surface
C74 / 100

Inspection record

quickplayrules.online

2026-10-24 22:29 UTC · 0.3s · 19 checks

This domain is workable but has real gaps. The checks below show what to fix first.

Not an official certification. This grade covers only a few externally visible components and is not a security audit. A high grade does not mean a domain is secure. Terms

1failing3warnings18passing8not gradeable

Stable link for quickplayrules.online →

Email authenticationW 3550
DNSW 1260
TLS & certificateW 20100
HTTP headersW 2593

What to fix first

C 74 → A 100

Ordered by how many points each fix adds to the score. Fixing everything would take this domain from C to A. Re-scan afterwards to confirm.

  1. 1.

    No DMARC record. Receivers have no instruction to reject spoofed mail, and you get no visibility into who is sending as this domain.

    This domain sends no mail, so go straight to enforcement: publish a TXT record at _dmarc.quickplayrules.online: "v=DMARC1; p=reject; sp=reject; adkim=s; aspf=s". There is no legitimate mail to monitor first.

    Fail · Email authentication

    +19 pts
  2. 2.

    DNSSEC is not enabled. DNS answers for this domain can be forged by an attacker in a position to tamper with resolution.

    Enable DNSSEC at your DNS host, then add the resulting DS record at your registrar. Most managed DNS providers do both in one click.

    Warn · DNS

    +3 pts
  3. 3.

    No CAA records. Any certificate authority in the world is permitted to issue certificates for this domain.

    Publish a CAA record naming only the CAs you use, e.g. 0 issue "letsencrypt.org". Add an iodef address to be notified of violations.

    Warn · DNS

    +3 pts
  4. 4.

    No security.txt. Someone who finds a vulnerability has no documented way to tell you.

    Publish https://quickplayrules.online/.well-known/security.txt with at least a Contact: and an Expires: field (RFC 9116).

    Warn · HTTP headers

    +2 pts

Email authentication

Weight 35 · Score 50

Whether someone can send mail pretending to be this domain.

DMARC

email.dmarc
Fail

No DMARC record. Receivers have no instruction to reject spoofed mail, and you get no visibility into who is sending as this domain.

FixThis domain sends no mail, so go straight to enforcement: publish a TXT record at _dmarc.quickplayrules.online: "v=DMARC1; p=reject; sp=reject; adkim=s; aspf=s". There is no legitimate mail to monitor first.

SPF

email.spf
Pass

SPF ends in `-all`, rejecting mail from unlisted senders.

v=spf1 -all
Pass

SPF uses 0 of 10 permitted DNS lookups.

DKIM

email.dkim
Info

No DKIM key found at any commonly-used selector. Selectors cannot be enumerated from DNS, so this does not prove DKIM is absent — check with your mail provider.

MTA-STS

email.mta_sts
Info

MTA-STS does not apply: this domain accepts no mail, so there is no inbound delivery to protect.

TLS reporting

email.tls_rpt
Info

TLS-RPT does not apply: this domain accepts no mail, so there is no inbound delivery to protect.

Mail servers

email.mx
Pass

Null MX published: this domain explicitly declares that it accepts no mail.

0 .

DNS

Weight 12 · Score 60

Integrity and issuance controls on the domain's DNS records.

DNSSEC

dns.dnssec
Warn

DNSSEC is not enabled. DNS answers for this domain can be forged by an attacker in a position to tamper with resolution.

FixEnable DNSSEC at your DNS host, then add the resulting DS record at your registrar. Most managed DNS providers do both in one click.

CAA

dns.caa
Warn

No CAA records. Any certificate authority in the world is permitted to issue certificates for this domain.

FixPublish a CAA record naming only the CAs you use, e.g. 0 issue "letsencrypt.org". Add an iodef address to be notified of violations.

Nameservers

dns.ns
Pass

2 nameserver(s).

ns2.dyna-ns.net, ns1.dyna-ns.net

TLS & certificate

Weight 20 · Score 100

The certificate and the encryption used to serve the site.

Certificate

tls.certificate
Pass

Certificate valid for another 61 day(s).

Let's Encrypt, notAfter 2026-12-25T13:54:18.000Z
Pass

Certificate covers quickplayrules.online.

Pass

The certificate chain validates against the public trust roots.

Pass

Negotiated TLSv1.3.

TLS_AES_128_GCM_SHA256

Connection strength

tls.strength
Pass

The connection uses forward secrecy, so recorded traffic stays private even if the server key is later stolen.

TLSv1.3, TLS_AES_128_GCM_SHA256
Pass

The server supports TLS 1.3.

TLSv1.3, TLS_AES_128_GCM_SHA256

Deprecated protocol versions

tls.legacy_protocols
Pass

TLS 1.0 and 1.1 are refused, so only current protocol versions are accepted.

HSTS preload

tls.hsts_preload
Info

The domain is not on the HSTS preload list. Preloading is optional and hard to undo; most sites do not need it.

HTTP headers

Weight 25 · Score 93

Response headers that constrain what a browser will do, and how a researcher can reach you about a problem.

Security headers

headers.security
Pass

HSTS is set with a long max-age.

max-age=63072000; includeSubDomains
Pass

Content-Security-Policy is set.

default-src 'self'; script-src 'self' 'wasm-unsafe-eval' https://www.googletagmanager.com 'sha256-FgDKl0vJ2rEgiWgUkgEZehV1TUAluNjCTup/VUk1HLs=' 'sha256-MW2uM7Hx++AOH75zqz3Dky8NLOkZZkpiu8PORAIuWK8=' 'sha256-NhgAiuYzy2sP5UVa/FaQx0FE6TxeZhJArfrPSJi/bp4=' 'sha256-b4gNrLa0m4OT8ooxVzTrH1Zot3/byyW747+w60mR
Info

style-src allows 'unsafe-inline'. That is far less dangerous than inline scripts, but it lets injected markup restyle the page, for example to fake a login form.

FixMove to nonce- or hash-based styles when the framework allows it.

Pass

X-Content-Type-Options: nosniff is set.

Pass

Referrer-Policy is set.

strict-origin-when-cross-origin

HTTPS redirect

headers.https_redirect
Pass

HTTP redirects to HTTPS (301).

https://quickplayrules.com

Cookies

headers.cookies
Info

No cookies were set on the homepage response.

Browser hardening headers

headers.hardening
Pass

Permissions-Policy is set.

camera=(), microphone=(), geolocation=(), payment=(), usb=()
Pass

Cross-Origin-Opener-Policy is set.

same-origin
Info

Neither Cross-Origin-Resource-Policy nor Cross-Origin-Embedder-Policy is set, so other sites may load this response as a sub-resource.

FixConsider `Cross-Origin-Resource-Policy: same-origin` for responses that are not meant to be embedded.

CORS

headers.cors
Info

Any website can read this response. That is fine for public data and wrong for anything user-specific.

access-control-allow-origin: *

security.txt

headers.security_txt
Warn

No security.txt. Someone who finds a vulnerability has no documented way to tell you.

FixPublish https://quickplayrules.online/.well-known/security.txt with at least a Contact: and an Expires: field (RFC 9116).

For the owner of quickplayrules.online

Show your grade

Put this badge on your homepage. It links to this report, and when a scan finds it on your site the report is marked verified, so visitors know the grade is yours.

The badge is not an official certification and not a security audit. It reflects only a few external checks, so don’t present it as proof of security or compliance. See the terms.

Surface grade badge for quickplayrules.online
Badge theme
I've added it: scan again

Publish the change first, then scan again. Surface looks for the badge on https://quickplayrules.online/ every time it scans. Reports are reused for 15 minutes, so a scan right after the last one may show the earlier result. The badge image can take up to an hour to show a new grade.

Surface keeps only the latest report for each domain. Re-inspecting quickplayrules.online will replace this report, and this link will stop resolving — use the stable link above if you want a URL that always reflects the current state.