plow.co

The domain plow.co publishes no SPF record. SPF is the DNS record that lists which mail servers are allowed to send email as your domain. Without it, spam filters have no way to tell your real mail from a forgery, and messages you do send are more likely to land in spam.

The domain plow.co publishes no DMARC record. DMARC is what tells receiving mail servers to reject or quarantine messages that fail your SPF/DKIM checks. Without it, an attacker can send phishing emails with a "From:" address at your domain and inboxes have no signal to distrust them — a favourite trick for invoice fraud and credential phishing.

Public Certificate Transparency logs reveal internal-looking hostnames under plow.co: demo.plow.co, dev.plow.co, old.plow.co, old.shop.plow.co, staging.plow.co, test.plow.co. Names like staging, dev, and admin are found by attackers the same way we found them here — from public logs, no scanning required — and these hosts are often left less protected than production.

Without `X-Content-Type-Options: nosniff`, browsers may guess ("sniff") the type of a response and, for example, run an uploaded file as JavaScript. It's a one-line header that closes a whole class of content-type confusion bugs.

plow.co is not protected by DNSSEC. DNSSEC signs your DNS records so resolvers can detect a forged answer — without it, an attacker who can poison DNS could point your domain at their own server without touching anything you control.

plow.co publishes no CAA records. CAA tells the world which certificate authorities are allowed to issue HTTPS certificates for your domain. Without it, any CA can be persuaded to issue a cert for your domain, which widens the door to mis-issuance.