Does sc.com have DMARC protection against email spoofing?

Yes. sc.com publishes a DMARC record with p=reject at 100% coverage, so receiving providers should reject mail forged from @sc.com.

How is sc.com's B security grade calculated?

CyberTrust scores sc.com passively across 6 area(s) — TLS encryption and certificates 100/100; external attack surface 100/100; reputation and credential exposure 100/100; DNS hygiene 92/100; HTTP security headers 62/100; email spoofing defences (SPF/DKIM/DMARC) 44/100 — and combines them by weight into the overall score of 80/100, which maps to grade B.

How many subdomains does sc.com expose?

This scan observed 154 publicly resolvable subdomain(s) for sc.com. Verified owners get the full list, with each host's open ports and running services.

Public security report

sc.com security rating

80/100

A means lowest risk and F means highest, like a school report card. How the score is calculated →

Scanned 2026-10-30 · 8 issue(s) found · 14 checks passed

Re-scan sc.com now

What this scan found

CyberTrust assessed sc.com passively — using only information that is publicly visible on the internet: DNS records, certificates, response headers and reachable services. The result is 80/100, grade B, where A means lowest risk and F means highest, like a school report card.

Email spoofing is blocked: sc.com publishes a DMARC record with p=reject at 100% coverage, so mail forged from @sc.com should be rejected by major providers.

Strongest area: TLS encryption and certificates (100/100). Weakest area: email spoofing defences (SPF/DKIM/DMARC) (44/100).

8 issue(s) need attention (1 high, 7 low), while 14 checks passed.

Infrastructure observed: mail is hosted by proofpoint.

154 subdomain(s) of sc.com resolve publicly.

1 of them resolve but return a server error instead of a page.

Score by category

Area	Score	Grade	Issues
DNS hygiene	92	A	1
email spoofing defences (SPF/DKIM/DMARC)	44	F	3
external attack surface	100	A	0
IP threat intelligence	—	—	0
reputation and credential exposure	100	A	0
TLS encryption and certificates	100	A	0
HTTP security headers	62	D	4

Issues found (8)

highSPF authorizes huge IP ranges (ip4:40.92.0.0/15, ip4:52.100.0.0/15)

Very large ranges (ip4:40.92.0.0/15, ip4:52.100.0.0/15) let anyone inside them - for example any customer of the same cloud provider - send mail as you.

1 asset(s) affected · worth +10 points · check an SPF record with the free SPF tool →

lowContent Security Policy is weak (no script-src/default-src; object-src not restricted)

The policy is too permissive (no script-src/default-src; object-src not restricted), so injected scripts still run while giving a false sense of security.

3 asset(s) affected · worth +2 points · how to set HSTS, CSP and other security headers →

lowWeak DKIM key: 1024-bit RSA (selector s2)

At 1024 bits (selector s2) the key is considered weak; 1024-bit keys can be broken cheaply, letting attackers sign mail that passes DKIM.

1 asset(s) affected · worth +2 points · look up DKIM keys with the free DKIM tool →

lowNo MTA-STS policy

Without it an attacker on the network path can force a downgrade to plaintext and read or modify mail such as contracts and payment details.

1 asset(s) affected · worth +2 points · how to stop email spoofing with SPF, DKIM and DMARC →

lowHSTS preload not enabled

Even with HSTS on, the very first visit is still exposed to SSL-stripping: the header only takes effect after one successful HTTPS visit. Browsers ship a preload list (Chromium's list is used by Chrome, Edge, Safari and Firefox) so the first connection goes straight to HTTPS.

2 asset(s) affected · worth +1 points · how to set HSTS, CSP and other security headers →

lowDNSSEC not enabled

Without it, attackers can poison caches or forge answers and send visitors to a lookalike server that harvests credentials.

1 asset(s) affected · worth +1 points · what DNSSEC prevents and how to enable it →

lowCookies without Secure/HttpOnly (incap_ses_139_3232176, nlbi_3232176, visid_incap_3232176)

Missing Secure lets cookies travel in plaintext; missing HttpOnly lets injected scripts steal sessions; missing SameSite enables CSRF. Affected: incap_ses_139_3232176, nlbi_3232176, visid_incap_3232176.

1 asset(s) affected · worth +1 points · how to set HSTS, CSP and other security headers →

low1 subdomain(s) return a server error

Some hostnames of this domain resolve publicly but answer with an HTTP server error instead of a page. Visitors who follow such a link see a gateway error, search engines index the error, and a hostname that resolves but serves nothing is also a takeover waiting to happen once the record is removed.

1 asset(s) affected · worth +1 points · how to set HSTS, CSP and other security headers →

Checks passed

Mail exchangers configured
DMARC policy is enforced
Name servers are redundant
CAA restricts which CAs may issue certificates
HSTS enabled
Clickjacking protection enabled
MIME sniffing disabled
No API keys found in front-end bundles
Only modern TLS versions are enabled
No weak cipher suites accepted
Certificate is valid and trusted
No risky services found exposed
No shadow-AI services exposed
No mail-server IP on spam blocklists

What we detected

mail provider: proofpoint
subdomain count: 154

What could not be fully checked

No BIMI record
BIMI shows your logo next to authenticated mail in supporting inboxes (requires an enforcing DMARC policy). It is a trust signal rather than a security control, so it does not affect your score.
No TLS-RPT record
TLS-RPT sends you reports when other servers fail to deliver mail to you securely. Recommended alongside MTA-STS.
No Permissions-Policy 3 host(s)
Permissions-Policy disables powerful browser features (camera, microphone, geolocation) you do not use.
No security.txt 2 host(s)
security.txt (RFC 9116) tells security researchers how to report vulnerabilities to you instead of posting them publicly.
Website not reachable 5 host(s)
The site could not be fetched, so its response headers and page content were not checked.
Website returned an error page — partly unassessed 2 host(s)
The page returned HTTP 503 (often a firewall challenge for automated clients), so most header and content checks could not run. HSTS was still assessed where the response is reliable, but this category is only partially evaluated and its score should be read as incomplete.
No Referrer-Policy
Browsers default to strict-origin-when-cross-origin today; setting it explicitly is good hygiene.
HTTPS not available on port 443 4 host(s)
The TLS checks could not run on this host, so its TLS configuration was not verified.

Frequently asked questions about sc.com security

Does sc.com have DMARC protection against email spoofing?: Yes. sc.com publishes a DMARC record with p=reject at 100% coverage, so receiving providers should reject mail forged from @sc.com.
How is sc.com's B security grade calculated?: CyberTrust scores sc.com passively across 6 area(s) — TLS encryption and certificates 100/100; external attack surface 100/100; reputation and credential exposure 100/100; DNS hygiene 92/100; HTTP security headers 62/100; email spoofing defences (SPF/DKIM/DMARC) 44/100 — and combines them by weight into the overall score of 80/100, which maps to grade B.
What is the most serious issue found on sc.com?: SPF authorizes huge IP ranges (ip4:40.92.0.0/15, ip4:52.100.0.0/15) (severity high). Very large ranges (ip4:40.92.0.0/15, ip4:52.100.0.0/15) let anyone inside them - for example any customer of the same cloud provider - send mail as you. Fixing it is worth about +10 points.
How many subdomains does sc.com expose?: This scan observed 154 publicly resolvable subdomain(s) for sc.com. Verified owners get the full list, with each host's open ports and running services.

What a verified owner of sc.com sees

Everything above is what anyone can observe from the internet. Domain owners who verify ownership additionally get the full asset inventory — every subdomain with its open ports and running services — look-alike and typosquatting domains registered against the brand, credential-exposure monitoring, and copy-paste fixes for each finding.

Verify ownership of sc.com (free) → Open the live interactive report →