Findings reference

Every finding code Lookproof can report, grouped by topic, with what it means, why it matters and what to do about it.

Check (3)

Warning CHECK_DEADLINE_EXCEEDED The check did not finish within its time limit.
Warning CHECK_INTERNAL_ERROR The check failed because of an internal error.
Warning CHECK_QUERY_BUDGET_EXCEEDED The check stopped after reaching its DNS query limit.

DNS (3)

Error DNS_DOMAIN_NOT_FOUND The DNS resolver reported that the domain does not exist.
Warning DNS_RESOLVER_FAILURE The DNS resolver returned a server failure.
Warning DNS_RESOLVER_TIMEOUT The DNS resolver did not answer in time.

SPF (13)

Error SPF_INCLUDE_LOOP The SPF chain returns to a domain it already evaluated.
Error SPF_INCLUDE_NOT_FOUND An included or redirected domain has no SPF record.
Info SPF_MACRO_NOT_EVALUATED An SPF record contains macros that were not evaluated.
Error SPF_MULTIPLE_RECORDS More than one SPF record was found for a name in the SPF chain.
Warning SPF_NEUTRAL_ALL The SPF policy ends with ?all.
Warning SPF_NOT_FOUND No SPF record was found for the domain.
Warning SPF_NO_ALL The SPF record has no all mechanism and no redirect.
Error SPF_PASS_ALL The SPF policy ends with +all.
Warning SPF_PTR_MECHANISM An SPF record uses the ptr mechanism.
Info SPF_SOFTFAIL_ALL The SPF policy ends with softfail (~all).
Error SPF_SYNTAX_ERROR An SPF record contains a term that cannot be parsed.
Error SPF_TOO_MANY_LOOKUPS The SPF record needs more than 10 DNS lookups.
Error SPF_TOO_MANY_VOID_LOOKUPS More than two SPF lookups returned no data.

DMARC (12)

Info DMARC_HISTORIC_TAG The DMARC record contains a tag that RFC 9989 lists as historic.
Info DMARC_INHERITED The DMARC policy comes from a parent domain.
Error DMARC_INVALID_POLICY The DMARC record has an invalid p, sp or np tag.
Error DMARC_MULTIPLE_RECORDS More than one DMARC record was found.
Warning DMARC_NOT_FOUND No DMARC record was found for the domain or any of its parent domains.
Info DMARC_NO_RUA The DMARC record has no aggregate report address (rua).
Info DMARC_PARTIAL_PCT The DMARC record uses pct below 100, a tag that RFC 9989 removed.
Info DMARC_POLICY_NONE The DMARC policy is p=none (monitoring only).
Error DMARC_SYNTAX_ERROR The DMARC record contains a tag that cannot be parsed or has an invalid value.
Info DMARC_TESTING_MODE The DMARC policy is in testing mode (t=y).
Info DMARC_UNKNOWN_TAG The DMARC record contains tags that are not defined.
Info DMARC_UNSUPPORTED_REPORT_URI A DMARC report address uses a scheme other than mailto.

DKIM (8)

Error DKIM_INVALID_KEY The DKIM public key is not valid base64.
Warning DKIM_KEY_REVOKED The DKIM key for this selector is revoked (empty p tag).
Error DKIM_MULTIPLE_RECORDS More than one DKIM record was found for the selector.
Warning DKIM_NOT_FOUND No DKIM key was found for the given selector.
Info DKIM_NO_COMMON_SELECTORS No DKIM key was found under the common selectors that were tried.
Error DKIM_SYNTAX_ERROR The DKIM record contains a tag that cannot be parsed or has an invalid value.
Info DKIM_TESTING_MODE The DKIM record is in testing mode (t=y).
Warning DKIM_WEAK_KEY The RSA key is shorter than 1024 bits.

MX (5)

Warning MX_NOT_FOUND The domain has no MX records.
Info MX_NULL The domain publishes a null MX and does not accept mail.
Error MX_NULL_WITH_OTHERS A null MX is published together with other MX records.
Error MX_TARGET_IS_IP An MX record points to an IP address instead of a host name.
Error MX_TARGET_UNRESOLVABLE An MX host has no A or AAAA records.

DNSSEC (6)

Error DNSSEC_BOGUS DNSSEC validation fails for the domain.
Warning DNSSEC_DEPRECATED_ALGORITHM The zone uses a DNSSEC algorithm that should no longer be used.
Error DNSSEC_DS_WITHOUT_DNSKEY A DS record has no DNSKEY with the same algorithm.
Warning DNSSEC_INDETERMINATE The DNSSEC status of the domain could not be determined.
Info DNSSEC_NOT_SIGNED The domain is not signed with DNSSEC.
Warning DNSSEC_SHA1_DIGEST A DS record uses a SHA-1 digest.

MTA-STS (10)

Error MTASTS_INVALID_POLICY The MTA-STS policy file is not valid.
Error MTASTS_INVALID_RECORD The MTA-STS record has invalid syntax.
Warning MTASTS_LOW_MAX_AGE The MTA-STS policy has a max_age below one day.
Info MTASTS_MODE_NONE The MTA-STS policy is in mode none.
Warning MTASTS_MODE_TESTING The MTA-STS policy is in testing mode.
Error MTASTS_MULTIPLE_RECORDS More than one MTA-STS record is published.
Error MTASTS_MX_NOT_COVERED An MX host is not covered by the enforced MTA-STS policy.
Warning MTASTS_MX_NOT_COVERED_TESTING An MX host is not covered by the MTA-STS policy in testing mode.
Info MTASTS_NOT_FOUND The domain publishes no MTA-STS record.
Error MTASTS_POLICY_UNAVAILABLE The MTA-STS policy file could not be fetched.

TLS-RPT (2)

Warning TLSRPT_INVALID The TLS-RPT record is not valid.
Info TLSRPT_NOT_FOUND The domain publishes no TLS-RPT record.

Reverse DNS (4)

Warning PTR_MISSING A mail server address has no PTR record.
Info PTR_MULTIPLE_RECORDS A mail server address has more than one PTR record.
Warning PTR_NOT_FORWARD_CONFIRMED The PTR name of a mail server address does not point back to it.
Info PTR_NO_MAIL_HOSTS The domain has no MX hosts whose reverse DNS could be checked.

BIMI (6)

Warning BIMI_DMARC_NOT_ENFORCED DMARC is not enforced strongly enough for BIMI.
Warning BIMI_INSECURE_URL A BIMI URL does not use HTTPS.
Error BIMI_INVALID_RECORD The BIMI record is not valid.
Warning BIMI_LOGO_NOT_SVG The BIMI logo URL does not point to an SVG file.
Info BIMI_NOT_FOUND The domain publishes no BIMI record.
Info BIMI_NO_VMC The BIMI record has no mark certificate (a= tag).

CAA (5)

Warning CAA_INVALID_IODEF The CAA iodef target is not a mailto: or https: address.
Warning CAA_INVALID_VALUE A CAA record value cannot be parsed.
Info CAA_NOT_FOUND The domain has no CAA records.
Info CAA_NO_ISSUANCE CAA forbids certificate issuance for the domain.
Error CAA_UNKNOWN_CRITICAL_TAG A CAA record marks an unknown tag as critical.

Mail provider (3)

Info MAIL_NO_MX The domain has no MX records, so no inbound mail provider can be named.
Info MAIL_PROVIDER_MIXED SPF authorises a mailbox provider that does not receive the domain's mail.
Info MAIL_PROVIDER_UNKNOWN The MX hosts match no provider on the list.

TLS certificate (8)

Error TLS_CERT_EXPIRED The TLS certificate has expired.
Info TLS_CERT_EXPIRING The TLS certificate expires within 30 days.
Warning TLS_CERT_EXPIRING_SOON The TLS certificate expires in less than 14 days.
Error TLS_HOSTNAME_MISMATCH The TLS certificate is not valid for the domain name.
Error TLS_UNAVAILABLE No TLS connection to the domain on port 443 could be made.
Error TLS_UNTRUSTED The TLS certificate does not chain to a trusted certificate authority.
Warning TLS_WEAK_KEY The TLS certificate uses a weak public key.
Warning TLS_WEAK_SIGNATURE A certificate in the chain is signed with SHA-1 or MD5.

HTTP (2)

Warning HTTP_NO_HTTPS_REDIRECT Plain HTTP is not redirected to HTTPS.
Info HTTP_UNAVAILABLE The site does not answer over plain HTTP.

HTTPS (1)

Error HTTPS_UNAVAILABLE The site could not be loaded over HTTPS.

Redirects (2)

Warning REDIRECT_LIMIT The site redirects more than five times in a row.
Info REDIRECT_OFFSITE The site redirects to another domain.

HSTS (3)

Warning HSTS_MISSING The HTTPS site sends no valid Strict-Transport-Security header.
Info HSTS_NOT_PRELOAD_READY The domain does not meet the HSTS preload requirements.
Info HSTS_SHORT_MAX_AGE The HSTS max-age is shorter than one year.

Content Security Policy (2)

Info CSP_MISSING The HTTPS site sends no Content-Security-Policy header.
Info CSP_UNSAFE_INLINE The Content Security Policy allows inline or eval'd scripts.

X-Content-Type-Options (1)

Info XCTO_MISSING The HTTPS site sends no X-Content-Type-Options: nosniff header.

Frame protection (1)

Info FRAME_PROTECTION_MISSING The HTTPS site does not restrict who may frame it.

Referrer-Policy (1)

Info REFERRER_POLICY_MISSING The HTTPS site sends no Referrer-Policy header.

Warning COOKIE_NOT_SECURE The HTTPS site sets a cookie without the Secure attribute.

Domain registration (6)

Error DOMAIN_EXPIRED The domain registration has expired.
Warning DOMAIN_EXPIRING_SOON The domain registration expires in less than 30 days.
Info DOMAIN_NOT_REGISTERED The registry has no record of the domain.
Error DOMAIN_ON_HOLD The domain is on hold and is not published in DNS.
Error DOMAIN_PENDING_DELETE The domain is about to be deleted.
Info DOMAIN_TRANSFER_UNLOCKED The domain has no transfer lock.

RDAP (1)

Info RDAP_UNAVAILABLE The registry's RDAP service could not be asked about the domain.

Findings reference

Check (3)

DNS (3)

SPF (13)

DMARC (12)

DKIM (8)

MX (5)

DNSSEC (6)

MTA-STS (10)

TLS-RPT (2)

Reverse DNS (4)

BIMI (6)

CAA (5)

Mail provider (3)

TLS certificate (8)

HTTP (2)

HTTPS (1)

Redirects (2)

HSTS (3)

Content Security Policy (2)

X-Content-Type-Options (1)

Frame protection (1)

Referrer-Policy (1)

Cookies (1)

Domain registration (6)

RDAP (1)