Email Security Analysis of tfsi.dev

Complete verification of tfsi.dev's SPF, DKIM, DMARC, and MTA-STS records. Find out if this domain is protected against email spoofing.

Last updated: April 15, 2026

65C

This domain is vulnerable to spoofing

Warning

v=spf1 mx ~all

Selectors: mail

Warning

v=DMARC1; p=none; rua=mailto:dmarc-reports@tfsi.dev; ruf=mailto:dmarc-reports@tfsi.dev; sp=none; ri=43200

mail.tfsi.dev

Warning

v=STSv1; id=20240405022800

1Change your DMARC policy from p=none to p=reject to block spoofing
With p=none, your DMARC record only monitors — it doesn't actually block spoofed emails. Attackers can still send emails as your domain and they'll be delivered normally. Switching to p=reject instructs receiving servers to drop fraudulent messages before they reach the inbox.
2Harden your SPF by replacing ~all with -all (hardfail)
With ~all (softfail), unauthorized senders are flagged but emails are usually still delivered. Switching to -all (hardfail) explicitly tells receiving servers to reject emails from unauthorized sources, providing much stronger protection against spoofing.
3Fix your MTA-STS policy file — it could not be fetched
Your domain has an MTA-STS DNS record, but the policy file at https://mta-sts.yourdomain/.well-known/mta-sts.txt is unreachable. Without a valid policy file, MTA-STS provides no protection. Check that the subdomain mta-sts.yourdomain resolves correctly and serves the policy over HTTPS.

If you're not sure how to apply these fixes, get in touch and we'll help you out.

Run a live analysis

The results above are updated daily. For an instant check of tfsi.dev, run a live analysis.

Understand how SPF defines which servers are authorized to send emails for a domain.

Discover how DKIM cryptographically signs your emails to guarantee their authenticity.

Learn how DMARC orchestrates SPF and DKIM to protect your domain.

Learn how MTA-STS enforces TLS encryption to protect your emails in transit.

Compare the three protocols and understand how they work together.