mediumDMARC is monitor-only (p=none)
p=none does not stop anything - forged mail still reaches the inbox. It is only meant as an observation phase.
Public security report
cathaypacific.com security rating
B
86/100
A means lowest risk and F means highest, like a school report card. How the score is calculated →
Scanned 2026-10-30 · 7 issue(s) found · 12 checks passed
What this scan found
CyberTrust assessed cathaypacific.com passively — using only information that is publicly visible on the internet: DNS records, certificates, response headers and reachable services. The result is 86/100, grade B, where A means lowest risk and F means highest, like a school report card.
Email spoofing is possible: a DMARC record exists for cathaypacific.com, but its policy is p=none — receivers are asked to report spoofed mail, not to reject it.
Strongest area: external attack surface (100/100). Weakest area: email spoofing defences (SPF/DKIM/DMARC) (64/100).
7 issue(s) need attention (1 medium, 6 low), while 12 checks passed.
Infrastructure observed: mail is hosted by cisco, DNS is served by akamai.
557 subdomain(s) of cathaypacific.com resolve publicly.
Score by category
| Area | Score | Grade | Issues |
|---|---|---|---|
| DNS hygiene | 84 | B | 2 |
| email spoofing defences (SPF/DKIM/DMARC) | 64 | D | 3 |
| external attack surface | 100 | A | 0 |
| IP threat intelligence | — | — | 0 |
| reputation and credential exposure | 100 | A | 0 |
| TLS encryption and certificates | 84 | B | 1 |
| HTTP security headers | 90 | A | 1 |
Issues found (7)
lowNo OCSP stapling
The server does not staple the certificate revocation status. Every revocation check becomes an extra round trip to the CA, which slows the first visit and, if the CA endpoint is unreachable or the visitor's network blocks it, leaves the browser without a usable revocation status.
lowNo DKIM key found on common selectors
Without DKIM, mail integrity cannot be verified and DMARC loses one of its two authentication pillars. Note we probed only 46 common selectors, so a custom selector may exist.
lowNo MTA-STS policy
Without it an attacker on the network path can force a downgrade to plaintext and read or modify mail such as contracts and payment details.
lowContent Security Policy is weak (no script-src/default-src; object-src not restricted)
The policy is too permissive (no script-src/default-src; object-src not restricted), so injected scripts still run while giving a false sense of security.
lowNo CAA record
Without it any CA may issue certificates for your domain, enabling a lookalike site with a valid padlock.
lowDNSSEC not enabled
Without it, attackers can poison caches or forge answers and send visitors to a lookalike server that harvests credentials.
Checks passed
- Mail exchangers configured
- SPF record is valid
- Name servers are redundant
- HSTS enabled
- Clickjacking protection enabled
- MIME sniffing disabled
- Only modern TLS versions are enabled
- No weak cipher suites accepted
- Certificate is valid and trusted
- No risky services found exposed
- No shadow-AI services exposed
- No mail-server IP on spam blocklists
What we detected
- mail provider
- cisco
- dns provider
- akamai
- subdomain count
- 557
What could not be fully checked
- No BIMI record
BIMI shows your logo next to authenticated mail in supporting inboxes (requires an enforcing DMARC policy). It is a trust signal rather than a security control, so it does not affect your score. - No TLS-RPT record
TLS-RPT sends you reports when other servers fail to deliver mail to you securely. Recommended alongside MTA-STS. - Website not reachable
The site could not be fetched, so its response headers and page content were not checked. - No Referrer-Policy
Browsers default to strict-origin-when-cross-origin today; setting it explicitly is good hygiene. - No Permissions-Policy
Permissions-Policy disables powerful browser features (camera, microphone, geolocation) you do not use.
Frequently asked questions about cathaypacific.com security
- Does cathaypacific.com have DMARC protection against email spoofing?
- No. cathaypacific.com has a DMARC record, but its policy is p=none: receivers are asked to report spoofed mail rather than reject it, so forged messages still get delivered.
- How is cathaypacific.com's B security grade calculated?
- CyberTrust scores cathaypacific.com passively across 6 area(s) — external attack surface 100/100; reputation and credential exposure 100/100; HTTP security headers 90/100; TLS encryption and certificates 84/100; DNS hygiene 84/100; email spoofing defences (SPF/DKIM/DMARC) 64/100 — and combines them by weight into the overall score of 86/100, which maps to grade B.
- What is the most serious issue found on cathaypacific.com?
- DMARC is monitor-only (p=none) (severity medium). p=none does not stop anything - forged mail still reaches the inbox. It is only meant as an observation phase. Fixing it is worth about +5 points.
- How many subdomains does cathaypacific.com expose?
- This scan observed 557 publicly resolvable subdomain(s) for cathaypacific.com. Verified owners get the full list, with each host's open ports and running services.
What a verified owner of cathaypacific.com sees
Everything above is what anyone can observe from the internet. Domain owners who verify ownership additionally get the full asset inventory — every subdomain with its open ports and running services — look-alike and typosquatting domains registered against the brand, credential-exposure monitoring, and copy-paste fixes for each finding.
Verify ownership of cathaypacific.com (free) → Open the live interactive report →