We checked 71 clinic websites for email spoofing protection. Then we found the same hole in our own domain

Bohdan Khomyn — Thu, 15 Oct 2026 09:32:08 +0000

Clinics hold the most sensitive data there is: diagnoses, test results, appointments. Patients trust emails that come from their clinic's domain. So we asked a simple question: can anyone send an email that looks like it came from a private clinic?

We checked 71 private clinic websites in Lviv, Ukraine, in October 2026. Passive checks only: the home page, HTTP headers and public DNS records, exactly what any visitor or mail server sees. No scanning, no login attempts. We publish aggregate numbers only, no clinic names.

The result

Not one of the 71 domains has DMARC set to block spoofed email.

79% have no DMARC record at all.
The rest have p=none, which only monitors and blocks nothing.

For a patient, that means a fraudster can send "your test results are attached" or "pay for your appointment here" from the clinic's real address, and the inbox will not flag it.

Other findings from the same scan:

80% send no HSTS header.
89% have no Content-Security-Policy.
15% load jQuery older than 3.5, which has known XSS issues.
83% have images with no alt text; 31% of all images are undescribed.

The good news: all 71 use HTTPS and are mobile-friendly. The basics are there; the next step is missing.

Then we checked ourselves

Our studio domain, olbo.com.ua, had SPF and DKIM configured properly, and DMARC set to... p=none. Exactly the gap we had just written about.

SPF, DKIM, DMARC in one paragraph each

SPF is a TXT record on your domain listing who may send mail for it:

v=spf1 include:zohomail.eu ~all

DKIM is a signature on every message. Your mail provider signs with a private key; receivers verify with the public key published at selector._domainkey.yourdomain.

DMARC tells receivers what to do when a message fails the checks, and where to send reports:

_dmarc.yourdomain  TXT  "v=DMARC1; p=quarantine; rua=mailto:reports@yourdomain"

p=none = report only. p=quarantine = spam folder. p=reject = don't deliver. Only the last two actually protect anyone.

How we switched without breaking our own mail

The risk with p=quarantine is that your legitimate mail starts landing in spam. The usual culprit is a service you forgot sends mail as you: a contact form, a newsletter tool, a CRM, an invoicing system.

Our list was short:

Zoho Mail for people (hello@). DKIM key zmail._domainkey, included in SPF.
Resend for the website: form notifications and report emails, sent as forms@. DKIM key resend._domainkey; the return path is on a subdomain, which still aligns under DMARC's default relaxed mode.

Both already had DKIM, so the change was one edit: p=none → p=quarantine.

Then we verified with real messages, not just DNS lookups:

An email from hello@ to a Gmail inbox → "Show original": SPF PASS, DKIM PASS, DMARC PASS.
A website form submission → arrived, not in spam.
An automated report email sent through Resend → SPF, DKIM, DMARC: PASS.

Total time: about 10 minutes. We'll move to p=reject in 2–3 weeks after reading the aggregate reports.

Checking a domain yourself

From a terminal:

dig +short TXT yourdomain.com | grep spf1
dig +short TXT _dmarc.yourdomain.com

Or in Node, which is roughly what our checker does:

import { promises as dns } from 'node:dns'

const txt = async (name) => {
  try { return (await dns.resolveTxt(name)).map((r) => r.join('')) }
  catch { return [] }
}

const domain = 'example.com'
const spf = (await txt(domain)).find((r) => r.startsWith('v=spf1'))
const dmarc = (await txt(`_dmarc.${domain}`)).find((r) => /^v=DMARC1/i.test(r))
const policy = dmarc?.match(/\bp=(\w+)/i)?.[1]?.toLowerCase()

console.log({ spf, dmarc, protected: !!spf && ['quarantine', 'reject'].includes(policy) })

Note the join(''): long TXT records come back split into 255-byte chunks.

If you'd rather not open a terminal, or want to send something to a non-technical client, we made the same check into a free page with a plain-language answer and no sign-up: olbo.com.ua/en/dmarc-checker. We don't store the domains people enter.

Takeaway

If you build sites for small businesses, add one line to your handover checklist: "DMARC at quarantine or reject, tested with a real email." It's an hour of work and closes one of the easiest ways to impersonate your client.

The full clinic study, including the four steps we recommend to clinic managers, is here: Clinic website security: a study of 71 clinic sites.

How we built a free 13-point website checker in Lviv

Bohdan Khomyn — Tue, 13 Oct 2026 09:01:39 +0000

Small business owners have asked me the same question again and again: "Is my website OK, or do I need a new one?" Existing tools answer only part of it. PageSpeed shows speed, SSL Labs shows the certificate, another service checks email. Nobody puts it all into one clear answer.

So we built OLBO Website Checker: 13 checks in about a minute.

What it checks

Hosting, HTTPS and security headers, email protection (SPF, DMARC), the platform and its version, outdated components, known vulnerabilities, Google blacklists, site age, basic accessibility (European Accessibility Act), privacy (GDPR), Google search, AI search readiness (does the site let GPTBot and ClaudeBot in, is there an llms.txt) and mobile speed.

Three decisions that matter for website owners

The check runs live. The server streams results one item at a time, so people see the program actually working instead of a pre-drawn template. That builds more trust than any description.
"Don't take our word for it." Next to the first results there are links to independent free tools (SSL Labs, MXToolbox, BuiltWith), so anyone can verify us.
No database. We don't store which websites were checked. A paid report opens through a signed link that works for 30 days and for one website only.

Data sources

IP registries (RDAP, IPinfo), endoflife.date for support dates, the OSV vulnerability database, Google Safe Browsing, PageSpeed Insights and the Wayback Machine. Public data only: we don't hack anything and don't log in anywhere.

Stack

Next.js on Vercel. A headless Chrome on the server generates the PDF report. There is also a Telegram bot.

How it compares

There are great tools out there, and we use them ourselves. The difference is in what one check covers and what it costs.

Tool	What one check covers	Price
Google PageSpeed Insights	Speed, basic SEO and accessibility	Free
GTmetrix	Speed and performance	Free; PRO from $4.99/month
Sucuri SiteCheck	Malware, blacklists, outdated software	Free; protection plans paid
Semrush Site Audit	Deep technical SEO across many pages	From $139/month
OLBO Website Checker	13 areas: hosting, security, email, platform, vulnerabilities, accessibility, GDPR, Google, AI search, speed	Score free; full report €25 once

Prices as of October 2026.

What we do differently:

Everything in one place. Speed, security, email protection, accessibility, GDPR and AI search readiness in a single run. Usually that takes four or five different tools.
One payment, no subscription. The full report is €25 once. You don't have to pay monthly to read one result.
Written for the owner, not only the developer. Every finding explains what it means for the business, and the fix list is a ready task for your developer.
We check the new things. Few free tools look at the European Accessibility Act or at whether ChatGPT and Claude can read your site.

To be fair about the limits: our check is automated and approximate. It doesn't replace a deep SEO audit of thousands of pages (that's what Semrush is for) or a full manual accessibility audit.

Honestly about me

I'm not a programmer. I'm a publisher with 23 years of experience. I wrote the code together with an AI assistant, with advice from programmer friends. My part was the product: what to check, how to explain it to a website owner in plain words, and where the line of honesty is.

What it costs

The overall score and the colour of each of the 13 checks are free. The full report with explanations and step-by-step fixes for your developer costs €25. Part of the revenue supports Balabony, our Ukrainian story platform that is accessible to people with disabilities.

Check your website: https://olbo.com.ua/en/website-checker?utm_source=devto

Tell me which check is missing and what is worth improving. Thank you!

DEV Community: Bohdan Khomyn