Does bochk.com have DMARC protection against email spoofing?

Partly. bochk.com publishes DMARC with p=quarantine at 100% coverage — better than nothing, but forged messages can still reach inboxes that do not enforce the policy.

How is bochk.com's B security grade calculated?

CyberTrust scores bochk.com passively across 6 area(s) — external attack surface 100/100; reputation and credential exposure 100/100; email spoofing defences (SPF/DKIM/DMARC) 92/100; DNS hygiene 84/100; HTTP security headers 80/100; TLS encryption and certificates 44/100 — and combines them by weight into the overall score of 84/100, which maps to grade B. The grade is capped by the most serious findings, because an attacker only needs the weakest link.

How many subdomains does bochk.com expose?

This scan observed 85 publicly resolvable subdomain(s) for bochk.com. Verified owners get the full list, with each host's open ports and running services.

Public security report

bochk.com security rating

84/100

A means lowest risk and F means highest, like a school report card. How the score is calculated →

Scanned 2026-10-30 · 7 issue(s) found · 16 checks passed

Re-scan bochk.com now

What this scan found

CyberTrust assessed bochk.com passively — using only information that is publicly visible on the internet: DNS records, certificates, response headers and reachable services. The result is 84/100, grade B, where A means lowest risk and F means highest, like a school report card.

Email spoofing is only partly blocked: DMARC is published with p=quarantine at 100% coverage, so forged mail can still reach inboxes that do not enforce the policy.

Strongest area: external attack surface (100/100). Weakest area: TLS encryption and certificates (44/100).

7 issue(s) need attention (1 high, 6 low), while 16 checks passed.

Infrastructure observed: DNS is served by akamai.

85 subdomain(s) of bochk.com resolve publicly.

Score by category

Area	Score	Grade	Issues
DNS hygiene	84	B	2
email spoofing defences (SPF/DKIM/DMARC)	92	A	1
external attack surface	100	A	0
IP threat intelligence	—	—	0
reputation and credential exposure	100	A	0
TLS encryption and certificates	44	F	2
HTTP security headers	80	B	2

Issues found (7)

highCertificate does not match the hostname

This certificate is issued for www.bochk.com, so browsers warn; typical causes are missing the bare domain, a stale name, or an incomplete SAN list.

1 asset(s) affected · worth +7 points · check a certificate with the free SSL tool →

lowNo OCSP stapling

The server does not staple the certificate revocation status. Every revocation check becomes an extra round trip to the CA, which slows the first visit and, if the CA endpoint is unreachable or the visitor's network blocks it, leaves the browser without a usable revocation status.

5 asset(s) affected · worth +2 points · check a certificate with the free SSL tool →

lowHSTS preload not enabled

Even with HSTS on, the very first visit is still exposed to SSL-stripping: the header only takes effect after one successful HTTPS visit. Browsers ship a preload list (Chromium's list is used by Chrome, Edge, Safari and Firefox) so the first connection goes straight to HTTPS.

2 asset(s) affected · worth +2 points · how to set HSTS, CSP and other security headers →

lowNo MTA-STS policy

Without it an attacker on the network path can force a downgrade to plaintext and read or modify mail such as contracts and payment details.

1 asset(s) affected · worth +2 points · how to stop email spoofing with SPF, DKIM and DMARC →

lowContent Security Policy is weak (no script-src/default-src; object-src not restricted)

The policy is too permissive (no script-src/default-src; object-src not restricted), so injected scripts still run while giving a false sense of security.

2 asset(s) affected · worth +1 points · how to set HSTS, CSP and other security headers →

lowNo CAA record

Without it any CA may issue certificates for your domain, enabling a lookalike site with a valid padlock.

1 asset(s) affected · worth +1 points · see who can issue certificates with the free CAA tool →

lowDNSSEC not enabled

Without it, attackers can poison caches or forge answers and send visitors to a lookalike server that harvests credentials.

1 asset(s) affected · worth +1 points · what DNSSEC prevents and how to enable it →

Checks passed

Mail exchangers configured
SPF record is valid
DMARC policy is enforced
DKIM signing keys found
Name servers are redundant
HSTS enabled
Clickjacking protection enabled
MIME sniffing disabled
Content Security Policy in place
No API keys found in front-end bundles
Only modern TLS versions are enabled
No weak cipher suites accepted
Certificate is valid and trusted
No risky services found exposed
No shadow-AI services exposed
No mail-server IP on spam blocklists

What we detected

dns provider: akamai
subdomain count: 85

What could not be fully checked

DMARC quarantines spoofed mail
p=quarantine sends failing mail to spam. p=reject blocks it outright and is the strongest protection.
No BIMI record
BIMI shows your logo next to authenticated mail in supporting inboxes (requires an enforcing DMARC policy). It is a trust signal rather than a security control, so it does not affect your score.
No TLS-RPT record
TLS-RPT sends you reports when other servers fail to deliver mail to you securely. Recommended alongside MTA-STS.
No Referrer-Policy 3 host(s)
Browsers default to strict-origin-when-cross-origin today; setting it explicitly is good hygiene.
No Permissions-Policy 3 host(s)
Permissions-Policy disables powerful browser features (camera, microphone, geolocation) you do not use.
No security.txt 2 host(s)
security.txt (RFC 9116) tells security researchers how to report vulnerabilities to you instead of posting them publicly.
Website not reachable 5 host(s)
The site could not be fetched, so its response headers and page content were not checked.
Website returned an error page — partly unassessed 2 host(s)
The page returned HTTP 400 (often a firewall challenge for automated clients), so most header and content checks could not run. HSTS was still assessed where the response is reliable, but this category is only partially evaluated and its score should be read as incomplete.
TLS 1.3 not enabled 5 host(s)
TLS 1.3 is faster and removes legacy cryptography. Recommended, but not required.
RSA key exchange still accepted 5 host(s)
Static RSA key exchange is kept for old clients. It lacks forward secrecy but is not scored when ECDHE is available.
HTTPS not available on port 443 5 host(s)
The TLS checks could not run on this host, so its TLS configuration was not verified.

Frequently asked questions about bochk.com security

Does bochk.com have DMARC protection against email spoofing?: Partly. bochk.com publishes DMARC with p=quarantine at 100% coverage — better than nothing, but forged messages can still reach inboxes that do not enforce the policy.
How is bochk.com's B security grade calculated?: CyberTrust scores bochk.com passively across 6 area(s) — external attack surface 100/100; reputation and credential exposure 100/100; email spoofing defences (SPF/DKIM/DMARC) 92/100; DNS hygiene 84/100; HTTP security headers 80/100; TLS encryption and certificates 44/100 — and combines them by weight into the overall score of 84/100, which maps to grade B. The grade is capped by the most serious findings, because an attacker only needs the weakest link.
What is the most serious issue found on bochk.com?: Certificate does not match the hostname (severity high). This certificate is issued for www.bochk.com, so browsers warn; typical causes are missing the bare domain, a stale name, or an incomplete SAN list. Fixing it is worth about +7 points.
How many subdomains does bochk.com expose?: This scan observed 85 publicly resolvable subdomain(s) for bochk.com. Verified owners get the full list, with each host's open ports and running services.

What a verified owner of bochk.com sees

Everything above is what anyone can observe from the internet. Domain owners who verify ownership additionally get the full asset inventory — every subdomain with its open ports and running services — look-alike and typosquatting domains registered against the brand, credential-exposure monitoring, and copy-paste fixes for each finding.

Verify ownership of bochk.com (free) → Open the live interactive report →