SSL/TLS and Email Security
Overview
Section titled “Overview”Fencer analyzes SSL/TLS certificates and validates email authentication as part of every domain scan. The SSL/TLS analysis surfaces certificate health, protocol support, and cipher configuration for each HTTPS host on your domain. Email security checks validate SPF, DMARC, and MX records and related mail transport settings, and DNS blacklist (DNSBL) lookups verify that your domain is not listed on common spam or abuse blocklists.
SSL/TLS Analysis
Section titled “SSL/TLS Analysis”Certificate details
Section titled “Certificate details”The SSL/TLS tab on the domain detail page lists every HTTPS host found on your domain, with:
- Hostname — the host that served the certificate.
- Cert CN — the certificate’s common name.
- Grade — the host’s grade (see below).
- Issuer — the certificate authority that signed the certificate.
- Issued and Expiry — the certificate’s validity period. Certificates that have expired or expire within 30 days are flagged so you can renew before service disruption occurs.
- Ver — the lowest TLS version the host accepts.
- Cipher — the negotiated cipher suite.
- Key / Sig — the key algorithm and size, and the signature algorithm (e.g., RSA-2048 with SHA-256).
Fencer also flags weak signals on a certificate: a SHA-1 or MD5 signature, an RSA key shorter than 2048 bits or an EC key shorter than 256 bits, and a certificate that does not cover the hostname. Use the search box to find a host.
Grades
Section titled “Grades”Each host receives a grade, and the domain’s Overall Grade is the worst grade across its hosts. The same grade appears on the SSL/TLS KPI card, with the number of hosts and any expired or soon-to-expire certificates.
| Grade | Meaning |
|---|---|
| A | TLS 1.3 in use — strong, modern configuration |
| B | TLS 1.2 with AEAD ciphers (GCM or ChaCha20) |
| C | TLS 1.2 without AEAD ciphers — acceptable, but the cipher suite needs tightening |
| F | TLS 1.1 or older — deprecated protocol that should be disabled |
| T | One or more certificates have expired |
| M | Certificate does not cover the hostname — the wrong certificate may be deployed |
Known TLS vulnerabilities
Section titled “Known TLS vulnerabilities”Hosts that only offer TLS 1.1 or older (grade F) are tested for a set of well-known SSL/TLS vulnerabilities during network service scans. Positive results are recorded as vulnerabilities on the host’s network service — see Network Services and Results.
| Vulnerability | Description |
|---|---|
| Heartbleed | OpenSSL heartbeat memory disclosure (CVE-2014-0160) |
| ROBOT | Return Of Bleichenbacher’s Oracle Threat — RSA padding attack |
| LOGJAM | Export-grade or weak Diffie-Hellman parameters (CVE-2015-4000) |
| POODLE | SSL 3.0 padding oracle (CVE-2014-3566) |
| CCS Injection | OpenSSL ChangeCipherSpec injection (CVE-2014-0224) |
| DROWN | Cross-protocol decryption via SSLv2 (CVE-2016-0800) |
| FREAK | Export-grade RSA accepted (CVE-2015-0204) |
| SWEET32 | 64-bit block ciphers (3DES) accepted (CVE-2016-2183) |
| BEAST | CBC ciphers in TLS 1.0 (CVE-2011-3389) |
| CRIME | TLS compression enabled (CVE-2012-4929) |
| RC4 | RC4 cipher suites enabled |
| Renegotiation | Secure renegotiation unsupported, or client renegotiation allowed |
| TLS_FALLBACK_SCSV | Downgrade protection not supported |
Email Security (SPF, DMARC, MX)
Section titled “Email Security (SPF, DMARC, MX)”What is validated
Section titled “What is validated”The Email tab shows a card for each of SPF, DMARC, MX, and Blacklist, followed by the issues found. Fencer validates:
- SPF (Sender Policy Framework) — the record must exist, end in a restrictive
allmechanism (+allor a missingallis flagged), and stay within the 10-DNS-lookup limit. - DMARC (Domain-based Message Authentication, Reporting and Conformance) — the record must exist
and enforce a policy:
p=none,pctbelow 100, and missingrua/rufreporting addresses are flagged. - MX records — mail exchange records pointing to the servers that receive email for your domain, including whether those servers support TLS and STARTTLS.
- MTA-STS, SMTP TLS Reporting (TLS-RPT), and DNSSEC — flagged at Low severity when they are not configured.
| Issue | Severity |
|---|---|
SPF missing, permissive, or without all | High |
DMARC missing or p=none | High |
DMARC pct below 100, SPF over 10 DNS lookups | Medium |
| MX host without TLS | Medium |
| MX host without STARTTLS, MX warnings | Low |
| DMARC without reporting addresses | Low |
| MTA-STS, TLS-RPT, or DNSSEC not configured | Low |
Overall email security status
Section titled “Overall email security status”The Email KPI card summarizes these checks:
- Secure — no open SPF, DMARC, MX, DNSSEC, MTA-STS, or TLS reporting issues, and the domain is not blacklisted.
- Issues — exactly one of those areas has an open issue (e.g., SPF is missing but everything else is valid).
- At risk — two or more areas have open issues, or the domain is found on a DNS blacklist.
DNSBL Blacklist Checking
Section titled “DNSBL Blacklist Checking”How it works
Section titled “How it works”DNSBL (DNS-based Blackhole List) checks determine whether your domain name appears on well-known domain reputation lists, such as the Spamhaus Domain Block List and SURBL.
A listing creates a vulnerability whose severity depends on why the domain is listed — High for malware, command-and-control, or exploit categories, Medium for spam or phishing, and Low for abused domains — and names the lists that reported it. Any listing sets the Blacklist card to Domain is blacklisted and the email security status to At risk, so you can initiate a delisting request with the relevant provider.
Examples
Section titled “Examples”Reviewing SSL findings for an expiring certificate:
- Open the domain detail page and select the SSL/TLS tab.
- Locate the host flagged as expiring, or check the SSL/TLS KPI card for the next expiry.
- Note the expiry date, issuer, and covered hostname.
- Renew the certificate through your CA or hosting provider before the expiry date.
Investigating a DMARC issue:
- After a scan, the Email KPI card shows Issues and the Email tab lists a
dmarcissue. - If the issue reports a missing record, no DMARC record exists for
_dmarc.example.com. - Add a DMARC TXT record at
_dmarc.example.com, for example:v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@example.com - Run a new scan to confirm the status resolves to Secure.
Handling a DNSBL listing:
- The Email KPI card shows At risk and the Blacklist card shows Domain is blacklisted.
- Open the blacklist vulnerability on the Vulnerabilities tab to see which lists your domain appears on.
- Visit the blacklist provider’s delisting portal, verify the issue is resolved, and submit a removal request.
- Re-scan after the standard delisting period (typically 24–48 hours).
Troubleshooting
Section titled “Troubleshooting”- No SSL data — Fencer has not found an HTTPS host for the domain yet. Verify that your domain serves HTTPS and that firewalls do not block Fencer’s scanners — see Allowlisting Scanner IPs.
- Email security status shows issues after fixing SPF — DNS changes can take up to 24 hours to propagate. Run a manual scan after propagation completes to refresh results.
- DKIM not shown — DKIM is not validated by domain scans. Make sure your DMARC record is configured to align DKIM results.
- Heartbleed shows positive on a patched server — Confirm the OpenSSL version running on your server with your hosting provider. Some CDN or load balancer configurations may still present vulnerable banners even when the underlying service is patched.