Before You Start
- A completed Cyber Defense Score scan from cyberdefenseagent.com
- Basic familiarity with email authentication concepts like SPF, DKIM, and DMARC
- Access to your IT team or service provider for implementing recommended changes
Understand the overall score and grade
Your Cyber Defense Score is a composite grade that reflects the overall security posture of your domain based on publicly observable configurations. The score aggregates results from multiple security categories into a single letter grade. An A grade indicates strong security configurations across all categories with only minor improvements possible. A B grade means most configurations are solid but there are meaningful gaps to address. A C grade indicates significant security gaps that should be remediated promptly. A D or F grade signals critical misconfigurations that leave your domain highly vulnerable to attack. The overall score is weighted, with email authentication and TLS configuration carrying the most weight because these are the most commonly exploited vectors for SMBs. Use the overall grade as a conversation starter with leadership but dive into the category details for actionable next steps.
Review the email authentication section
The email authentication section evaluates your SPF, DKIM, and DMARC configurations. For SPF, the scan checks whether a record exists, whether it is syntactically valid, whether it stays within the ten DNS lookup limit, and whether it ends with a restrictive qualifier like -all. For DKIM, the scan attempts to verify that DKIM signing is active by checking common selector names. For DMARC, the scan checks whether a record exists, what policy level it is set to, and whether aggregate reporting is configured. A DMARC policy of p=none provides monitoring only and is scored lower than p=quarantine or p=reject. The ideal state is having all three protocols configured and aligned, with DMARC at p=reject. If any of these three are missing or misconfigured, this section will show the specific failures and what the correct configuration should look like.
Review the web security and TLS section
The web security section examines your website TLS configuration and HTTP security headers. For TLS, the scan checks your certificate validity and expiration date, the protocol versions supported by your server, and the cipher suites offered. Supporting TLS 1.0 or 1.1 is flagged as a critical finding because these protocols have known vulnerabilities. The scan also checks for common TLS misconfigurations like missing certificate chain intermediates, expired certificates, and weak cipher suites. The HTTP security headers subsection checks for Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Strict-Transport-Security, Referrer-Policy, and Permissions-Policy. Each missing header is reported with an explanation of what attack it mitigates and a recommended value to implement.
Review the DNS security section
The DNS section evaluates how well your domain name infrastructure is protected. It checks whether DNSSEC is enabled for your domain, which protects against DNS spoofing and cache poisoning attacks. It examines your nameserver configuration for redundancy and geographic distribution. It also checks for dangling DNS records that point to decommissioned services, which can be exploited through subdomain takeover attacks. If your domain has MX records, the scan verifies they point to valid mail servers. The DNS section may also flag if your domain is listed on any public blocklists that could affect email deliverability. While DNS findings are often lower severity than email or TLS issues, they represent foundational infrastructure that affects all other security layers.
Interpret severity levels and prioritize findings
Each finding in the report is assigned a severity level to help you prioritize. Critical findings represent immediate risks that could be actively exploited, such as a missing DMARC record that allows anyone to spoof your domain or an expired TLS certificate that exposes traffic to interception. High severity findings are significant gaps that should be addressed within days, such as supporting deprecated TLS versions or missing SPF records. Medium severity findings are important improvements that should be completed within weeks, such as tightening an SPF soft fail to a hard fail or adding missing security headers. Low severity findings are best-practice enhancements that improve your posture but do not represent immediate risk. Always address critical and high findings first and work your way down the severity list.
Create a remediation plan from the findings
Transform the scan results into a concrete action plan. For each finding, identify who on your team or which vendor is responsible for the fix. Group related findings together since email authentication fixes involving SPF, DKIM, and DMARC should be addressed as a coordinated effort rather than individually. Estimate the level of effort for each fix. Most email authentication fixes can be completed in under an hour if you have DNS access. TLS configuration changes may require coordination with your hosting provider. Security header additions typically require web server configuration changes. Set target dates for each fix and assign accountability. After completing each batch of fixes, re-run the Cyber Defense Score scan to verify improvement and update your baseline. Share the remediation plan with leadership to demonstrate your commitment to improving security posture.
Common Mistakes to Avoid
Focusing only on the overall grade without reviewing the individual category findings
Treating all findings as equal priority instead of addressing critical and high severity issues first
Not re-scanning after implementing fixes to verify the changes were effective
Ignoring the email authentication section because the website section looks good
Get your Cyber Defense Score™ in 60 seconds.
100 tools. No installation. No credit card.
Get My Cyber Defense Score™ →