DMARC, SPF, and what a public scan can infer about email posture

Website scans are not inbox penetration tests

Scorifya resolves public DNS records the same way many receivers would: SPF and DMARC on the organizational domain (with a conservative parent-domain heuristic when subdomains publish differently), common DKIM selector guesses, and MX targets. We do not send email, forge messages, or log into providers—so we cannot prove deliverability or spoofing outcomes end to end.

If your goal is a single entry point that explains the whole breadth-first model, read the website security scanner page before diving into individual categories.

Why p=none still produces guidance

A DMARC record in monitoring mode tells receivers policy is defined but not yet enforced. For hardening programs, that is often an intentional phase—yet it is still observable signal teams track alongside TLS and headers. Our methodology spells out how those signals participate in weights without pretending we executed a phishing campaign against you.

Category weights, penalties, and explicit non-goals live on the methodology page if you need to quote them in a design doc.

Pair DNS context with what browsers see

Email authentication is one slice of attack surface; framing headers, MIME sniffing controls, and HTTPS upgrades are another. The product value is seeing both classes in one prioritized list after a single URL entry—not proving compliance with a specific framework in one click.