Resolution Scope

══ resolutionscope.com ══
engine 26.0.0-alpha.3 · resolver cloudflare · 2026-09-02 15:55:09 UTC (epoch 1788364509) · session f2b3fc09c38592a0
seal   64256c68c5dc9e302d60b1c4dd292c0747243cab48113c7a546b5c98e750b7f447cded09b7b0cd519b41b6c6302d966b323aa7b3d1fb51d771fae2e56bb91fbd
scheme resolution-scope-sha3-512-v5

FINDINGS
  HIGH       MTA-STS      ABSENT  record absent — zone exists, no MTA-STS
      rfc  Optional (RFC 8461). TXT at _mta-sts.<domain> plus an HTTPS policy file; only mode:enforce enforces — testing and none do not.
      → No transport policy: senders may fall back to plaintext delivery, so mail to this domain is exposed to STARTTLS stripping. Publish an MTA-STS policy (or deploy DANE).

ADVISORY
  LOW        CDS/CDNSKEY  ABSENT  not published — zone exists, no CDS/CDNSKEY
      rfc  Optional (RFC 7344, Proposed Standard — elevated from Informational by RFC 8078 §6.1; further updated by RFC 9615/9975). CDS/CDNSKEY at the apex signal automated DS maintenance to the parent zone; the parent MAY act on it but is not normatively required to (§6 SHOULD, not MUST).
      → DS updates at the parent are manual. If your keys change and the parent DS is not updated in step, the domain stops resolving (SERVFAIL) for every validating resolver until it is fixed. Publishing CDS/CDNSKEY lets a supporting parent maintain the DS automatically. This is an availability control: it protects you from your own key changes, not from an attacker. Remediation: publish CDS and CDNSKEY records matching your DS at your DNS operator; if your operator provides no way to create them, the remediation is procedural — write the registrar DS step into your key-change runbook.
  LOW        TLS-RPT      ABSENT  record absent — zone exists, no TLS-RPT
      rfc  Optional (RFC 8460). TXT at _smtp._tls.<domain>: v=TLSRPTv1 plus rua= — where senders deliver aggregate TLS-success/failure reports. Pairs with MTA-STS: the reporting channel that tells the operator their policy is (or is not) working.
      → No reporting channel: MTA-STS/DANE failures happen invisibly — the operator learns nothing when senders cannot enforce TLS. Publish v=TLSRPTv1 with a rua.

HOLDING
  OK         DNSSEC       PRESENT signed + delegated — chain validates from the root
      rfc  Optional (BCP: RFC 9364). If deployed: DNSKEY at the apex, DS at the parent, and the chain must validate from the root.
      → DNSSEC is fully operational: responses for this zone are cryptographically verifiable end-to-end.
  OK         SPF          PRESENT hardfail (-all) — strongest publisher assertion
      rfc  Optional (RFC 7208). If present: exactly one TXT record starting `v=spf1`, terminating in `-all` (enforce) or `~all` (softfail).
      → SPF authorizes specific senders and asserts the rest are unauthorized — the strongest statement the record can make. RFC 9989 §7.1 names a trade: because SPF runs early in the SMTP transaction, -all can cause rejection before DMARC is consulted, so mail that would have passed via an aligned DKIM signature may be refused — and those rejections never reach the DATA phase, so they never appear in your aggregate reports.
  OK         DMARC        PRESENT reject (p=reject) — enforced
      rfc  Optional (RFC 9989, which obsoletes RFC 7489). TXT at _dmarc.<domain> with p=none, p=quarantine, or p=reject; only quarantine and reject enforce.
      → DMARC tells receivers to refuse mail that fails SPF/DKIM alignment.
  OK         CAA          PRESENT wildcard-fully-restricted — issuewild ";"
      rfc  Optional (RFC 8659). CAA records name the CAs allowed to issue certificates for the domain; CAs are required to honor them.
      → The domain affirmatively prohibits wildcard-certificate issuance (RFC 8659 §4.3): no CA may issue for *.example. This is stricter than a named-CA restriction.
  OK         CSYNC        ABSENT  record absent — standing state outside a delegation change
      rfc  Optional (RFC 7477). CSYNC RR at the apex signals the parent's agent to copy delegation records (NS/A/AAAA) from the child — automated child-to-parent sync for delegation changes. NOT for DS sync (that is CDS). Absence is the standing state outside a delegation change, not a deficiency.
      → No CSYNC: delegation updates go through the registrar manually. Normal for most zones — absence is expected outside a delegation change (the CDS precedent).

COULD NOT MEASURE
  UNMEASURED DKIM         INDET   wildcard *._domainkey — the selector sweep proves nothing
      rfc  Optional (RFC 6376). Public key published at <selector>._domainkey.<domain>; the selector is advertised only in outbound mail (DKIM-Signature `s=` tag), not in the zone.
      → A nonexistent selector name resolved, so this domain publishes a wildcard and the 81-selector sweep is not probative — every probe "resolves" against it. Provide your actual selector (the s= tag in any outbound DKIM-Signature header) to measure DKIM definitively.

NOT APPLICABLE
  N/A        DANE         N/A     no mail declared (null MX, RFC 7505)
      rfc  Optional (RFC 7672). TLSA at _25._tcp.<mx-host> for each MX; requires a DNSSEC-signed zone (§1.3.2) to mean anything.
      → The domain explicitly declares it accepts no mail; there is no mail server to pin.

Coverage Score : 4/8 (50%)  — deployed controls over measured controls
Risk-Weighted  : 66%  (scoring v1)  — the same verdicts weighted by each control's identity — beside Coverage, never instead of it, never sealed
? (indeterminate): 1 · N/A (not applicable): 1  — excluded from both scores