aws.amazon.com

15-check dossier · scoreboard above, section details below

embed badge

Markdown

[![Domain posture](https://www.domainposture.com/d/aws.amazon.com/badge.svg)](https://www.domainposture.com/d/aws.amazon.com)

HTML

<a href="https://www.domainposture.com/d/aws.amazon.com"><img src="https://www.domainposture.com/d/aws.amazon.com/badge.svg" alt="Domain posture" /></a>

Scanning…

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

resolving mx…

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

resolving dmarc…

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

tracing redirects…

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

inspecting web surface…

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.

aws.amazon.com

15-check dossier · scoreboard above, section details below

Get a pack →

embed badge

Markdown

[![Domain posture](https://www.domainposture.com/d/aws.amazon.com/badge.svg)](https://www.domainposture.com/d/aws.amazon.com)

HTML

<a href="https://www.domainposture.com/d/aws.amazon.com"><img src="https://www.domainposture.com/d/aws.amazon.com/badge.svg" alt="Domain posture" /></a>

Multiple findings need attention

Aggregate grade across 15 checks. Auditors typically flag any High-severity finding.

Pass: 9
Warn: 3
Fail: 3

What an auditor would flag first

high
MX
no MX records — domain cannot receive email
SOC 2 CC6.7
high
SPF
no SPF record — phishing risk
SOC 2 CC6.7ISO 27001 A.8.20
high
DMARC
no DMARC record — spoofing risk
SOC 2 CC6.7ISO 27001 A.5.14

Need this as an artifact your auditor can verify?

Your aws.amazon.com scan flagged 3 high and 1 medium and 2 low findings. A signed pack covers the apex plus up to 100 CT-discovered subdomains, Ed25519-signed and ISO-timestamped, delivered in 10–30 minutes.

Get a pack →See methodology See a sample$29

Scanning…

15-check summary

DNS recordsA/AAAA records present
MXno MX records — domain cannot receive email
SPFno SPF record — phishing risk
DMARCno DMARC record — spoofing risk
DKIMno DKIM selectors found — likely not configured
TLS certificatecert valid for 122 days
Redirect chainHTTPS served correctly
Security headers3 security header(s) missing
CORSCORS restricted to specific origin: https://domainposture.com
Web surfacecheck failed: fetch failed
MTA-STSnot applicable: no _mta-sts TXT record
TLS-RPTnot applicable: no TLSRPT record
DNSSECDS records present but DNSSEC chain not validated (no AD flag)
WHOISnot applicable: whois returned no data and RDAP fallback unavailable (registry refused or unmapped TLD)
Certificate Transparencycheck failed: crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

dns

info

Open standalone →

A/AAAA records present

Why it matters: Without authoritative A or AAAA records on the apex, the domain is unreachable. Missing baseline DNS shows up in vendor reviews as evidence of unmanaged infrastructure (SOC 2 CC6.6).

A: ttl=6690 tp.8e49140c2-frontier.amazon.com.
ttl=33 dr49lng3n1n2s.cloudfront.net.
ttl=33 108.158.61.67
ttl=33 108.158.61.96
ttl=33 108.158.61.79
ttl=33 108.158.61.102
AAAA: ttl=5917 tp.8e49140c2-frontier.amazon.com.
ttl=39 dr49lng3n1n2s.cloudfront.net.
ttl=39 2600:9000:2139:5600:1c:a813:8500:93a1
ttl=39 2600:9000:2139:3c00:1c:a813:8500:93a1
ttl=39 2600:9000:2139:200:1c:a813:8500:93a1
ttl=39 2600:9000:2139:3800:1c:a813:8500:93a1
ttl=39 2600:9000:2139:7a00:1c:a813:8500:93a1
ttl=39 2600:9000:2139:c00:1c:a813:8500:93a1
ttl=39 2600:9000:2139:4400:1c:a813:8500:93a1
ttl=39 2600:9000:2139:9400:1c:a813:8500:93a1
NS: ttl=7200 tp.8e49140c2-frontier.amazon.com.
ttl=60 dr49lng3n1n2s.cloudfront.net.
ttl=172800 ns-106.awsdns-13.com.
ttl=172800 ns-1402.awsdns-47.org.
ttl=172800 ns-1860.awsdns-40.co.uk.
ttl=172800 ns-905.awsdns-49.net.
SOA: ttl=7200 tp.8e49140c2-frontier.amazon.com.
ttl=60 dr49lng3n1n2s.cloudfront.net.
ttl=60 ns-905.awsdns-49.net. awsdns-hostmaster.amazon.com. 1 7200 900 1209600 86400
CAA: ttl=7200 tp.8e49140c2-frontier.amazon.com.
ttl=60 dr49lng3n1n2s.cloudfront.net.
TXT: ttl=7200 tp.8e49140c2-frontier.amazon.com.
ttl=60 dr49lng3n1n2s.cloudfront.net.

fetched 2026-06-17T08:27:30.657Z

dns

info

Open standalone →

resolving…

mx

high

Open standalone →

no MX records — domain cannot receive email

Why it matters: MX records direct inbound mail. Misconfiguration silently breaks email delivery and lets attackers stand up parallel MX hosts for spoofing campaigns (ISO 27001 A.8.21).

Recommendations

Add MX records pointing to your mail provider (e.g. MX 10 mail.example.com)
If the domain should not receive email, publish 'v=spf1 -all' to signal no senders

no parseable MX records

mx

info

Open standalone →

resolving mx…

spf

high

Open standalone →

no SPF record — phishing risk

Why it matters: SPF tells receiving servers which hosts may send mail for the domain. Without it, any sender can forge the envelope-from — the primary mechanism behind business-email-compromise (SOC 2 CC6.7).

Recommendations

Publish a TXT record: v=spf1 include:<your-provider> -all
Example for Google Workspace: v=spf1 include:_spf.google.com -all

no SPF record

spf

info

Open standalone →

resolving spf…

dmarc

high

Open standalone →

no DMARC record — spoofing risk

Why it matters: DMARC binds SPF and DKIM into an enforceable policy (quarantine or reject) and surfaces spoofing attempts via aggregate reports. `p=none` or absent means spoofing succeeds silently (SOC 2 CC6.7).

Recommendations

Publish a DMARC TXT record at _dmarc.<domain>: v=DMARC1; p=none; rua=mailto:dmarc@<domain>
Start with p=none to collect reports, then move to p=quarantine and finally p=reject

no DMARC record

dmarc

info

Open standalone →

resolving dmarc…

dkim

low

Open standalone →

no DKIM selectors found — likely not configured

Why it matters: DKIM signs outbound mail so receivers can detect tampering. Missing selectors or rotated-away keys break DMARC alignment and let receivers downgrade trust (ISO 27001 A.8.24).

Recommendations

Enable DKIM signing in your mail provider and publish the provided TXT record
Common selectors: google._domainkey, selector1._domainkey (Microsoft), mail._domainkey

no DKIM record on probed selectors (default, google, k1, selector1, selector2, mxvault)

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

cert valid for 122 days

Why it matters: A valid current TLS certificate is the baseline for data in transit. Expiry, weak chain, or hostname mismatch break HTTPS and fail PCI 4.2.1 / SOC 2 CC6.1.

subject cn:: aws.amazon.com
issuer:: Amazon RSA 2048 M04 / Amazon
valid:: Nov 6 00:00:00 2025 GMT → Oct 17 23:59:59 2026 GMT
authorized:: yes
sha256:: CF:A6:CB:61:4D:BD:50:3D:3E:49:90:A3:DF:3E:36:12:94:25:D9:E9:62:A2:9E:5D:6F:FB:72:E6:23:CD:BD:6C
sans: aws.amazon.com
aws-us-west-2.amazon.com
www.aws.amazon.com
1.aws-lbr.amazonaws.com
amazonaws-china.com
www.amazonaws-china.com
aws-us-east-1.amazon.com

fetched 2026-06-17T08:27:30.688Z

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

HTTPS served correctly

Why it matters: Bare HTTP requests must redirect to HTTPS without dropping the user mid-chain. Plain-text fallback or open redirects fail PCI 4.2.1 and feed phishing chains (SOC 2 CC6.6).

final status: 200 · 1 hop

[200] https://aws.amazon.com/

fetched 2026-06-17T08:27:30.979Z

redirects

info

Open standalone →

tracing redirects…

headers

low

Open standalone →

3 security header(s) missing

Why it matters: Security headers — HSTS, CSP, X-Frame-Options, Referrer-Policy — defend against XSS, clickjacking, and downgrade attacks. Absent headers map directly to OWASP ASVS V14 findings (ISO 27001 A.8.23).

Recommendations

Add response header — Content-Security-Policy: default-src 'self' (tune per app)
Add response header — Referrer-Policy: strict-origin-when-cross-origin
Add permissions-policy response header

final url: https://aws.amazon.com/

security headers

strict-transport-security: max-age=47304000; includeSubDomains
content-security-policy: —
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
referrer-policy: —
permissions-policy: —

other headers

connection: keep-alive
content-encoding: gzip
content-type: text/html;charset=utf-8
date: Wed, 17 Jun 2026 08:27:30 GMT
last-modified: Tue, 16 Jun 2026 15:01:08 GMT
server: Server
set-cookie: aws_lang=en; Domain=.amazon.com; Path=/
transfer-encoding: chunked
vary: accept-encoding
via: 1.1 d4b7d888e73186740da95f88adba5686.cloudfront.net (CloudFront)
x-amz-cf-id: lZO6u9DW4E-kmVbbkROaivQfW1Yc6IhIbqBYVIrLuahOjC2isU6X8A==
x-amz-cf-pop: BOM78-P4
x-amz-id-1: 758A6B46D9CD45DE94F7
x-cache: Miss from cloudfront
x-xss-protection: 1; mode=block

fetched 2026-06-17T08:27:30.948Z

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

CORS restricted to specific origin: https://domainposture.com

Why it matters: Overly permissive CORS (wildcard with credentials, or reflected origin) lets any origin read authenticated responses from this domain. OWASP A05 misconfiguration territory (NIST AC-4).

origin: https://domainposture.com
method: GET
preflight status: 200

access-control-* headers

access-control-allow-origin: https://domainposture.com
access-control-allow-methods: GET
access-control-allow-headers: —
access-control-allow-credentials: true
access-control-max-age: —
access-control-expose-headers: —

fetched 2026-06-17T08:27:30.946Z

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

HTTPS surface reachable (robots ✓, sitemap ✗, title ✓)

Why it matters: Public files — robots.txt, sitemap.xml, head meta — are what attackers see first during reconnaissance. Misadvertised paths, stale sitemaps, and verbose generators leak more than intended (ISO 27001 A.8.9).

robots.txt

present

User-agent: AdsBot-Google
User-agent: AdsBot-Google-Mobile
Allow: /pm/
Disallow: /alexaforbusiness/
Disallow: /blogs/
Disallow: /*/blogs/
Disallow: /solutions/case-studies/
Disallow: /*/solutions/case-studies/
Allow: /solutions/case-studies/sustainability-emea/
Allow: /*/solutions/case-studies/sustainability-emea/
Allow: /solutions/case-studies/innovators/innovators-eu/
Allow: /*/solutions/case-studies/innovators/innovators-eu/
Allow: /solutions/case-studies/generative-ai-ekacare/
Allow: /cn/solutions/case-studies/generative-ai-ekacare/
Allow: /solutions/case-studies/generative-ai-mindtickle/
Allow: /cn/solutions/case-studies/generative-ai-mindtickle/
Allow: /solutions/case-studies/generative-ai-invideo/
Allow: /solutions/case-studies/generative-ai-mitsui/
Allow: /solutions/case-studies/generative-ai-national-australia-bank/
Allow: /solutions/case-studies/generative-ai-ntu/
Allow: /solutions/case-studies/generative-ai-qarc/
Allow: /solutions/case-studies/generative-ai-swimming-australia/
Allow: /cn/solutions/case-studies/generative-ai-swimming-australia/
Allow: /solutions/case-studies/generative-ai-thematic/
Allow: /cn/solutions/case-studies/generative-ai-thematic/
Allow: /solutions/case-studies/generative-ai-turing/
Allow: /solutions/case-studies/generative-ai-stockmark/   
Allow: /*/solutions/case-studies/generative-ai-turing/
Allow: /*/solutions/case-studies/generative-ai-stockmark/   
Allow: /solutions/case-studies/generative-ai-starhub/    
Allow: /solutions/case-studies/generative-ai-bolttech/
Allow: /*/solutions/case-studies/generative-ai-starhub/    
Allow: /*/solutions/case-studies/generative-ai-bolttech/

User-agent: *
Disallow: */confirmation/
Disallow: */registration-confirmation/
Disallow: /about-aws/launch-a-website-in-minutes-tutorial/
Disallow: /about-aws/media-coverage/2011/08/17/rhat-support-for-sap-solutions-running-on-rhel-on-amazon-ec2/
Disallow: /about-aws/whats-new/2007/11/07/red-hat-enterprise-linux-available-on-amazon-ec2/
Disallow: /about-aws/whats-new/2008/06/17/jboss-on-amazon-ec2/
Disallow: /about-aws/whats-new/2008/10/01/amazon-ec2-running-windows-server-coming-soon/
Disallow: /about-aws/whats-new/2008/11/03/force.com-toolkit/
Disallow: /about-aws/whats-new/2008/11/18/force.com-toolkit-2/
Disallow: /about-aws/whats-new/2009/01/05/Amazon-CTO-Chief-of-Year/
Disallow: /about-aws/whats-new/2009/01/09/Amazon-CTO-Chief-of-Year-2/
Disallow: /about-aws/whats-new/2009/07/24/aws-survey/
Disallow: /activate/accelerators
Disallow: /activate/accelerators/*
Disallow: /activate/accelerators/confirmation/
Disallow: /activate/china-portfolio-signup/
Disallow: /activate/cloudkata/
Disallow: /activate/event/
Disallow: /activate/event/*
Disallow: /activate/events/*
Disallow: /activate/events/hact/
Disallow: /activate/hackathons
Disallow: /activate/hackathons/*
Disallow: /activate/harvard-innovation-lab-students-2013/
Disallow: /activate/harvard-innovation-lab-vip-teams-2013/
Disallow: /activate/hsw/confirmation/
Disallow: /activate/loft/
Disallow: /activate/self-starters/confirmation/
Disallow: /activate/wdm/*
Disallow: /alexa/*
Disallow: /alexa-top-sites/*
Disallow: /alexa-web-search/*
Disallow: /apac/aws-credits-confirmation/
Disallow: /apac/aws-credits-request-confirmation/
Disallow: /articles/item/
Disallow: /awis/*
Disallow: /aws-summit-2014/enterprise-london-db/
Disallow: /aws-summit-2014/london-db/
Disallow: /blogs/7faebe5debfdd358a46f2452a54eec94fce49269/
Disallow: /campaigns/infor-hub-xt5r5iwdrgxbnuz/
Disallow: /careers/aus-nz-event/
Disallow: /careers/aus-nz-event/
Disallow: /careers/aws-ar-event/
Disallow: /careers/aws-aus-event/
Disallow: /careers/aws-australia-event/
Disallow: /careers/aws-bigdata-hiring/
Disallow: /careers/aws-brisbane-event/
Disallow: /careers/aws-db-event/
Disallow: /careers/aws-ks-event/
Disallow: /careers/aws-london-event/
Disallow: /careers/aws-mexicocity-event/
Disallow: /careers/aws-miami-event/
Disallow: /careers/aws-ny-event/
Disallow: /careers/aws-pittsburgh-event/
Disallow: /careers

sitemap.xml

absent

head

title: Cloud Computing Services - Amazon Web Services (AWS)
description: Amazon Web Services offers reliable, scalable, and inexpensive cloud computing services. Free to join, pay only for what you use.

social

og:type: website
og:site_name: Amazon Web Services, Inc.
og:description: Amazon Web Services offers reliable, scalable, and inexpensive cloud computing services. Free to join, pay only for what you use.
og:title: Cloud Computing Services - Amazon Web Services (AWS)
og:updated_time: 2026-06-16T08:01:00.419-0700
og:url: https://aws.amazon.com/
og:locale: en_US

fetched 2026-06-17T08:27:30.988Z

web-surface

info

Open standalone →

inspecting web surface…

dnssec

medium

Open standalone →

DS records present but DNSSEC chain not validated (no AD flag)

Why it matters: DNSSEC cryptographically signs DNS responses, blocking cache-poisoning attacks. US federal civilian agencies are required to enable it under OMB M-22-09 (NIST SC-20).

Recommendations

Verify the DS record at the parent zone matches the DNSKEY in your authoritative DNS
Check for key-signing key (KSK) rollover issues with your DNS provider

enabled: no
DS records: tp.8e49140c2-frontier.amazon.com., dr49lng3n1n2s.cloudfront.net.
DNSKEY records: 2 key(s)

fetched 2026-06-17T08:27:30.656Z

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

not applicable: no _mta-sts TXT record

Why it matters: MTA-STS forces inbound SMTP to use TLS and refuse downgraded connections. Without it, an in-path attacker can strip TLS and read mail in plaintext (SOC 2 CC6.7).

no _mta-sts TXT record

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

not applicable: no TLSRPT record

Why it matters: TLS-RPT publishes a reporting address for SMTP-TLS failures. Without it, downgrade attacks on inbound mail go unnoticed (SOC 2 CC7.2).

no TLSRPT record

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

not applicable: whois returned no data and RDAP fallback unavailable (registry refused or unmapped TLD)

Why it matters: Registrar and expiry tell auditors the domain is owned, current, and not about to lapse. An expired or about-to-expire domain fails business-continuity evidence (SOC 2 A1.2).

whois returned no data and RDAP fallback unavailable (registry refused or unmapped TLD)

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

check failed: crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

Why it matters: Every certificate issued for this domain is published in Certificate Transparency logs — including subdomains you may have forgotten. Unknown subdomains in CT are pre-disclosed attack surface (ISO 27001 A.8.16).

crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.