A96 / 100

Inspection record

darinor.com

✓ Verified: the Surface badge is on this site

2026-10-23 17:13 UTC · 0.3s · 19 checks

This domain is in good shape. The checks below are the few things worth keeping an eye on.

Not an official certification. This grade covers only a few externally visible components and is not a security audit. A high grade does not mean a domain is secure. Terms

0failing2warnings22passing7not gradeable

Stable link for darinor.com →

Email authentication

W 35100

DNS

W 1280

TLS & certificate

W 20100

HTTP headers

W 2595

What to fix first

96 → 100

Ordered by how many points each fix adds to the score. Fixing everything would raise the score from 96 to 100, keeping the A grade. Re-scan afterwards to confirm.

1.
DNSSEC is not enabled. DNS answers for this domain can be forged by an attacker in a position to tamper with resolution.
Enable DNSSEC at your DNS host, then add the resulting DS record at your registrar. Most managed DNS providers do both in one click.
Warn · DNS
+3 pts
2.
CSP is present but weakened by 'unsafe-inline' in script-src, which permits most script injection it would otherwise stop.
Replace inline scripts with nonces or hashes, and remove 'unsafe-eval'.
Warn · HTTP headers
+1 pts

Email authentication

Weight 35 · Score 100

Whether someone can send mail pretending to be this domain.

DMARC

email.dmarc

Pass

DMARC policy is `p=reject`.

v=DMARC1; p=reject; rua=mailto:dmarc@darinor.com

Pass

Aggregate reports are being collected (`rua`).

SPF

email.spf

Pass

SPF ends in `~all` (soft fail).

v=spf1 include:_spf.mail.hostinger.com ~all

Pass

SPF uses 3 of 10 permitted DNS lookups.

DKIM

email.dkim

Info

DKIM keys published for selector(s): resend.

resend._domainkey.darinor.com

MTA-STS

email.mta_sts

Pass

MTA-STS policy is published and set to `enforce`.

v=STSv1; id=20260701

TLS reporting

email.tls_rpt

Pass

TLS-RPT is configured.

v=TLSRPTv1; rua=mailto:dmarc@darinor.com

Mail servers

email.mx

Pass

2 MX record(s) published.

5 mx1.hostinger.com, 10 mx2.hostinger.com

DNS

Weight 12 · Score 80

Integrity and issuance controls on the domain's DNS records.

DNSSEC

dns.dnssec

Warn

DNSSEC is not enabled. DNS answers for this domain can be forged by an attacker in a position to tamper with resolution.

FixEnable DNSSEC at your DNS host, then add the resulting DS record at your registrar. Most managed DNS providers do both in one click.

CAA

dns.caa

Pass

CAA records restrict issuance to: letsencrypt.org, pki.goog, sectigo.com.

0 issue "letsencrypt.org", 0 issue "pki.goog", 0 issue "sectigo.com", 0 iodef "mailto:security@darinor.com"

Nameservers

dns.ns

Pass

2 nameserver(s).

ns1.vercel-dns.com, ns2.vercel-dns.com

TLS & certificate

Weight 20 · Score 100

The certificate and the encryption used to serve the site.

Certificate

tls.certificate

Pass

Certificate valid for another 55 day(s).

Let's Encrypt, notAfter 2026-12-17T19:04:38.000Z

Pass

Certificate covers darinor.com.

Pass

The certificate chain validates against the public trust roots.

Pass

Negotiated TLSv1.3.

TLS_AES_128_GCM_SHA256

Connection strength

tls.strength

Pass

The connection uses forward secrecy, so recorded traffic stays private even if the server key is later stolen.

TLSv1.3, TLS_AES_128_GCM_SHA256

Pass

The server supports TLS 1.3.

TLSv1.3, TLS_AES_128_GCM_SHA256

Deprecated protocol versions

tls.legacy_protocols

Pass

TLS 1.0 and 1.1 are refused, so only current protocol versions are accepted.

HSTS preload

tls.hsts_preload

Info

The domain is not on the HSTS preload list. Preloading is optional and hard to undo; most sites do not need it.

HTTP headers

Weight 25 · Score 95

Response headers that constrain what a browser will do, and how a researcher can reach you about a problem.

Security headers

headers.security

Pass

HSTS is set with a long max-age.

max-age=63072000; includeSubDomains

Warn

CSP is present but weakened by 'unsafe-inline' in script-src, which permits most script injection it would otherwise stop.

default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https://cdn.bsky.app https://av-cdn.bsky.app https://surface.darinor.com; connect-src 'self' https://ollama.com; frame

FixReplace inline scripts with nonces or hashes, and remove 'unsafe-eval'.

Info

style-src allows 'unsafe-inline'. That is far less dangerous than inline scripts, but it lets injected markup restyle the page, for example to fake a login form.

FixMove to nonce- or hash-based styles when the framework allows it.

Pass

X-Content-Type-Options: nosniff is set.

Pass

Referrer-Policy is set.

strict-origin-when-cross-origin

HTTPS redirect

headers.https_redirect

Pass

HTTP redirects to HTTPS (308).

https://darinor.com/

Cookies

headers.cookies

Info

No cookies were set on the homepage response.

Browser hardening headers

headers.hardening

Pass

Permissions-Policy is set.

camera=(), microphone=(), geolocation=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=(), vr=(), xr=(), ambient-light-sensor=()

Info

No Cross-Origin-Opener-Policy. Pages that open or are opened by cross-origin windows keep a handle on each other, which cross-site leak attacks use.

FixConsider `Cross-Origin-Opener-Policy: same-origin` if the site does not rely on cross-origin popups.

Info

Neither Cross-Origin-Resource-Policy nor Cross-Origin-Embedder-Policy is set, so other sites may load this response as a sub-resource.

FixConsider `Cross-Origin-Resource-Policy: same-origin` for responses that are not meant to be embedded.

CORS

headers.cors

Info

Any website can read this response. That is fine for public data and wrong for anything user-specific.

access-control-allow-origin: *

security.txt

headers.security_txt

Pass

security.txt is published and current, so researchers know where to report problems.

Contact: mailto:security@darinor.com

For the owner of darinor.com

Show your grade

Put this badge on your homepage. It links to this report, and when a scan finds it on your site the report is marked verified, so visitors know the grade is yours.

The badge is not an official certification and not a security audit. It reflects only a few external checks, so don’t present it as proof of security or compliance. See the terms.

✓ This report is verified: the badge was found on your homepage.

For light sitesFor dark sites

Paste into your homepage HTML

<a href="https://surface.darinor.com/d/darinor.com"><img src="https://surface.darinor.com/badge/darinor.com.svg" alt="Security grade for darinor.com by Surface" height="44"></a>

Scan again

Publish the change first, then scan again. Surface looks for the badge on https://darinor.com/ every time it scans. Reports are reused for 15 minutes, so a scan right after the last one may show the earlier result. The badge image can take up to an hour to show a new grade.

Surface keeps only the latest report for each domain. Re-inspecting darinor.com will replace this report, and this link will stop resolving — use the stable link above if you want a URL that always reflects the current state.