bbc.com

15-check dossier · scoreboard above, section details below

Get a pack →

Scanning…

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

resolving mx…

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

resolving dmarc…

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

tracing redirects…

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

inspecting web surface…

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.

bbc.com

15-check dossier · scoreboard above, section details below

Get a pack →

Mostly compliant · 5 items need attention

Aggregate grade across 15 checks. Auditors typically flag any High-severity finding.

Pass: 10
Warn: 5
Fail: 0

What an auditor would flag first

medium
SPF
~all softfail — receivers may still accept
SOC 2 CC6.7ISO 27001 A.13.2.1
low
DKIM
no DKIM selectors found — likely not configured
SOC 2 CC6.7
low
TLS certificate
cert expires in 53 days
SOC 2 CC6.6ISO 27001 A.13.1.1

Need this as an artifact your auditor can verify?

Your bbc.com scan flagged 1 medium and 4 low findings. A signed pack covers the apex plus up to 100 CT-discovered subdomains, Ed25519-signed and ISO-timestamped, delivered in 10–30 minutes.

Get a pack →See methodology See a sample$29

Scanning…

15-check summary

DNS recordsA/AAAA records present
MX2 MX record(s) present
SPF~all softfail — receivers may still accept
DMARCp=reject — strict policy
DKIMno DKIM selectors found — likely not configured
TLS certificatecert expires in 53 days
Redirect chainHTTPS served correctly
Security headers2 security header(s) missing
CORSno CORS headers — cross-origin requests blocked by default
Web surfaceHTTPS surface reachable (robots ✓, sitemap ✓, title ✓)
MTA-STSnot applicable: no _mta-sts TXT record
TLS-RPTnot applicable: no TLSRPT record
DNSSECDNSSEC not configured — no DS or DNSKEY records found
WHOISdomain registered until 2030-07-14
Certificate Transparencycheck failed: crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

dns

info

Open standalone →

A/AAAA records present

Why it matters: Without authoritative A or AAAA records on the apex, the domain is unreachable. Missing baseline DNS shows up in vendor reviews as evidence of unmanaged infrastructure (SOC 2 CC6.6).

A: ttl=294 151.101.0.81
ttl=294 151.101.128.81
ttl=294 151.101.192.81
ttl=294 151.101.64.81
AAAA: ttl=300 2a04:4e42::81
ttl=300 2a04:4e42:200::81
ttl=300 2a04:4e42:400::81
ttl=300 2a04:4e42:600::81
NS: ttl=183 dns0.bbc.co.uk.
ttl=183 dns0.bbc.com.
ttl=183 dns1.bbc.co.uk.
ttl=183 dns1.bbc.com.
ttl=183 ddns0.bbc.co.uk.
ttl=183 ddns0.bbc.com.
ttl=183 ddns1.bbc.co.uk.
ttl=183 ddns1.bbc.com.
SOA: ttl=900 ns.bbc.co.uk. hostmaster.bbc.co.uk. 2026052700 1800 600 864000 10800
CAA: ttl=300 \# 17 00 05 69 73 73 75 65 61 6d 61 7a 6f 6e 2e 63 6f 6d
ttl=300 \# 19 00 05 69 73 73 75 65 64 69 67 69 63 65 72 74 2e 63 6f 6d
ttl=300 \# 21 00 05 69 73 73 75 65 67 6c 6f 62 61 6c 73 69 67 6e 2e 63 6f 6d
ttl=300 \# 25 00 09 69 73 73 75 65 77 69 6c 64 67 6c 6f 62 61 6c 73 69 67 6e 2e 63 6f 6d
ttl=300 \# 32 00 05 69 6f 64 65 66 6d 61 69 6c 74 6f 3a 73 65 63 75 72 69 74 79 40 62 62 63 2e 63 6f 2e 75 6b
TXT: ttl=14400 "v=spf1 ip4:212.58.224.0/19 ip4:132.185.0.0/16 +include:spf.messagelabs.com ~all"
ttl=14400 "Validity-Domain-Verification=TYXJnAeGHNF4DGlOgE4vdoDT3a0="
ttl=14400 "xoCARoExwkNhLPdKaaxv"
ttl=14400 "slack-domain-verification=hza4gfkmctQ7A7BpMhGNVOZVZcKTFC8OC5ewDFVA"
ttl=14400 "atlassian-domain-verification=SQsgJ5h/FqwMTXuSG/G4Nd1Gx6uX2keREOsZSa22D5XT46EsEuyaic8Aej4cR4Tr"
ttl=14400 "dropbox-domain-verification=mtgv0f2pudoz"
ttl=14400 "google-site-verification=mTy-FoNnG0yetpI3-0e9AXctAkUCcWGc_K3BcMfioFI"
ttl=14400 "docusign=57499c1f-9099-463b-a5bd-cb7583816d78"
ttl=14400 "docusign=75217687-3ba0-49bb-bb3b-482d888493af"
ttl=14400 "atlassian-sending-domain-verification=da3721b6-1d2c-4c32-bf01-b792667aeb4d"
ttl=14400 "docker-verification=f89691bb-7bdd-4bc1-9673-57454d6d9c42"
ttl=14400 "adobe-idp-site-verification=c3a16fcb00ac5365e4ea125d5e59d4be11936f768b3020c4d81b4232019604a2"
ttl=14400 "jamf-site-verification=28Mn3O6rTBSXkL5w6c911A"
ttl=14400 "airtable-verification=b1a394c872dd6721d39a1d91cc96080d"

fetched 2026-06-04T05:35:45.484Z

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

2 MX record(s) present

Why it matters: MX records direct inbound mail. Misconfiguration silently breaks email delivery and lets attackers stand up parallel MX hosts for spoofing campaigns (ISO 27001 A.8.21).

pri=10 cluster8.eu.messagelabs.com.
pri=20 cluster8a.eu.messagelabs.com.

fetched 2026-06-04T05:35:45.483Z

mx

info

Open standalone →

resolving mx…

spf

medium

Open standalone →

~all softfail — receivers may still accept

Why it matters: SPF tells receiving servers which hosts may send mail for the domain. Without it, any sender can forge the envelope-from — the primary mechanism behind business-email-compromise (SOC 2 CC6.7).

Recommendations

Move to -all (hardfail) once your mail flow is confirmed — softfail gives no real protection

v=spf1 ip4:212.58.224.0/19 ip4:132.185.0.0/16 +include:spf.messagelabs.com ~all

v=spf1
ip4:212.58.224.0/19
ip4:132.185.0.0/16
+include:spf.messagelabs.com
~all

fetched 2026-06-04T05:35:45.478Z

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

p=reject — strict policy

Why it matters: DMARC binds SPF and DKIM into an enforceable policy (quarantine or reject) and surfaces spoofing attempts via aggregate reports. `p=none` or absent means spoofing succeeds silently (SOC 2 CC6.7).

v=DMARC1;p=reject;aspf=s;adkim=s;pct=100;fo=0;ri=86400; rua=mailto:dmarc_agg@vali.email;

v=: DMARC1
p=: reject
aspf=: s
adkim=: s
pct=: 100
fo=: 0
ri=: 86400
rua=: mailto:dmarc_agg@vali.email

fetched 2026-06-04T05:35:45.484Z

dmarc

info

Open standalone →

resolving dmarc…

dkim

low

Open standalone →

no DKIM selectors found — likely not configured

Why it matters: DKIM signs outbound mail so receivers can detect tampering. Missing selectors or rotated-away keys break DMARC alignment and let receivers downgrade trust (ISO 27001 A.8.24).

Recommendations

Enable DKIM signing in your mail provider and publish the provided TXT record
Common selectors: google._domainkey, selector1._domainkey (Microsoft), mail._domainkey

no DKIM record on probed selectors (default, google, k1, selector1, selector2, mxvault)

dkim

info

Open standalone →

probing dkim selectors…

tls

low

Open standalone →

cert expires in 53 days

Why it matters: A valid current TLS certificate is the baseline for data in transit. Expiry, weak chain, or hostname mismatch break HTTPS and fail PCI 4.2.1 / SOC 2 CC6.1.

Recommendations

Schedule certificate renewal — consider enabling auto-renewal

subject cn:: www.bbc.com
issuer:: GlobalSign RSA OV SSL CA 2018 / GlobalSign nv-sa
valid:: Jun 27 06:54:01 2025 GMT → Jul 27 10:26:17 2026 GMT
authorized:: yes
sha256:: 87:A4:D1:2D:B9:B5:7D:68:64:B5:4D:2E:FD:CC:66:CD:C1:7A:05:17:13:94:8C:F4:0B:EF:42:A0:86:5B:59:CB
sans: www.bbc.com
www.bbc.co.uk
www.bbcrussian.com
bbc.co.uk
bbcrussian.com
session.bbc.co.uk
search.bbc.co.uk
open.live.bbc.co.uk
news.bbc.co.uk
newsimg.bbc.co.uk
wwwnews.live.bbc.co.uk
cdnedge.bbc.co.uk
newsrss.bbc.co.uk
newsvote.bbc.co.uk
playlists.bbc.co.uk
r.bbci.co.uk
node1.bbcimg.co.uk
news.bbcimg.co.uk
account.bbc.com
session.bbc.com
bbc.com

fetched 2026-06-04T05:35:45.522Z

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

HTTPS served correctly

Why it matters: Bare HTTP requests must redirect to HTTPS without dropping the user mid-chain. Plain-text fallback or open redirects fail PCI 4.2.1 and feed phishing chains (SOC 2 CC6.6).

final status: 200 · 2 hops

[301] https://bbc.com/
[200] https://www.bbc.com/

fetched 2026-06-04T05:35:45.626Z

redirects

info

Open standalone →

tracing redirects…

headers

low

Open standalone →

2 security header(s) missing

Why it matters: Security headers — HSTS, CSP, X-Frame-Options, Referrer-Policy — defend against XSS, clickjacking, and downgrade attacks. Absent headers map directly to OWASP ASVS V14 findings (ISO 27001 A.8.23).

Recommendations

Add response header — Content-Security-Policy: default-src 'self' (tune per app)
Add permissions-policy response header

final url: https://www.bbc.com/

security headers

strict-transport-security: max-age=31536000; preload
content-security-policy: —
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
referrer-policy: no-referrer-when-downgrade
permissions-policy: —

other headers

accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
belfrage-cache-status: MISS
bid: sally
brequestid: e431cb78aec1474a968c2b0218ae8f41
bsig: dd6c607f7f127572020f1095728d0b29
cache-control: public, stale-if-error=90, stale-while-revalidate=30, max-age=30
connection: keep-alive
content-encoding: gzip
content-length: 86550
content-type: text/html; charset=utf-8
date: Thu, 04 Jun 2026 05:35:45 GMT
etag: "9vmitfm4nib80t"
fastly-restarts: 1
nel: {"report_to":"default","max_age":2592000,"include_subdomains":true,"failure_fraction":0.25}
origin-agent-cluster: ?0
report-to: {"group":"default","max_age":2592000,"endpoints":[{"url":"https://default.bbc-reporting-api.app/report-endpoint","priority":1}],"include_subdomains":true}
req-svc-chain: FASTLY,GTM,BELFRAGE,BBCX
server: BBC-GTM
vary: X-BBC-Edge-Scheme,Accept-Encoding
via: 1.1 BBC-GTM, 1.1 Belfrage, 1.1 varnish
x-bbc-edge-cache-status: HIT
x-cache: HIT
x-cache-age: 30
x-cache-hits: 1
x-correlation-id: a1738727-2c0b-4f78-bfd6-12f59c5f4a53
x-fastly-cache-status: HIT-CLUSTER
x-fastly-pre-flight-cache: MISS, HIT
x-fastly-pre-flight-cache-status: HIT-WAIT-CLUSTER
x-lb-nocache: true
x-robots-tag: bingbot: noarchive
x-served-by: cache-iad-kjyo7100125-IAD
x-timer: S1780551346.586363,VS0,VE32

fetched 2026-06-04T05:35:45.624Z

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

no CORS headers — cross-origin requests blocked by default

Why it matters: Overly permissive CORS (wildcard with credentials, or reflected origin) lets any origin read authenticated responses from this domain. OWASP A05 misconfiguration territory (NIST AC-4).

origin: https://domainposture.com
method: GET
preflight status: 301

access-control-* headers

access-control-allow-origin: —
access-control-allow-methods: —
access-control-allow-headers: —
access-control-allow-credentials: —
access-control-max-age: —
access-control-expose-headers: —

no access-control-* headers returned — site does not advertise CORS to this origin

fetched 2026-06-04T05:35:45.548Z

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

HTTPS surface reachable (robots ✓, sitemap ✓, title ✓)

Why it matters: Public files — robots.txt, sitemap.xml, head meta — are what attackers see first during reconnaissance. Misadvertised paths, stale sitemaps, and verbose generators leak more than intended (ISO 27001 A.8.9).

robots.txt

present


# version: 93256d693f35d6a70e7c37ac78d3bb49724f63fa
# The BBC's Terms of Use: https://www.bbc.co.uk/terms
# - Explain the rules for using our services
# - Tell you what you can do with our content
#
# In short: Please use our site like a human, not a robot.
# That means:
# - No scraping, crawling, or systematic extraction of content 
# - No use of BBC content for training or fine-tuning AI models, including large language models (LLMs)
# - No retrieval-augmented generation (RAG), AI-powered search, agentic AI or grounding using BBC content
# - No creating datasets from BBC content
# - No text and data mining (TDM) under Article 4 of the EU Directive on Copyright in the Digital Single Market
# - No using BBC content to create summaries for your own use
# - No business use without permission (details: https://www.bbc.co.uk/usingthebbc/terms/can-i-use-bbc-content-for-my-business/)
# - The BBC reserves all rights in its content and expressly opts out of any statutory exceptions in any jurisdiction for text and data mining, as permitted by law
 
# TL;DR: Browse, read, watch, enjoy - like a human.
#

# HTTPS www.bbc.com

User-agent: *
Sitemap: https://www.bbc.com/sitemaps/https-index-com-archive.xml
Sitemap: https://www.bbc.com/sitemaps/https-index-com-news.xml
Sitemap: https://www.bbc.com/sitemaps/https-index-com-archive_video.xml
Sitemap: https://www.bbc.com/sitemaps/https-index-com-video.xml
Sitemap: https://www.bbc.com/sitemaps/sitemap-com-ws-topics.xml
Sitemap: https://www.bbc.com/sport/sitemap.xml
Sitemap: https://www.bbc.com/sitemaps/sitemap-com-ws-topics.xml
Sitemap: https://www.bbc.com/afrique/sitemap.xml
Sitemap: https://www.bbc.com/arabic/sitemap.xml
Sitemap: https://www.bbc.com/bengali/sitemap.xml
Sitemap: https://www.bbc.com/burmese/sitemap.xml
Sitemap: https://www.bbc.com/gahuza/sitemap.xml
Sitemap: https://www.bbc.com/hausa/sitemap.xml
Sitemap: https://www.bbc.com/hindi/sitemap.xml
Sitemap: https://www.bbc.com/indonesia/sitemap.xml
Sitemap: https://www.bbc.com/mundo/sitemap.xml
Sitemap: https://www.bbc.com/pashto/sitemap.xml
Sitemap: https://www.bbc.com/persian/sitemap.xml
Sitemap: https://www.bbc.com/portuguese/sitemap.xml
Sitemap: https://www.bbc.com/russian/sitemap.xml
Sitemap: https://www.bbc.com/swahili/sitemap.xml
Sitemap: https://www.bbc.com/tajik/sitemap.xml
Sitemap: https://www.bbc.com/turkce/sitemap.xml
Sitemap: https://www.bbc.com/ukchina/simp/sitemap.xml
Sitemap: https://www.bbc.com/ukrainian/sitemap.xml
Sitemap: https://www.bbc.com/urdu/sitemap.xml
Sitemap: https://www.bbc.com/uzbek/sitemap.xml
Sitemap: https://www.bbc.com/vietnamese/sitemap.xml
Sitemap: https://www.bbc.com/zhongwen/simp/sitemap.xml
Sitemap: https://www.bbc.com/zhongwen/trad/sitemap.xml
Sitemap: https://www.bbc.com/bbcx/index_sitemap.xml
Sitemap: https://www.bbc.com/bbcx/audio_archive_sitemap.xml
Sitemap: https://www.bbc.com/bbcx/video_documentaries_sitemap.xml
Sitemap: https://www.bbc.com/bbcx/content_index_sitemap.xml

Disallow: /asset/
Disallow: /backstage/bbc-login-help/
Disallow: /backstage/bbc-login-help$
Disallow: /bitesize/search$
Disallow: /bitesize/search/
Disallow: /bitesize/search?
Disallow: /cbbc/search/
Disallow: /cbbc/search$
Disallow: /cbbc/search?
Disallow: /cbeebies/search/
Disallow: /cbeebies/search$
Disallow: /cbeebies/search?
Disallow: /chwilio/
Disallow: /chwilio$
Disallow: /chwilio?
Disallow: /education/blocks$
Disallow: /education/blocks/
Disallow: /newsround
Disallow: /search/
Disallow: /search$
Disallow: /search?
Disallow: /food/favourites
Disallow: /food/search*?*
Disallow: /food/recipes/search*?*
Disallow: /education/my$
Disallow: /education/my/
Disallow: /bitesize/my$
Disallow: /bitesize/my/
Disallow: /food/recipes/*/shopping-list
Disallow: /food/menus/*/shopping-list
Disallow: /news/0
Disallow: /sport/alpha/
Disallow: /ugc$
Disallow: /ugc/
Disallow: /ugcsupport$
Disallow: /ugcsupport/
Disallow: /userinfo/
Disallow: /userinfo
Disallow: /u5llnop$
Disallow: /u5llnop/
Disallow: /sounds/search$
Disallow: /sounds/search/
Disallow: /sounds/search?
Disallow: /ws/includes
Disallow: /radio/imda
Disallow: /storyw

sitemap.xml

present — 5 url(s)

head

title: BBC Home - Breaking News, World News, US News, Sports, Business, Innovation, Climate, Culture, Travel, Video & Audio
description: Visit BBC for trusted reporting on the latest world and US news, sports, business, climate, innovation, culture and much more.

social

og:title: BBC Home - Breaking News, World News, US News, Sports, Business, Innovation, Climate, Culture, Travel, Video & Audio
og:description: Visit BBC for trusted reporting on the latest world and US news, sports, business, climate, innovation, culture and much more.
twitter:title: BBC Home - Breaking News, World News, US News, Sports, Business, Innovation, Climate, Culture, Travel, Video & Audio
twitter:description: Visit BBC for trusted reporting on the latest world and US news, sports, business, climate, innovation, culture and much more.

fetched 2026-06-04T05:35:45.655Z

web-surface

info

Open standalone →

inspecting web surface…

dnssec

low

Open standalone →

DNSSEC not configured — no DS or DNSKEY records found

Why it matters: DNSSEC cryptographically signs DNS responses, blocking cache-poisoning attacks. US federal civilian agencies are required to enable it under OMB M-22-09 (NIST SC-20).

Recommendations

Enable DNSSEC in your DNS provider's control panel and add the resulting DS record at your registrar

enabled: no
DS records: —
DNSKEY records: —

fetched 2026-06-04T05:35:45.488Z

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

not applicable: no _mta-sts TXT record

Why it matters: MTA-STS forces inbound SMTP to use TLS and refuse downgraded connections. Without it, an in-path attacker can strip TLS and read mail in plaintext (SOC 2 CC6.7).

no _mta-sts TXT record

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

not applicable: no TLSRPT record

Why it matters: TLS-RPT publishes a reporting address for SMTP-TLS failures. Without it, downgrade attacks on inbound mail go unnoticed (SOC 2 CC7.2).

no TLSRPT record

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

domain registered until 2030-07-14

Why it matters: Registrar and expiry tell auditors the domain is owned, current, and not about to lapse. An expired or about-to-expire domain fails business-continuity evidence (SOC 2 A1.2).

registrar: Tucows Domains Inc.
created: 1989-07-15T04:00:00Z
expires: 2030-07-14T04:00:00Z
statuses: clientTransferProhibited https://icann.org/epp#clientTransferProhibited, clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited, serverDeleteProhibited https://icann.org/epp#serverDeleteProhibited, serverTransferProhibited https://icann.org/epp#serverTransferProhibited

fetched 2026-06-04T05:35:45.822Z

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

check failed: crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

Why it matters: Every certificate issued for this domain is published in Certificate Transparency logs — including subdomains you may have forgotten. Unknown subdomains in CT are pre-disclosed attack surface (ISO 27001 A.8.16).

crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.