🔒 Email & Domain Security Audit

EmailMeNow IT Consulting · Based in College Station, Texas

Audit snapshot: November 13, 2026 | Next free refresh: May 12, 2027

Report framed for: Auto Dealership — change industry

Threat examples and compliance framing adjust per vertical. Re-scanning span.io preserves your current scores.

Law Firm Auto Dealership ✓CPA & Tax Firm Title & Real Estate Office RIA & Financial Advisor Medical & Dental Practice Payroll & HR Provider Local Government & School District Small Business Nonprofit / Church

📧 Domain Email Security Analyzer

Enter a domain, URL, or email address to generate a compliance report.

Free scans refresh every six months. Next free refresh on May 12, 2027. Unlock for immediate access.

Free scan refresh locked

Free scans for this domain refresh every six months. Showing results from November 13, 2026. Next free refresh on May 12, 2027.

Unlock the full report ($99) for immediate re-scan access, detailed threat analysis, and remediation steps.

Domain Security Audit: span.io

48%

Overall Compliance Rating

Executive Summary

Critical Risk

span.io has gaps that may weaken protection of customer financial data under the FTC Safeguards Rule. Prioritize the remediation plan below before relying on this configuration as a defensible posture.

DNS Fix Kit Complete Risk Report ($149) Domain Watch ($29/mo)

Identity & Spoofing

Transport Security

100

Email Infrastructure
Google Workspace (Custom Domain)

Website Security

Stack signal: cloudflare — unlock for full sender inventory & header analysis

Local Endpoint

Additional scan signals (summary)

Website soft-header score adjustment applied (−5). Unlock for named header rows and Low remediations.
DNS host signal: GoDaddy DNS. Unlock for full nameserver list and DNSSEC guidance.
Client discovery: Microsoft Lync legacy target (informational). Unlock for full note.
Subdomain email policy gaps detected (DMARC sp=/np=). Unlock for CT subdomain inventory, host DNS table, and ideal-settings checklist.
IPv6 / dual-stack: Website has AAAA; 3/5 MX hosts have AAAA (informational — not scored). Unlock for MX address-family detail.
Mail server certificates (public CT logs): alt3.aspmx.l.googlemail.com: unavailable; aspmx.l.google.com: managed by provider
Minimum TLS (HTTPS edge): Cloudflare signals detected but setting was not read (API token not configured on audit worker).

📊 Audit Scoring Methodology

This tool uses a weighted algorithm focused on the FTC Safeguards Rule:

Identity & Spoofing (40%): Grades SPF terminal mechanism (-all vs exploitable ~all) and DMARC enforcement including explicit sp=reject subdomain policy and np=reject for non-existent subdomains.
Transport Security (5%): Requires MTA-STS mode=enforce (not testing/none), plus TLS-RPT and DNSSEC signals. DNS host, IPv6 dual-stack, and BIMI are shown for guidance and are not primary score drivers.
Website Security (30%): Penalizes missing encryption and clickjacking headers (HSTS, CSP, XFO), plus soft deductions for X-Content-Type-Options, Referrer-Policy, and Permissions-Policy.
Local Endpoint & Network (20%): Evaluates operating system lifecycle support and active IP masking/VPN usage.
Email Infrastructure (5%): Checks for enterprise-grade routing vs. consumer/shared hosts; small ding only for definitive dangling lyncdiscover (Microsoft Lync legacy targets are Info only).

🔍 Sample from the full report — DMARC is not fully enforced — a primary BEC and wire-fraud vector

Without strict DMARC (p=reject) and SPF (-all), attackers can email customers as your dealership:

Toyota Boshoku (2019): Executive impersonation led to $37 million in fraudulent transfers.
Scoular Company (2014): CFO spoofing caused $17.2 million in wire losses.
Dealership scenario: A forged finance@span.io or parts@span.io message with fake wire instructions reaches a lender or customer who whitelists your domain.

Unlock the full report for every control — MTA-STS, TLS-RPT, DNSSEC, HSTS, CSP, clickjacking, CAA, security.txt, and endpoint risk — each with named incidents and remediation steps.

🔓 Credential hygiene checklist — unlock in full report

The paid report adds a step-by-step playbook: Have I Been Pwned check (when you audit by email), MFA rollout, password-manager guidance (we suggest Proton Pass), and Microsoft 365 / Google Workspace compromised-credential settings — plus our breach-monitoring guide if exposure is found.

🔒

Detailed Threat Analysis Locked

This summary shows how your public DNS and website settings compare to common the FTC Safeguards Rule expectations. Unlock the full report for step-by-step remediation guidance, granular DNS data, and the tools below.

What's included in the full report ($99)

Everything below unlocks immediately after checkout—no separate subscriptions.

Executive summary & risk profile Full score breakdown, risk label, and compliance-focused summary for dealership leadership.
Granular DNS & email security analysis DMARC tag detail (rua/adkim/aspf), SPF authorized-sender inventory, DKIM delegation probes, BIMI, MTA-STS enforce status with MX cross-check, DNSSEC, TLS-RPT destinations, structured CAA analysis, DNS host/nameserver identity, limited lyncdiscover dangling checks, Certificate Transparency subdomain inventory with current vs ideal subdomain settings, and IPv6 dual-stack readiness — each with real-world context where applicable.
Website & session security review HSTS, CSP, X-Frame-Options, scored soft checks for X-Content-Type-Options / Referrer-Policy / Permissions-Policy, extended header grid, server stack signals, CMS/AMP fingerprint (paid), security.txt (RFC 9116), and lightweight performance/resilience signals with PageSpeed guidance.
Top priority remediation plan Ranked fixes with severity, business impact, and implementation effort for your IT team or vendor.
SB 2610 / FTC Safeguards Relevance Map Technical readiness mapping tied to applicable sector frameworks—supporting evidence, not legal advice.
Raw technical evidence Full DNS records, website header gaps, and probe details ready to paste into tickets or provider consoles.
AI compliance research links One-click Perplexity and Google searches pre-filled with your audit findings for the FTC Safeguards Rule.
Credential breach & hygiene checklist HIBP one-click check when you audit by email, plus plain-language steps: rotate reused passwords, enable MFA, adopt a password manager (we suggest Proton Pass), enable compromised-credential detection in Microsoft 365 or Google Workspace, and link to our breach-monitoring guide if exposure is found.
Typosquatting & lookalike domain check Links to the one-time Lookalike Domain Report, Cybersquat Watch subscription, or Full Watch (lookalikes plus domain monitoring) for your audited domain.
Mail Authentication Verifier Paste raw email headers and cross-check SPF, DKIM, and DMARC results against live DNS (DMARC, SPF, DKIM selectors, MTA-STS, TLS-RPT, BIMI) for your audited domain.
Favicon & Brand Icon Suite (90-day access) Protected link to favicon.emailmenow.com — generate favicon.ico, SVG, Apple touch icon, PWA PNGs, and site.webmanifest for browser tabs, mobile home screens, and inbox branding.
Three SB 2610 compliance PDF guides Delivered by email: general cybersecurity guide, SB 2610 overview PDF, and tiered requirements detailed guide.
Print-ready report & fulfillment email Browser access via secure checkout link, plus a branded email with your full report and included resources.

Email (optional — prefills Stripe if provided)

🛡️

How we store audit data: Free summary scans are cached for up to six months so we can limit automated re-scans; we also retain domain and score history so you can compare results over time. Full report HTML is kept for about 180 days. Paid unlocks, nonprofit fulfillment, and admin requests bypass the free refresh window. Payment, email delivery, and infrastructure logs may be processed by Stripe, Resend, and Cloudflare. Privacy Policy

Related Cybersecurity News — Auto Dealership

Dealer-Installed KARR Alarms Left Millions of Cars Unlockable Over Shared Bluetooth Keys

Jul 29, 2026 · UC San Diego found every KARR Security System since 2017 shares one plaintext Bluetooth auth key. ~2.2M U.S. cars — many via SoCal…

Subaru STARLINK Admin Portal Let Attackers Track and Control Cars With License Plate Data

Jul 29, 2026 · Sam Curry and Shubham Shah showed Subaru’s STARLINK admin portal allowed account takeover and remote unlock/start plus a year of ~5 m location history. UH…

Was Challenge Manufacturing Breached? We Scanned Their Domain Security

Jul 5, 2026 · Challenge Manufacturing disclosed a Chaos ransomware breach affecting 24,211 people, including 1,661 Texans. SSNs and medical data were exposed. An…

See all cybersecurity news →

Report prepared by EmailMeNow IT Consulting · College Station, Texas

emailmenow.com · News · Articles