Guide
SPF / DKIM / DMARC missing or weak
How StackSiren Deep Scan detects this issue and how to fix it. Severity typically medium.
Why it matters
SPF / DKIM / DMARC missing or weak is a common finding on vibe-coded and AI-built apps that ship client bundles, shared backends or platform defaults without a security pass.
StackSiren reports this from read-only checks (GET, HEAD or OPTIONS only). It does not exploit the issue.
How to fix it
Publish SPF covering only the senders you use, enable DKIM on your ESP, and set a DMARC record (start with p=none, then quarantine/reject). Monitor reports for spoofing.
How StackSiren Deep Scan checks
Deep Scan runs only on hosts you have verified you own (DNS TXT or /.well-known file) and consented to test. Findings include a short evidence string; secret values are masked.
See the Acceptable Use Policy and Active scanning terms for what Deep Scan is and is not.