surface
A94 / 100

Inspection record

manualskipper.com

2026-10-24 22:01 UTC · 0.1s · 19 checks

This domain is in good shape. The checks below are the few things worth keeping an eye on.

Not an official certification. This grade covers only a few externally visible components and is not a security audit. A high grade does not mean a domain is secure. Terms

0failing3warnings20passing8not gradeable

Stable link for manualskipper.com →

Email authenticationW 35100
DNSW 1270
TLS & certificateW 20100
HTTP headersW 2593

What to fix first

94 → 100

Ordered by how many points each fix adds to the score. Fixing everything would raise the score from 94 to 100, keeping the A grade. Re-scan afterwards to confirm.

  1. 1.

    DNSSEC is not enabled. DNS answers for this domain can be forged by an attacker in a position to tamper with resolution.

    Enable DNSSEC at your DNS host, then add the resulting DS record at your registrar. Most managed DNS providers do both in one click.

    Warn · DNS

    +3 pts
  2. 2.

    No security.txt. Someone who finds a vulnerability has no documented way to tell you.

    Publish https://manualskipper.com/.well-known/security.txt with at least a Contact: and an Expires: field (RFC 9116).

    Warn · HTTP headers

    +2 pts
  3. 3.

    CAA has no `iodef` address, so you are not notified when a CA is asked to issue a certificate it should not.

    Add: 0 iodef "mailto:security@manualskipper.com".

    Warn · DNS

    +1 pts

Email authentication

Weight 35 · Score 100

Whether someone can send mail pretending to be this domain.

DMARC

email.dmarc
Pass

DMARC policy is `p=reject`.

v=DMARC1; p=reject

SPF

email.spf
Pass

SPF ends in `-all`, rejecting mail from unlisted senders.

v=spf1 -all
Pass

SPF uses 0 of 10 permitted DNS lookups.

DKIM

email.dkim
Info

No DKIM key found at any commonly-used selector. Selectors cannot be enumerated from DNS, so this does not prove DKIM is absent — check with your mail provider.

MTA-STS

email.mta_sts
Info

MTA-STS does not apply: this domain accepts no mail, so there is no inbound delivery to protect.

TLS reporting

email.tls_rpt
Info

TLS-RPT does not apply: this domain accepts no mail, so there is no inbound delivery to protect.

Mail servers

email.mx
Pass

Null MX published: this domain explicitly declares that it accepts no mail.

0 .

DNS

Weight 12 · Score 70

Integrity and issuance controls on the domain's DNS records.

DNSSEC

dns.dnssec
Warn

DNSSEC is not enabled. DNS answers for this domain can be forged by an attacker in a position to tamper with resolution.

FixEnable DNSSEC at your DNS host, then add the resulting DS record at your registrar. Most managed DNS providers do both in one click.

CAA

dns.caa
Pass

CAA records restrict issuance to: letsencrypt.org, pki.goog, sectigo.com.

0 issue "letsencrypt.org", 0 issue "pki.goog", 0 issue "sectigo.com"
Warn

CAA has no `iodef` address, so you are not notified when a CA is asked to issue a certificate it should not.

FixAdd: 0 iodef "mailto:security@manualskipper.com".

Nameservers

dns.ns
Pass

2 nameserver(s).

ns1.vercel-dns.com, ns2.vercel-dns.com

TLS & certificate

Weight 20 · Score 100

The certificate and the encryption used to serve the site.

Certificate

tls.certificate
Pass

Certificate valid for another 89 day(s).

Let's Encrypt, notAfter 2027-01-22T21:01:39.000Z
Pass

Certificate covers manualskipper.com.

Pass

The certificate chain validates against the public trust roots.

Pass

Negotiated TLSv1.3.

TLS_AES_128_GCM_SHA256

Connection strength

tls.strength
Pass

The connection uses forward secrecy, so recorded traffic stays private even if the server key is later stolen.

TLSv1.3, TLS_AES_128_GCM_SHA256
Pass

The server supports TLS 1.3.

TLSv1.3, TLS_AES_128_GCM_SHA256

Deprecated protocol versions

tls.legacy_protocols
Pass

TLS 1.0 and 1.1 are refused, so only current protocol versions are accepted.

HSTS preload

tls.hsts_preload
Info

The domain is not on the HSTS preload list. Preloading is optional and hard to undo; most sites do not need it.

HTTP headers

Weight 25 · Score 93

Response headers that constrain what a browser will do, and how a researcher can reach you about a problem.

Security headers

headers.security
Pass

HSTS is set with a long max-age.

max-age=63072000; includeSubDomains
Pass

Content-Security-Policy is set.

default-src 'self'; script-src 'self' 'wasm-unsafe-eval' https://www.googletagmanager.com 'sha256-FgDKl0vJ2rEgiWgUkgEZehV1TUAluNjCTup/VUk1HLs=' 'sha256-MW2uM7Hx++AOH75zqz3Dky8NLOkZZkpiu8PORAIuWK8=' 'sha256-NhgAiuYzy2sP5UVa/FaQx0FE6TxeZhJArfrPSJi/bp4=' 'sha256-b4gNrLa0m4OT8ooxVzTrH1Zot3/byyW747+w60mR
Info

style-src allows 'unsafe-inline'. That is far less dangerous than inline scripts, but it lets injected markup restyle the page, for example to fake a login form.

FixMove to nonce- or hash-based styles when the framework allows it.

Pass

X-Content-Type-Options: nosniff is set.

Pass

Referrer-Policy is set.

strict-origin-when-cross-origin

HTTPS redirect

headers.https_redirect
Pass

HTTP redirects to HTTPS (308).

https://manualskipper.com/

Cookies

headers.cookies
Info

No cookies were set on the homepage response.

Browser hardening headers

headers.hardening
Pass

Permissions-Policy is set.

camera=(), microphone=(), geolocation=(), payment=(), usb=()
Pass

Cross-Origin-Opener-Policy is set.

same-origin
Info

Neither Cross-Origin-Resource-Policy nor Cross-Origin-Embedder-Policy is set, so other sites may load this response as a sub-resource.

FixConsider `Cross-Origin-Resource-Policy: same-origin` for responses that are not meant to be embedded.

CORS

headers.cors
Info

Any website can read this response. That is fine for public data and wrong for anything user-specific.

access-control-allow-origin: *

security.txt

headers.security_txt
Warn

No security.txt. Someone who finds a vulnerability has no documented way to tell you.

FixPublish https://manualskipper.com/.well-known/security.txt with at least a Contact: and an Expires: field (RFC 9116).

For the owner of manualskipper.com

Show your grade

Put this badge on your homepage. It links to this report, and when a scan finds it on your site the report is marked verified, so visitors know the grade is yours.

The badge is not an official certification and not a security audit. It reflects only a few external checks, so don’t present it as proof of security or compliance. See the terms.

Surface grade badge for manualskipper.com
Badge theme
I've added it: scan again

Publish the change first, then scan again. Surface looks for the badge on https://manualskipper.com/ every time it scans. Reports are reused for 15 minutes, so a scan right after the last one may show the earlier result. The badge image can take up to an hour to show a new grade.

Surface keeps only the latest report for each domain. Re-inspecting manualskipper.com will replace this report, and this link will stop resolving — use the stable link above if you want a URL that always reflects the current state.