Security Analysis
americastrustpharmacy.com
D
95 / 185
2 critical2 high1 medium
Basic Security
10/40 (25%)DNSSEC Enabledhigh
DNSSEC protects against DNS spoofing and cache poisoning
→ Enable DNSSEC to protect against DNS spoofing and cache poisoning attacks. Contact your domain registrar to enable DNSSEC.
Multiple Nameservers
Multiple nameservers provide redundancy
Nameserver Diversitylow
Nameservers on different networks improve resilience
→ Both nameservers are run by one operator (emu-dns.com). If it has an outage, the domain stops resolving; a second DNS provider protects against that.
Record Security
0/45 (0%)CAA Recordshigh
CAA restricts which CAs can issue certificates
→ Add CAA records to specify which Certificate Authorities are allowed to issue certificates for your domain. Example: 0 issue "letsencrypt.org"
SPF Recordcritical
SPF prevents email spoofing
→ Add an SPF record to prevent email spoofing. Example: v=spf1 include:_spf.google.com -all
DMARC Recordcritical
DMARC protects against phishing
→ Add a DMARC record at _dmarc.yourdomain.com. Example: v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com
DKIM Presencenot checked
No DKIM key at the common selectors we try (default, google, selector1, selector2, k1, s1 and others). Many senders use their own selector names, so DKIM may still be set up. Not scored.
→ If this domain sends mail, look up the selector your email provider gave you with the DKIM checker (/dkim-checker).
Advanced Security
10/25 (40%)Mail Server Configurationmedium
Multiple MX records provide email redundancy
→ No MX records found. If you use email, configure MX records pointing to your mail server.
SOA Record Configuration
SOA timers that do not delay new names or expire secondaries (refresh 1d, retry 3h, expire 7d, SOA minimum 1m)
IPv6 Supportlow
AAAA records enable IPv6 connectivity
→ No IPv6 (AAAA) records found. Consider adding IPv6 support for future-proofing.
Domain Reputation
30/30 (100%)Typosquatting Check
Domain does not mimic protected brands
Domain Blacklist Statusnot checked
Domain blacklists (Spamhaus DBL, SURBL, URIBL) could not be checked — every query timed out or errored
→ Blacklist status is unknown, not clean. Re-run the report to check.
IP Blacklist Status
Server IP addresses checked against spam and abuse blacklists (Spamhaus ZEN, SpamCop, Barracuda)
Threat Detection
45/45 (100%)DGA Detection
Domain Generation Algorithm detection
DNS Tunneling Detection
Detection of data exfiltration via DNS
Fast-Flux Detection
Detection of rapidly changing DNS infrastructure
Domain Age Checknot checked
Registration date not available from the registry, so domain age could not be checked