Why this shows up next to CSP and HSTS
Customers trust the From: line more than they trust your TLS grade. If your apex domain has no SPF and no DMARC, a stranger can send invoices that look like yours.
AuditHQ’s deep website security scan checks public DNS for SPF and DMARC on the audited host. Missing records become findings you can fix without a pentest.
Minimum viable records
SPF: a TXT record that lists every service allowed to send as your domain (Google Workspace, transactional ESP, etc.) and ends with a hard fail (~all) once you trust the list.
DMARC: a TXT at _dmarc that starts in p=none so you can watch reports, then moves to quarantine or reject when the data looks clean.
DKIM still matters for deliverability; the scan flags DMARC/SPF first because they are the spoofing controls shoppers feel.
Fix without breaking mail
Inventory every sender before you tighten ~all. Soft-fail (?all) is a temporary bridge, not a destination.
After DNS propagates, re-run the AuditHQ security scan. SPF/DMARC findings should clear when the public TXT records resolve.