What is GEO and why does it matter?

GEO stands for Generative Engine Optimization. It is the practice of making your site visible to AI assistants like ChatGPT, Gemini, Claude, and Perplexity. These are where a growing share of people now search for services. If your site is not structured for GEO, you are invisible to that traffic. Most audit tools do not score for this. Canopy Guard does.

Answer Engine Optimization. It is the practice of structuring your content to directly answer questions. Voice search results, Google AI Overviews, and featured snippets all favor sites built for AEO. It overlaps with GEO but focuses on traditional answer engines and search result features rather than generative AI specifically.

Does scanning my site affect its performance or SEO?

No. Canopy Guard reads only publicly available information, the same data any search engine crawler sees. We do not touch your server, database, or code. Running a scan has zero impact on your site performance or rankings.

What does MITRE ATT&CK mean for my website?

MITRE ATT&CK is a globally recognized framework for understanding how attackers operate. For each security finding, Canopy Guard identifies the exposure condition associated with the relevant MITRE ATT&CK technique, so you get context for what the gap actually exposes you to, not just a number. This comes from Adam's CISSP background and 20 years in cybersecurity.

What does Canopy Guard's security scan check for?

Across nine security layers, Canopy Guard checks TLS and certificates, DNS, HTTP headers, HTML vulnerabilities, and exposed paths, plus four expanded capabilities: malware and reputation scanning against Google Safe Browsing and common blacklists (reported as Clean, Flagged, or Blacklisted); an expanded footprint covering Subresource Integrity on scripts and stylesheets, Secure and HttpOnly cookie flags, full TLS cipher-suite enumeration with weak-cipher warnings, and certificate transparency log presence; expanded DNS and email depth that parses SPF mechanisms and qualifiers, reports the DMARC policy as none, quarantine, or reject, and checks registrar lock and days until expiration (flagging domains expiring within 60 days as a hijacking risk); and exposed sensitive file detection for paths like /.env, /.git/config, /wp-config.php.bak, /.aws/credentials, and /admin, reporting any publicly accessible path as Critical. Every check is passive and read-only, and each finding identifies the exposure condition associated with a MITRE ATT&CK technique.

My score is low. What do I do next?

Your full report includes prioritized findings so you know exactly what to fix first. If you want to implement the recommendations yourself, the report gives you enough to work from. If you want it done for you, book a call with Adam. Canopy Guard customers receive a discount on all implementation services.

How is this different from other SEO tools?

Three things. First, GEO scoring is rare at this price point, which is free. Second, the security findings are mapped to MITRE ATT&CK, not flagged generically. Third, there is a real human behind this tool who can implement everything the audit finds. Most tools give you data. This one connects you to someone who fixes it.

Is my site data private?

Yes. Canopy Guard only scans publicly available data, the same information any search engine sees. We do not store your site's private content, login credentials, or analytics. See our Privacy Policy for full details.

Do I need an account to get my full report?

No account required to run the scan. When you download your full report, basic contact information is collected so we can follow up if you have questions. That information is handled securely and never sold or shared with third parties.

How does Canopy Guard compare to hiring an SEO agency?

An agency charges a monthly retainer and often reports only on traditional SEO. Canopy Guard gives you the full picture for free across SEO, AEO, GEO, and security in 30 seconds, with findings mapped to MITRE ATT&CK. When you want the work implemented, you hire Adam directly. No retainer, no account managers, just the practitioner who built the tool.

What does a good overall score look like, and what should I do if mine is low?

Above 80 is strong, 50 to 80 means clear fixable gaps, and below 50 signals problems costing you visibility or trust right now. A low score is not a verdict, it is a roadmap. Your report ranks findings by impact so you fix what matters first, and Canopy Guard customers get a discount if you want it done for you.

How often should I re-scan my site?

Re-scan after any meaningful change: a redesign, new pages, a platform migration, or after applying fixes from a previous report. For an active site, a monthly scan catches regressions before they cost you traffic. Because the scan is free and takes 30 seconds, there is no reason to wait for a problem to show up in your analytics first.

Which search engines and AI assistants does Canopy Guard check for?

Canopy Guard evaluates your readiness for traditional search like Google and Bing, AI answer engines like Google AI Overviews and featured snippets, and generative assistants including ChatGPT, Gemini, Claude, and Perplexity. It inspects your structured data, llms.txt, crawler access, and content structure to estimate how each of those systems can find, parse, and cite your pages.

Blog · 4 min read · 2026-06-29

DMARC, SPF, and DKIM Explained for Non-Technical Business Owners

By Adam McClarin, CISSP · Meraki is Love (Soulful Tech) · Friendswood, Texas

Who built Canopy Guard, and why should you trust this guidance?

Canopy Guard is a free website audit tool built by Adam McClarin, a CISSP with dual master's degrees in cybersecurity, a Microsoft Azure AI Engineer certification, and 20 years in the field. Email authentication is one of the first things he checks, because it is one of the most common gaps.

I have spent two decades securing systems, and the same pattern shows up again and again. A business has a sharp website and a real brand, but anyone in the world can send email that looks like it came from that domain. That is not a small detail. It is the gap that phishing campaigns are built on.

The good news is that three small records fix it. You do not need a developer for most of this, and you do not need to spend a dollar. You need to understand what each record does and where it lives.

What do SPF, DKIM, and DMARC actually do?

Think of these three records as the locks, the seal, and the rulebook for your email. SPF says which servers are allowed to send for you. DKIM adds a tamper-proof signature. DMARC tells receiving servers what to do when a message fails those checks.

SPF, which stands for Sender Policy Framework, is a public list of the mail servers permitted to send on your behalf. When a receiving server gets a message, it checks that list. If the sending server is not on it, the message looks suspicious.

DKIM, or DomainKeys Identified Mail, attaches a cryptographic signature to every message you send. The receiving server uses your published key to confirm the message was not altered in transit. DMARC ties the two together and gives instructions, so you move from hoping for the best to setting a clear policy.

Why does missing DMARC cost you points, and why do AI models care?

Most audit tools, Canopy Guard included, subtract eight points from your security score when DMARC is missing. That number reflects real risk. AI models that summarize and rank businesses also read DMARC as a trust signal, so a missing record can quietly lower how your domain is judged.

The eight point deduction is not arbitrary. Without DMARC, SPF and DKIM still run, but nothing enforces what happens on failure. An attacker can spoof your domain, and receiving servers are left guessing. The penalty reflects how directly that gap leads to fraud against your customers and your name.

The AI angle is newer and worth understanding. When a language model evaluates a domain for trust, it looks for the same signals a security professional would. A published DMARC record says you operate a maintained, legitimate domain. A missing one is a quiet mark against you, even when nothing else is wrong.

How do you add each record?

Every one of these is a TXT record at your DNS host, the same place you manage your domain. SPF and DKIM sit at your root domain. DMARC goes at a special host named _dmarc. You add them once, then verify they resolve.

Log in to your DNS host, the provider where your domain lives, such as GoDaddy, Cloudflare, or Namecheap. For SPF, create a TXT record at your root domain with a value that lists your senders, often starting with v=spf1 and ending with -all. Most email providers give you the exact string to paste.

DKIM usually comes from your email provider as a key you publish, again as a TXT record. For DMARC, create a TXT record at the host _dmarc, with a value like v=DMARC1; p=none; and a reporting address. Start with a monitoring policy, watch the reports for a few weeks, then tighten to quarantine or reject.

How does Canopy Guard show you these gaps?

Canopy Guard scans your domain and surfaces missing SPF, DKIM, and DMARC records directly in your security score, so you see the exact deductions. It then maps each exposure to MITRE ATT&CK reconnaissance techniques, showing how an attacker would use the gap against you.

The score is the starting point, but the value is in the context. Canopy Guard does not just tell you a record is missing. It connects that gap to MITRE ATT&CK, the standard framework security teams use to describe attacker behavior, so you understand the technique, not just the symptom.

Missing email authentication maps cleanly to reconnaissance, the stage where attackers gather information and identify ways to impersonate you. Seeing your own exposure named that way changes how seriously you treat it. Run your domain through Canopy Guard, fix the three records, and close one of the most common doors attackers walk through.

See where your own site stands across SEO, AEO, GEO, and security in about 30 seconds.

Run your free scan Book a call with Adam

Frequently asked questions

Do I need all three records, or is DMARC enough?

You need all three working together. SPF and DKIM do the actual checking of senders and signatures, while DMARC sets the policy and reporting. DMARC alone has nothing to enforce, so the three records depend on each other to stop spoofing.

Will adding DMARC break my email?

Not if you start with a monitoring policy of p=none. That setting reports failures without blocking anything, so you can confirm your real mail passes before you enforce. Once the reports look clean, you move to quarantine or reject with confidence.

How long does it take to see results in Canopy Guard?

DNS changes can take up to 48 hours to propagate fully, though many resolve within an hour. Once they are live, rerun your domain through Canopy Guard and the security score updates automatically to reflect the new records it now finds.

← All articles Run a free audit →