Does tradeprotected.com have DMARC protection against email spoofing?

No. No DMARC record was found for tradeprotected.com, so mail forged from @tradeprotected.com has no policy-based barrier at all.

How is tradeprotected.com's C security grade calculated?

CyberTrust scores tradeprotected.com passively across 6 area(s) — external attack surface 100/100; reputation and credential exposure 100/100; TLS encryption and certificates 90/100; DNS hygiene 84/100; HTTP security headers 45/100; email spoofing defences (SPF/DKIM/DMARC) 44/100 — and combines them by weight into the overall score of 76/100, which maps to grade C.

How many subdomains does tradeprotected.com expose?

This scan observed 1 publicly resolvable subdomain(s) for tradeprotected.com. Verified owners get the full list, with each host's open ports and running services.

Public security report

tradeprotected.com security rating

76/100

A means lowest risk and F means highest, like a school report card. How the score is calculated →

Scanned 2026-10-26 · 10 issue(s) found · 10 checks passed

Re-scan tradeprotected.com now

What this scan found

CyberTrust assessed tradeprotected.com passively — using only information that is publicly visible on the internet: DNS records, certificates, response headers and reachable services. The result is 76/100, grade C, where A means lowest risk and F means highest, like a school report card.

Email spoofing is possible: no DMARC record was found for tradeprotected.com, so anyone can send mail that appears to come from @tradeprotected.com.

Strongest area: external attack surface (100/100). Weakest area: email spoofing defences (SPF/DKIM/DMARC) (44/100).

10 issue(s) need attention (1 high, 1 medium, 8 low), while 10 checks passed.

Infrastructure observed: DNS is served by cloudflare, traffic is fronted by cloudflare, the web server identifies as cloudflare.

1 subdomain(s) of tradeprotected.com resolve publicly.

Score by category

Area	Score	Grade	Issues
DNS hygiene	84	B	2
email spoofing defences (SPF/DKIM/DMARC)	44	F	3
external attack surface	100	A	0
IP threat intelligence	—	—	0
reputation and credential exposure	100	A	0
TLS encryption and certificates	90	A	1
HTTP security headers	45	F	4

Issues found (10)

highNo DMARC policy

Without it, spoofed mail is usually delivered as normal and you receive no visibility at all; bulk senders are also required by major mailbox providers to publish DMARC.

1 asset(s) affected · worth +10 points · check any domain's DMARC record with the free DMARC tool →

mediumHSTS not enabled

Without it, an attacker can strip SSL on the first HTTP request and keep the user on plaintext (SSL stripping), a common attack on public Wi-Fi.

2 asset(s) affected · worth +4 points · how to set HSTS, CSP and other security headers →

lowNo MTA-STS policy

Without it an attacker on the network path can force a downgrade to plaintext and read or modify mail such as contracts and payment details.

1 asset(s) affected · worth +2 points · how to stop email spoofing with SPF, DKIM and DMARC →

lowSPF soft-fails without DMARC enforcement

Without an enforcing DMARC policy most receivers still deliver forged mail to the inbox.

1 asset(s) affected · worth +2 points · check an SPF record with the free SPF tool →

lowNo OCSP stapling

The server does not staple the certificate revocation status. Every revocation check becomes an extra round trip to the CA, which slows the first visit and, if the CA endpoint is unreachable or the visitor's network blocks it, leaves the browser without a usable revocation status.

2 asset(s) affected · worth +1 points · check a certificate with the free SSL tool →

lowNo Content Security Policy

Without it, any injected script runs: session theft, fake payment forms, or card-skimming scripts on compromised pages. CSP limits the damage even when something else fails.

2 asset(s) affected · worth +1 points · how to set HSTS, CSP and other security headers →

lowX-Content-Type-Options missing

Without it a file uploaded as an image can be executed as HTML/JavaScript on your domain, stealing same-site cookies and sessions.

2 asset(s) affected · worth +1 points · how to set HSTS, CSP and other security headers →

lowNo clickjacking protection

Without it, attackers overlay a transparent frame of your page and trick users into clicking real actions such as transfers or password changes (clickjacking).

2 asset(s) affected · worth +1 points · how to set HSTS, CSP and other security headers →

lowNo CAA record

Without it any CA may issue certificates for your domain, enabling a lookalike site with a valid padlock.

1 asset(s) affected · worth +1 points · see who can issue certificates with the free CAA tool →

lowDNSSEC not enabled

Without it, attackers can poison caches or forge answers and send visitors to a lookalike server that harvests credentials.

1 asset(s) affected · worth +1 points · what DNSSEC prevents and how to enable it →

Checks passed

Mail exchangers configured
SPF record is valid
DKIM signing keys found
Name servers are redundant
No API keys found in front-end bundles
Only modern TLS versions are enabled
No weak cipher suites accepted
Certificate is valid and trusted
No shadow-AI services exposed
No mail-server IP on spam blocklists

What we detected

dns provider: cloudflare
cdn: cloudflare
web server: cloudflare
subdomain count: 1

What could not be fully checked

No BIMI record
BIMI shows your logo next to authenticated mail in supporting inboxes (requires an enforcing DMARC policy). It is a trust signal rather than a security control, so it does not affect your score.
No TLS-RPT record
TLS-RPT sends you reports when other servers fail to deliver mail to you securely. Recommended alongside MTA-STS.
No Referrer-Policy 2 host(s)
Browsers default to strict-origin-when-cross-origin today; setting it explicitly is good hygiene.
No Permissions-Policy 2 host(s)
Permissions-Policy disables powerful browser features (camera, microphone, geolocation) you do not use.
No security.txt 2 host(s)
security.txt (RFC 9116) tells security researchers how to report vulnerabilities to you instead of posting them publicly.
All hosts are behind a CDN or hosting platform

Frequently asked questions about tradeprotected.com security

Does tradeprotected.com have DMARC protection against email spoofing?: No. No DMARC record was found for tradeprotected.com, so mail forged from @tradeprotected.com has no policy-based barrier at all.
How is tradeprotected.com's C security grade calculated?: CyberTrust scores tradeprotected.com passively across 6 area(s) — external attack surface 100/100; reputation and credential exposure 100/100; TLS encryption and certificates 90/100; DNS hygiene 84/100; HTTP security headers 45/100; email spoofing defences (SPF/DKIM/DMARC) 44/100 — and combines them by weight into the overall score of 76/100, which maps to grade C.
What is the most serious issue found on tradeprotected.com?: No DMARC policy (severity high). Without it, spoofed mail is usually delivered as normal and you receive no visibility at all; bulk senders are also required by major mailbox providers to publish DMARC. Fixing it is worth about +10 points.
How many subdomains does tradeprotected.com expose?: This scan observed 1 publicly resolvable subdomain(s) for tradeprotected.com. Verified owners get the full list, with each host's open ports and running services.

What a verified owner of tradeprotected.com sees

Everything above is what anyone can observe from the internet. Domain owners who verify ownership additionally get the full asset inventory — every subdomain with its open ports and running services — look-alike and typosquatting domains registered against the brand, credential-exposure monitoring, and copy-paste fixes for each finding.

Verify ownership of tradeprotected.com (free) → Open the live interactive report →