Email Security Analysis of tcy.com

Recommendations

1. 1Change your DMARC policy from p=none to p=reject to block spoofing▾

   With p=none, your DMARC record only monitors — it doesn't actually block spoofed emails. Attackers can still send emails as your domain and they'll be delivered normally. Switching to p=reject instructs receiving servers to drop fraudulent messages before they reach the inbox.

2. 2Harden your SPF by replacing ~all with -all (hardfail)▾

   With ~all (softfail), unauthorized senders are flagged but emails are usually still delivered. Switching to -all (hardfail) explicitly tells receiving servers to reject emails from unauthorized sources, providing much stronger protection against spoofing.

3. 3Enable DKIM in your email provider and add the public key to your DNS zone▾

   DKIM adds a cryptographic signature to your emails, proving they haven't been tampered with in transit and genuinely originated from your domain. Without it, attackers can forge emails that pass basic checks, and your legitimate emails are more likely to land in spam.

4. 4Fix your MTA-STS policy file — it could not be fetched▾

   Your domain has an MTA-STS DNS record, but the policy file at https://mta-sts.yourdomain/.well-known/mta-sts.txt is unreachable. Without a valid policy file, MTA-STS provides no protection. Check that the subdomain mta-sts.yourdomain resolves correctly and serves the policy over HTTPS.