarantine, pct=100, published at the exact name
SPF permitted senders	5 permitted senders; ends -all; 4 lookups
Home page	status 200; 48213 bytes; indexable; no mixed content; found expected text 'Order your cake'
Security headers	8 security headers present
HTTP to HTTPS redirect	redirects; status 301
security.txt	published; contact mailto:security@acme-bakery.test
HTTPS certificate	valid until 2026-11-28T00:00:00Z (Example CA R3)
Certificate transparency	4 unexpired certificate(s) from 2 authority(ies): Example CA, Budget Certs Inc
TLS versions accepted	lowest accepted TLSv1.2

Coverage

Check	Status	Last successful observation
Website address (A)	observed	2026-08-31 18:00 UTC
Blocklist status	observed	2026-08-31 18:00 UTC
Alias targets (CNAME)	observed	2026-08-31 18:00 UTC
DNSSEC	observed	2026-08-31 18:00 UTC
Mail servers (MX)	observed	2026-08-31 18:00 UTC
Nameservers	observed	2026-08-31 18:00 UTC
Domain registration	observed	2026-08-31 18:00 UTC
DKIM selector mh1	observed	2026-08-31 18:00 UTC
DMARC policy	observed	2026-08-31 18:00 UTC
SPF permitted senders	observed	2026-08-31 18:00 UTC
Home page	observed	2026-08-31 18:00 UTC
Security headers	observed	2026-08-31 18:00 UTC
HTTP to HTTPS redirect	observed	2026-08-31 18:00 UTC
security.txt	observed	2026-08-31 18:00 UTC
HTTPS certificate	observed	2026-08-31 18:00 UTC
Certificate transparency	stale	2026-08-23 00:00 UTC
TLS versions accepted	observed	2026-08-31 18:00 UTC

0 checks never observed successfully; 1 stale at period end. Gaps are reported, never assumed fine.

Harbour Goods (shop) · shop.harbour-goods.test

Review changes (4)

Check	What changed	Observed
DKIM selector selector1	DKIM selector selector1 removed The selector previously published a key and now returns no record. What to do Check the mail provider's DKIM settings. If the client changed mail providers, add the new selector here and remove the old one; if not, the DNS record may have been deleted by mistake.	first seen 2026-08-18 12:00 UTC confirmed 2026-08-18 18:00 UTC
Home page	Search engines are told not to index the home page found in a meta robots tag value: noindex, nofollow What to do Almost always a staging setting that reached production. In WordPress, Settings then Reading, clear "Discourage search engines". Otherwise remove the noindex from the meta robots tag or the X-Robots-Tag header at the server or CDN. Until it is removed the site will drop out of search results.	first seen 2026-08-18 12:00 UTC confirmed 2026-08-18 18:00 UTC
Home page	Page loads resources over plain http insecure source: assets.old-theme.test What to do Change the listed sources to https, or serve them from the site itself. Browsers block insecure scripts and stylesheets on a secure page, so part of the design or behaviour is probably already broken, and the padlock is weakened.	first seen 2026-08-18 12:00 UTC confirmed 2026-08-18 18:00 UTC
Blocklist status	Address listed on a blocklist 203.0.113.70 (mx mx.harbour-goods.test) on bl.spamcop.net What to do Find out why the address was listed (the blocklist's lookup page names the reason), fix the cause, then request delisting there. For a shared hosting or mail address, ask the provider; they usually handle delisting. Mail from a listed mail server is likely to be rejected or filtered until it is cleared.	first seen 2026-08-25 00:00 UTC confirmed 2026-08-25 06:00 UTC

Certificate action (1)

Check	What changed	Observed
HTTPS certificate	Certificate expires within 14 days not after 2026-09-12T00:00:00Z 11 days remaining What to do Renew the certificate before the date shown. If renewal is automatic, check that the renewal job is running and that DNS or HTTP validation still succeeds.	first seen 2026-08-31 18:00 UTC

Registration action (1)

Check	What changed	Observed
Domain registration	Domain registration expires within 60 days expires 2026-10-02T00:00:00Z registrar: Example Registrar Ltd What to do Renew the domain at the registrar before the date shown, or confirm auto-renew is on and the payment method is valid. An expired domain takes the website and email with it.	first seen 2026-08-31 18:00 UTC

Configuration notes (7)

Check	What changed	Observed
DMARC policy	DMARC policy inherited from organisational domain harbour-goods.test publishes the record; effective policy quarantine. What to do No action needed. The subdomain uses the parent domain's policy; publish a record at the subdomain only if it should differ.	first seen 2026-08-01 00:00 UTC
Security headers	Content-Security-Policy not set Observed as absent; not a vulnerability claim. What to do Optional: add this header at the web server or CDN. Hosting providers and CDNs usually have a one-line setting for it.	first seen 2026-08-01 00:00 UTC
Security headers	X-Frame-Options not set Observed as absent; not a vulnerability claim. What to do Optional: add this header at the web server or CDN. Hosting providers and CDNs usually have a one-line setting for it.	first seen 2026-08-01 00:00 UTC
Security headers	Permissions-Policy not set Observed as absent; not a vulnerability claim. What to do Optional: add this header at the web server or CDN. Hosting providers and CDNs usually have a one-line setting for it.	first seen 2026-08-01 00:00 UTC
Security headers	Cross-Origin-Resource-Policy not set Observed as absent; not a vulnerability claim. What to do Optional: add this header at the web server or CDN. Hosting providers and CDNs usually have a one-line setting for it.	first seen 2026-08-01 00:00 UTC
Domain registration	Registrar transfer lock not set No clientTransferProhibited or serverTransferProhibited status at the registry. What to do Enable the registrar transfer lock so the domain cannot be moved without unlocking it first.	first seen 2026-08-01 00:00 UTC
DNSSEC	DNSSEC not enabled No DS record at the parent; an observation, not a defect. What to do Optional: enabling DNSSEC at the DNS host and publishing the DS record at the registrar protects answers from tampering. Only do this if the DNS host supports it fully.	first seen 2026-08-01 00:00 UTC

Pending confirmation (3)

Check	Observed difference	First seen
Home page	Search engines are told not to index the home page	2026-08-31 18:00 UTC
Home page	Page loads resources over plain http	2026-08-31 18:00 UTC
Blocklist status	Address listed on a blocklist	2026-08-31 18:00 UTC

Current configuration at period end

Check	Observed value
Blocklist status	(none)
Website alias (CNAME)	shops.platform-host.test
DNSSEC	no record
Mail servers (MX)	10 mx.harbour-goods.test
Domain registration	expires 2026-10-02T00:00:00Z; registrar Example Registrar Ltd; no transfer lock
DKIM selector google	no record
DKIM selector selector1	no record
DMARC policy	p=quarantine, pct=100, inherited from harbour-goods.test
SPF permitted senders	1 permitted sender; ends ~all; 1 lookups
Home page	status 200; 30102 bytes; NOT INDEXABLE; 1 insecure source(s)
Security headers	4 security headers present
HTTP to HTTPS redirect	redirects; status 308
HTTPS certificate	valid until 2026-09-12T00:00:00Z (Example CA R3)
TLS versions accepted	lowest accepted TLSv1.2

Coverage

Check	Status	Last successful observation
Blocklist status	observed	2026-08-31 18:00 UTC
Website alias (CNAME)	observed	2026-08-31 18:00 UTC
DNSSEC	observed	2026-08-31 18:00 UTC
Mail servers (MX)	observed	2026-08-31 18:00 UTC
Domain registration	observed	2026-08-31 18:00 UTC
DKIM selector google	observed	2026-08-31 18:00 UTC
DKIM selector selector1	observed	2026-08-31 18:00 UTC
DMARC policy	observed	2026-08-31 18:00 UTC
SPF permitted senders	observed	2026-08-31 18:00 UTC
Home page	observed	2026-08-31 18:00 UTC
Security headers	observed	2026-08-31 18:00 UTC
HTTP to HTTPS redirect	observed	2026-08-31 18:00 UTC
HTTPS certificate	observed	2026-08-31 18:00 UTC
TLS versions accepted	observed	2026-08-31 18:00 UTC

Bluefin Legal · bluefin-legal.test

Certificate action (1)

Check	What changed	Observed
HTTPS certificate	Certificate expires within 30 days not after 2026-09-29T00:00:00Z 28 days remaining What to do Renew the certificate before the date shown. If renewal is automatic, check that the renewal job is running and that DNS or HTTP validation still succeeds.	first seen 2026-08-31 18:00 UTC

Registration action (1)

Check	What changed	Observed
Domain registration	Domain registration expires within 30 days expires 2026-09-18T00:00:00Z registrar: Example Registrar Ltd What to do Renew the domain at the registrar before the date shown, or confirm auto-renew is on and the payment method is valid. An expired domain takes the website and email with it.	first seen 2026-08-31 18:00 UTC

Configuration notes (5)

Check	What changed	Observed
DMARC policy	No DMARC record observed No record at the exact name or at the organisational domain. What to do Publish a DMARC record at _dmarc.<domain>, starting with p=none and a reporting address, once SPF and DKIM are in place.	first seen 2026-08-01 00:00 UTC
Domain registration	Registrar transfer lock not set No clientTransferProhibited or serverTransferProhibited status at the registry. What to do Enable the registrar transfer lock so the domain cannot be moved without unlocking it first.	first seen 2026-08-01 00:00 UTC
DNSSEC	DNSSEC not enabled No DS record at the parent; an observation, not a defect. What to do Optional: enabling DNSSEC at the DNS host and publishing the DS record at the registrar protects answers from tampering. Only do this if the DNS host supports it fully.	first seen 2026-08-01 00:00 UTC
TLS versions accepted	Legacy TLS versions accepted accepted: What to do Ask the hosting provider to disable TLS 1.0 and 1.1. Modern browsers no longer use them and they weaken the connection for everyone.	first seen 2026-08-01 00:00 UTC
security.txt	No security.txt published /.well-known/security.txt returned no file. What to do Optional: publish /.well-known/security.txt with a contact address so anyone who finds a problem knows whom to tell.	first seen 2026-08-01 00:00 UTC

Coverage gap (1)

Check	What changed	Observed
Security headers	Check has not succeeded for 12 hours last successful observation 2026-08-19T18:00:00+00:00 latest state: error What to do No action on the client's domain: the check itself could not complete. If it persists for more than a day, contact support with the domain name.	first seen 2026-08-19 18:00 UTC confirmed 2026-08-20 06:00 UTC

Current configuration at period end

Check	Observed value
Website address (A)	198.51.100.20
DNSSEC	no record
Mail servers (MX)	10 mail.bluefin-legal.test
Domain registration	expires 2026-09-18T00:00:00Z; registrar Example Registrar Ltd; no transfer lock
DMARC policy	no record
SPF permitted senders	1 permitted sender; ends -all; 1 lookups
Availability	up · status 200 · 196 ms
Security headers	8 security headers present
HTTP to HTTPS redirect	redirects; status 301
security.txt	no record
HTTPS certificate	valid until 2026-09-29T00:00:00Z (Example CA R3)
TLS versions accepted	lowest accepted TLSv1; legacy versions accepted

Coverage

Check	Status	Last successful observation
Website address (A)	observed	2026-08-31 18:00 UTC
DNSSEC	observed	2026-08-31 18:00 UTC
Mail servers (MX)	observed	2026-08-31 18:00 UTC
Domain registration	observed	2026-08-31 18:00 UTC
DMARC policy	observed	2026-08-31 18:00 UTC
SPF permitted senders	observed	2026-08-31 18:00 UTC
Availability	observed	2026-08-31 18:00 UTC
Security headers	stale	2026-08-19 18:00 UTC
HTTP to HTTPS redirect	observed	2026-08-31 18:00 UTC
security.txt	observed	2026-08-31 18:00 UTC
HTTPS certificate	observed	2026-08-31 18:00 UTC
TLS versions accepted	observed	2026-08-31 18:00 UTC

0 checks never observed successfully; 1 stale at period end. Gaps are reported, never assumed fine.