Proof First — External Security Review — smartsecuritys.com
Prepared October 26, 2026 · Public, outside-view checks only
| Section | Score | Weight | Counts for |
|---|
| Email security | 64 / 100 | 40% | 25.6 |
| Website & encryption | 35 / 35 | 35 pts | 35.0 |
| Exposed services | not measured | 25 pts | — |
| Overall | | | 81 / 100 |
Overall is based on the email and website sections (75 points, scaled to 100) — the exposed-services check could not run from this network.
1 · Email security 64 / 100
Mail routing (MX records)ON TRACKEmail is routed through Microsoft 365.
Mail routing is the front door for business email; healthy routing keeps mail flowing to a real provider.
Sender policy (SPF)ON TRACKSPF is published with a hard fail (-all) and uses 3 of the 10 allowed DNS lookups.
SPF tells receiving servers which senders may use your domain, so forged mail can be spotted.
Spoofing policy (DMARC)WORTH ATTENTIONDMARC policy is p=quarantine — forged email is sent to spam folders rather than refused outright.
DMARC is the rule that tells the world what to do with email pretending to be you — the core defense against spoofing.
Message signing (DKIM)WORTH ATTENTIONNo DKIM keys were found at the common selector names we probed (selector1, selector2, google, default, mail, k1, s1, s2). That does not prove DKIM is off — the domain may sign with a different selector name.
DKIM signs outgoing mail so receivers can verify it really came from your systems.
Delivery encryption policy (MTA-STS)WORTH ATTENTIONNeither MTA-STS nor TLS-RPT records were found. These are bonus protections that guard delivery encryption.
MTA-STS and TLS-RPT protect the delivery path itself, keeping mail encrypted in transit.
| Scoring | Points | Possible |
|---|
| Mail routing (MX records) — Strong | 10 | 10 |
| Sender policy (SPF) — Strong | 25 | 25 |
| Spoofing policy (DMARC) — Needs Attention | 13.5 | 30 |
| Message signing (DKIM) — Needs Attention | 11.2 | 25 |
| Delivery encryption policy (MTA-STS) — Needs Attention | 4.5 | 10 |
| Email security subtotal | 64 | 100 |
2 · Website & encryption 35 / 35
HTTPS is on and the certificate is validON TRACKThe site answers on https://smartsecuritys.com (HTTP status 200) and presents a valid certificate issued by Let's Encrypt.
Encryption in transit keeps visitor traffic and form submissions private.
Plain HTTP redirects to HTTPSON TRACKVisitors who type the plain http:// address are bounced to the encrypted version automatically.
This closes the unencrypted side door without relying on the visitor to notice.
Certificate is comfortably currentON TRACKThe certificate runs until December 25, 2026 — 59 days from this review.
An expired certificate triggers full-page browser warnings that drive visitors off.
Modern encryption standard (TLSv1.2)ON TRACKThe connection negotiates TLSv1.2.
Current TLS versions close the weaknesses found in the older standards attackers still probe for.
Protective headers in placeON TRACKThe site sends: Strict-Transport-Security (HSTS), Content-Security-Policy, X-Content-Type-Options, Referrer-Policy.
These headers add cheap, always-on protection against common web attacks.
Clickjacking protection is onON TRACKThe site tells browsers it may not be framed by other sites (X-Frame-Options).
This stops attackers from embedding your pages inside look-alike pages to trick your visitors.
Software versions stay privateON TRACKThe site's headers do not announce product versions.
Attackers scanning the street learn less about what to aim at.
| Scoring | Points | Possible |
|---|
| Site loads over HTTPS with a valid certificate | 10 | 10 |
| Certificate lifetime (59 days left) | 3 | 3 |
| Modern TLS version (TLSv1.2) | 2 | 2 |
| Header present: Strict-Transport-Security (HSTS) | 5 | 5 |
| Header present: Content-Security-Policy | 5 | 5 |
| Header present: X-Content-Type-Options | 3 | 3 |
| Header present: Referrer-Policy | 2 | 2 |
| Clickjacking protection (frame rules) | 4 | 4 |
| No software version disclosure | 1 | 1 |
| Website & encryption subtotal | 35 | 35 |
3 · Exposed services not measured
This section was not measured this run (see the note inside).
Exposed-services check could not run from this networkWORTH ATTENTIONThe network this review ran on intercepts outbound connections to service ports, so open/closed answers would not be trustworthy and none are reported. Run the Prospect Report tool from a normal internet connection to complete this section.
This section is left honestly blank rather than filled with numbers nobody verified.
Not scored this run: the review network intercepts outbound service connections, so no port results are reported rather than guessed.
4 · Domain basics
| A | 148.72.0.193 |
| AAAA | lookup unavailable this run |
| MX | 0 smartsecuritys-com.mail.protection.outlook.com |
| NS | lookup unavailable this run |
6 unique subdomains appear in public certificate-transparency records.
6 subdomains are visible in public certificate recordsON TRACKCertificate-transparency logs show these public names: cpanel.smartsecuritys.com, mail.smartsecuritys.com, pay.smartsecuritys.com, webdisk.smartsecuritys.com, www.pay.smartsecuritys.com, www.smartsecuritys.com.
Every public subdomain is another door to keep patched and accounted for; forgotten test sites are a common way in.
What we would fix first
- Move DMARC to enforcement (p=quarantine, then p=reject) so forged mail claiming to be from the domain is refused, with reporting turned on.
- Turn on DKIM signing for outgoing mail so receivers can verify messages genuinely came from the domain.
- Publish MTA-STS and TLS reporting records to protect mail delivery encryption.
Start with a free email checkup
We will walk through this review with you, confirm every finding, and price the fixes in
plain numbers before any work begins. Call (833) 365-7047 or email
info@smartsecuritys.com.