Inspection record
trindogames.com
2026-10-23 05:48 UTC · 0.2s · 17 checks
This domain is in good shape. The checks below are the few things worth keeping an eye on.
Not an official certification. This grade covers only a few externally visible components and is not a security audit. A high grade does not mean a domain is secure. Terms
Stable link for trindogames.com →
What to fix first
93 → 100Ordered by how many points each fix adds to the score. Fixing everything would raise the score from 93 to 100, keeping the A grade. Re-scan afterwards to confirm.
- 1.+3 pts
DNSSEC is not enabled. DNS answers for this domain can be forged by an attacker in a position to tamper with resolution.
Enable DNSSEC at your DNS host, then add the resulting DS record at your registrar. Most managed DNS providers do both in one click.
Warn · DNS
- 2.+2 pts
No Permissions-Policy. Embedded third-party frames can request camera, microphone, geolocation and other powerful features unless you deny them.
Send `Permissions-Policy: camera=(), microphone=(), geolocation=()`, then allow only what the site uses.
Warn · HTTP headers
- 3.+1 pts
HSTS does not include subdomains, so subdomains can still be reached over plaintext HTTP.
Add `includeSubDomains` once every subdomain is confirmed to serve HTTPS.
Warn · HTTP headers
- 4.+1 pts
CAA has no `iodef` address, so you are not notified when a CA is asked to issue a certificate it should not.
Add: 0 iodef "mailto:security@trindogames.com".
Warn · DNS
Email authentication
Weight 35 · Score 100Whether someone can send mail pretending to be this domain.
DMARC
email.dmarcDMARC policy is `p=reject`.
v=DMARC1; p=reject
SPF
email.spfSPF ends in `-all`, rejecting mail from unlisted senders.
v=spf1 -all
SPF uses 0 of 10 permitted DNS lookups.
DKIM
email.dkimNo DKIM key found at any commonly-used selector. Selectors cannot be enumerated from DNS, so this does not prove DKIM is absent — check with your mail provider.
MTA-STS
email.mta_stsMTA-STS does not apply: this domain accepts no mail, so there is no inbound delivery to protect.
TLS reporting
email.tls_rptTLS-RPT does not apply: this domain accepts no mail, so there is no inbound delivery to protect.
Mail servers
email.mxNull MX published: this domain explicitly declares that it accepts no mail.
0 .
DNS
Weight 12 · Score 70Integrity and issuance controls on the domain's DNS records.
DNSSEC
dns.dnssecDNSSEC is not enabled. DNS answers for this domain can be forged by an attacker in a position to tamper with resolution.
FixEnable DNSSEC at your DNS host, then add the resulting DS record at your registrar. Most managed DNS providers do both in one click.
CAA
dns.caaCAA records restrict issuance to: pki.goog, sectigo.com, letsencrypt.org.
0 issue "pki.goog", 0 issue "sectigo.com", 0 issue "letsencrypt.org"
CAA has no `iodef` address, so you are not notified when a CA is asked to issue a certificate it should not.
FixAdd: 0 iodef "mailto:security@trindogames.com".
Nameservers
dns.ns2 nameserver(s).
ns2.vercel-dns.com, ns1.vercel-dns.com
TLS & certificate
Weight 20 · Score 100The certificate and the encryption used to serve the site.
Certificate
tls.certificateCertificate valid for another 52 day(s).
Let's Encrypt, notAfter 2026-12-14T10:27:18.000Z
Certificate covers trindogames.com.
The certificate chain validates against the public trust roots.
Negotiated TLSv1.3.
TLS_AES_128_GCM_SHA256
Deprecated protocol versions
tls.legacy_protocolsTLS 1.0 and 1.1 are refused, so only current protocol versions are accepted.
HSTS preload
tls.hsts_preloadThe domain is not on the HSTS preload list. Preloading is optional and hard to undo; most sites do not need it.
HTTP headers
Weight 25 · Score 87Response headers that constrain what a browser will do, and how a researcher can reach you about a problem.
Security headers
headers.securityHSTS is set with a long max-age.
max-age=63072000
HSTS does not include subdomains, so subdomains can still be reached over plaintext HTTP.
max-age=63072000
FixAdd `includeSubDomains` once every subdomain is confirmed to serve HTTPS.
Content-Security-Policy is set.
default-src 'self'; script-src 'self' 'sha256-2GtFyV4Aoe5eJTNMB5k5owqQsqdQwevCm15oEZjxYU4=' https://www.googletagmanager.com; style-src 'self'; img-src 'self' data: https://www.googletagmanager.com https://*.google-analytics.com https://*.analytics.google.com https://lemonlaunch.dev https://twelve.t
X-Content-Type-Options: nosniff is set.
Referrer-Policy is set.
no-referrer
HTTPS redirect
headers.https_redirectHTTP redirects to HTTPS (308).
https://trindogames.com/
Cookies
headers.cookiesNo cookies were set on the homepage response.
Browser hardening headers
headers.hardeningNo Permissions-Policy. Embedded third-party frames can request camera, microphone, geolocation and other powerful features unless you deny them.
FixSend `Permissions-Policy: camera=(), microphone=(), geolocation=()`, then allow only what the site uses.
No Cross-Origin-Opener-Policy. Pages that open or are opened by cross-origin windows keep a handle on each other, which cross-site leak attacks use.
FixConsider `Cross-Origin-Opener-Policy: same-origin` if the site does not rely on cross-origin popups.
Neither Cross-Origin-Resource-Policy nor Cross-Origin-Embedder-Policy is set, so other sites may load this response as a sub-resource.
FixConsider `Cross-Origin-Resource-Policy: same-origin` for responses that are not meant to be embedded.
CORS
headers.corsAny website can read this response. That is fine for public data and wrong for anything user-specific.
access-control-allow-origin: *
For the owner of trindogames.com
Show your grade
Put this badge on your homepage. It links to this report, and when a scan finds it on your site the report is marked verified, so visitors know the grade is yours.
The badge is not an official certification and not a security audit. It reflects only a few external checks, so don’t present it as proof of security or compliance. See the terms.
Publish the change first, then scan again. Surface looks for the badge on https://trindogames.com/ every time it scans. Reports are reused for 15 minutes, so a scan right after the last one may show the earlier result. The badge image can take up to an hour to show a new grade.
Surface keeps only the latest report for each domain. Re-inspecting trindogames.com will replace this report, and this link will stop resolving — use the stable link above if you want a URL that always reflects the current state.