bigcommerce.com

15-check dossier · scoreboard above, section details below

Get a pack →

Scanning…

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

resolving mx…

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

resolving dmarc…

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

tracing redirects…

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

inspecting web surface…

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.

bigcommerce.com

15-check dossier · scoreboard above, section details below

Get a pack →

Mostly compliant · 5 items need attention

Aggregate grade across 15 checks. Auditors typically flag any High-severity finding.

Pass: 10
Warn: 5
Fail: 0

What an auditor would flag first

medium
SPF
~all softfail — receivers may still accept
SOC 2 CC6.7ISO 27001 A.13.2.1
low
DMARC
p=quarantine — receivers send to spam
SOC 2 CC6.7ISO 27001 A.13.2.1
low
DKIM
1/6 DKIM selectors valid
SOC 2 CC6.7

Need this as an artifact your auditor can verify?

Your bigcommerce.com scan flagged 1 medium and 4 low findings. A signed pack covers the apex plus up to 100 CT-discovered subdomains, Ed25519-signed and ISO-timestamped, delivered in 10–30 minutes.

Get a pack →See methodology See a sample$29

Scanning…

15-check summary

DNS recordsA/AAAA records present
MX5 MX record(s) present
SPF~all softfail — receivers may still accept
DMARCp=quarantine — receivers send to spam
DKIM1/6 DKIM selectors valid
TLS certificatecert valid for 126 days
Redirect chainHTTPS served correctly
Security headers3 security header(s) missing
CORSno CORS headers — cross-origin requests blocked by default
Web surfaceHTTPS surface reachable (robots ✓, sitemap ✗, title ✓)
MTA-STSnot applicable: no _mta-sts TXT record
TLS-RPTnot applicable: no TLSRPT record
DNSSECDNSSEC not configured — no DS or DNSKEY records found
WHOISdomain registered until 2028-02-08
Certificate Transparencycheck failed: crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

dns

info

Open standalone →

A/AAAA records present

Why it matters: Without authoritative A or AAAA records on the apex, the domain is unreachable. Missing baseline DNS shows up in vendor reviews as evidence of unmanaged infrastructure (SOC 2 CC6.6).

A: ttl=300 63.141.128.3
ttl=300 192.200.160.253
AAAA: —
NS: ttl=2795 ns-cloud-d1.googledomains.com.
ttl=2795 dns2.p01.nsone.net.
ttl=2795 ns-cloud-d3.googledomains.com.
ttl=2795 ns-cloud-d2.googledomains.com.
SOA: ttl=21600 ns-cloud-d1.googledomains.com. cloud-dns-hostmaster.google.com. 1 21600 3600 259200 300
CAA: —
TXT: ttl=900 "stripe-verification=8E1643BB1E090B59C1F856110BB5B3E60D2A22CEE98A6C6671104361EF1B3368"
ttl=900 "atlassian-domain-verification=DH/o4CLaorQMynXBdX7muPiomWfyWiWeMIVmajNXDhQ2S60drXUCaDUTW9HLwsaB"
ttl=900 "docusign=84edac5a-e870-46a3-b3c8-651fb4bbdd8a"
ttl=900 "55c3391166ec417c8a32ee3adc1e5833"
ttl=900 "google-site-verification=cc3UJVdqH6LNpPWse7P-2K3g1m-l53PF1L5GYkWZ8vQ"
ttl=900 "docker-verification=1f105d83-cd33-4776-9cfa-a6d299ef4079"
ttl=900 "facebook-domain-verification=6vbnygaebese1kvuycu2hmydt74oxh"
ttl=900 "pendo-domain-verification=98a21714-5bc5-4b95-b29c-f7255ee21edb"
ttl=900 "xdtdAirI0HOW92VsDWqi5ie3Sw"
ttl=900 "make-domain-verification=847a8225-4b99-4f0d-b6fb-398ff70260f3"
ttl=900 "google-site-verification=Je_nji7iiI0lcHbkf3ZYmU0CbAJpTj0IQdTrntB_BzI"
ttl=900 "MS=ms60407567"
ttl=900 "stripe-verification=4373D5ABE9FB14237902C5003C47538CD7F3724EEE509DE951B29BE09AB5F0F3"
ttl=900 "_ixbpsf0ldac68ifwnoydrdefj4lct76"
ttl=900 "citrix-verification-code=e4ed595b-020f-4ae6-8f3a-d66f5a2d0b1f"
ttl=900 "browserstack-domain-verification=6491380b-0b61-4c6c-929a-9e5c0a2fe5b4"
ttl=900 "globalsign-domain-verification=jpcnVg6kuHYyEz5op6ZzxI2E53gePoVqca7RgL0aNq"
ttl=900 "stripe-verification=6F478566ED5E08A41C96BF1F271E86D47C1034C66F3C3D79C778646BE02C8FF8"
ttl=900 "stripe-verification=FF82E885D06757D3CCF3A3C55CD6E16B476FF66B668DF88BCA075936A2F1528E"
ttl=900 "google-site-verification=lSFR7DaBCHnrpao2rY79-x4gshzCJEuFrKPOlfEno9I"
ttl=900 "google-site-verification=w4eNbEValiap9E2V3AREAHrPUWxXxpJejU5b56O-UQU"
ttl=900 "slack-domain-verification=PDv4TgfnNzNnJ28yS9OmlbzULwmjPbjNJn2fBsyB"
ttl=900 "linear-domain-verification=mzvc44kjbdp3"
ttl=900 "stripe-verification=649F27E0935990C4F127CF8E57B71F14B6977BDBE092EF33DE209F500E4AB551"
ttl=900 "stripe-verification=EDF4E04D52B3B8EC6F398B5042DD715373462ADBEB582B5F4A0FA2B8AAFCC9F4"
ttl=900 "google-site-verification=kSDJpCV0m9JJ3VpLeOHjofJU_2jEDDPTvAY9ang0BOE"
ttl=900 "anthropic-domain-verification-ef5r55=pfodvgQIUlYdeSev0p5G93FGX"
ttl=900 "v=spf1 include:_spf.bigcommerce.com include:_spf.google.com include:spf.mandrillapp.com ip4:192.28.144.165 include:_spf.salesforce.com include:amazonses.com a:zgateway.zuora.com ~all"
ttl=900 "apple-domain-verification=KOV2pL3nbJXXV6lZ"
ttl=900 "drift-domain-verification=1d71a8baf8b89a67c9731003d9f9c5da3335d1d57c3bd920a0f045408c0cd2ac"
ttl=900 "openai-domain-verification=dv-EqyKINOUdmLYPSd9SevQVOX8"
ttl=900 "MS=ms76375977"
ttl=900 "hubspot-domain-verification=ZjA1MTcxNGMtM2Q1Zi00NjM4LWE1MjYtYWU2MGFmZDE3ZDc0"
ttl=900 "jamf-site-verification=llnWTHppqXwC9RTrokA7Ig"
ttl=900 "segment-site-verification=jQiuL6eK28PF0N07gNHLJ8epyW6Hj2k0"
ttl=900 "miro-verification=53929802bdebe4593686ff037ad8d589620db54d"
ttl=900 "globalsign-domain-verification=3Fl4Eqj_V08XH5MZb8lPUQ4LiuWJf4kLzrGscuVilP"
ttl=900 "zoho-verification=zb42296805.zmverify.zoho.com"
ttl=900 "adobe-idp-site-verification=2c89746d-c625-4e2c-abec-11249178916b"
ttl=900 "canva-site-verification=L5kFGonOKRjITC53sRRtow"
ttl=900 "google-site-verification=96ihpTeQnGctdy_C0L0pBz-pUYrefZqBZjVxhKom7m4"
ttl=900 "asv=c69323db81b6ede6d8295bbb5da7c179"
ttl=900 "google-site-verification=_G-MwZnW8-yaKsZ9gZY2ggJliuuLJ2xGW7xqR-JPHIg"
ttl=900 "_l1obg75j6veklvhf89rq42ua919dtg3"

fetched 2026-06-04T02:34:22.375Z

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

5 MX record(s) present

Why it matters: MX records direct inbound mail. Misconfiguration silently breaks email delivery and lets attackers stand up parallel MX hosts for spoofing campaigns (ISO 27001 A.8.21).

pri=10 aspmx.l.google.com.
pri=20 alt2.aspmx.l.google.com.
pri=20 alt1.aspmx.l.google.com.
pri=30 aspmx2.googlemail.com.
pri=30 aspmx3.googlemail.com.

fetched 2026-06-04T02:34:22.370Z

mx

info

Open standalone →

resolving mx…

spf

medium

Open standalone →

~all softfail — receivers may still accept

Why it matters: SPF tells receiving servers which hosts may send mail for the domain. Without it, any sender can forge the envelope-from — the primary mechanism behind business-email-compromise (SOC 2 CC6.7).

Recommendations

Move to -all (hardfail) once your mail flow is confirmed — softfail gives no real protection

v=spf1 include:_spf.bigcommerce.com include:_spf.google.com include:spf.mandrillapp.com ip4:192.28.144.165 include:_spf.salesforce.com include:amazonses.com a:zgateway.zuora.com ~all

v=spf1
include:_spf.bigcommerce.com
include:_spf.google.com
include:spf.mandrillapp.com
ip4:192.28.144.165
include:_spf.salesforce.com
include:amazonses.com
a:zgateway.zuora.com
~all

fetched 2026-06-04T02:34:22.376Z

spf

info

Open standalone →

resolving spf…

dmarc

low

Open standalone →

p=quarantine — receivers send to spam

Why it matters: DMARC binds SPF and DKIM into an enforceable policy (quarantine or reject) and surfaces spoofing attempts via aggregate reports. `p=none` or absent means spoofing succeeds silently (SOC 2 CC6.7).

Recommendations

Upgrade to p=reject once your SPF and DKIM pass rates are consistently high

v=DMARC1;p=quarantine;pct=100;rua=mailto:dmarc_agg@dmarc.everest.email;ruf=mailto:dmarc_fr@dmarc.everest.email;fo=1;rf=afrf

v=: DMARC1
p=: quarantine
pct=: 100
rua=: mailto:dmarc_agg@dmarc.everest.email
ruf=: mailto:dmarc_fr@dmarc.everest.email
fo=: 1
rf=: afrf

fetched 2026-06-04T02:34:22.367Z

dmarc

info

Open standalone →

resolving dmarc…

dkim

low

Open standalone →

1/6 DKIM selectors valid

Why it matters: DKIM signs outbound mail so receivers can detect tampering. Missing selectors or rotated-away keys break DMARC alignment and let receivers downgrade trust (ISO 27001 A.8.24).

Recommendations

Check the missing selectors in your DNS provider and re-add any removed records

default:: —
google:: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAj7WUDlz/NyDLbV6wu7IMYpvKgp6EBLXK+/xPP/vYwgqWzcZ9kx137U8qCsEjpOQIbq9mA+AxfaiC/Ha9lDYF6VBhchHO7PRpjKB+Dp0yYeT4v1oyPDD8LbV4Z4Ly9O5LYAWOpkB7p3NZeouZ6dS5slg+kF1WOA0wgsVwhuwKDoQ+kcSeJrXMm/9vXxPaZI3bSc9efTcS60uYGfxIsUIae6XlcH7KsLaSY5XH7xY/QxT3PASlajMT8P37wQJZ7Kx7YVUMwXIBunb7JiqEBcv09Kob+DOZkuybx9J+I6wQiPBgQY5ElEfo85+APtRRkUhXkP/4EZWdu/z7+/O7sy2/ZwIDAQAB
k1:: —
selector1:: —
selector2:: —
mxvault:: —

fetched 2026-06-04T02:34:22.376Z

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

cert valid for 126 days

Why it matters: A valid current TLS certificate is the baseline for data in transit. Expiry, weak chain, or hostname mismatch break HTTPS and fail PCI 4.2.1 / SOC 2 CC6.1.

subject cn:: *.bigcommerce.com
issuer:: DigiCert Global G2 TLS RSA SHA256 2020 CA1 / DigiCert Inc
valid:: Mar 24 00:00:00 2026 GMT → Oct 8 23:59:59 2026 GMT
authorized:: yes
sha256:: A6:AB:F7:86:CA:62:83:37:88:69:34:D0:F7:10:3E:87:90:E6:A4:E9:A4:28:43:B1:86:F3:CC:8E:5C:65:BA:5F
sans: *.bigcommerce.com
bigcommerce.com

fetched 2026-06-04T02:34:22.413Z

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

HTTPS served correctly

Why it matters: Bare HTTP requests must redirect to HTTPS without dropping the user mid-chain. Plain-text fallback or open redirects fail PCI 4.2.1 and feed phishing chains (SOC 2 CC6.6).

final status: 200 · 2 hops

[301] https://bigcommerce.com/
[200] https://www.bigcommerce.com/

fetched 2026-06-04T02:34:22.685Z

redirects

info

Open standalone →

tracing redirects…

headers

low

Open standalone →

3 security header(s) missing

Why it matters: Security headers — HSTS, CSP, X-Frame-Options, Referrer-Policy — defend against XSS, clickjacking, and downgrade attacks. Absent headers map directly to OWASP ASVS V14 findings (ISO 27001 A.8.23).

Recommendations

Add response header — X-Frame-Options: DENY (or SAMEORIGIN if framing is intended)
Add response header — X-Content-Type-Options: nosniff
Add permissions-policy response header

final url: https://www.bigcommerce.com/

security headers

strict-transport-security: max-age=2592000; includeSubDomains
content-security-policy: frame-ancestors 'self' app.makeswift.com
x-frame-options: —
x-content-type-options: —
referrer-policy: no-referrer-when-downgrade
permissions-policy: —

other headers

age: 3313
alt-svc: h3=":443"; ma=86400
bc-ray: 1
cache-control: public, max-age=0, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: a06389c27d4c82bd-IAD
connection: keep-alive
content-encoding: br
content-type: text/html; charset=utf-8
date: Thu, 04 Jun 2026 02:34:22 GMT
document-policy: js-profiling
server: cloudflare
set-cookie: __cf_bm=iTIvnYlg.YZYsMPgowwcZ39adGCsNZFdyMulcqeIzFk-1780540462.4797702-1.0.1.1-pxRwFGBNiuuKWd7sFDTMXbuvZU5N2OPmQ8v6ukyKOvDThPhUwIA8e5Juq.CfhwZHBW9rsd91RQTap7awWA22ErJB3z3cgmXpEW3MfX_d96JeyvaUbWS6REqgShIGjXHF; HttpOnly; SameSite=None; Secure; Path=/; Domain=bigcommerce.com; Expires=Thu, 04 Jun 2026 03:04:22 GMT
transfer-encoding: chunked
vary: accept-encoding
x-matched-path: /en-US/[[...path]]
x-powered-by: Next.js
x-vercel-cache: HIT
x-vercel-id: cle1:iad1::iad1::xx8mv-1780540462498-7645246ddd3f

fetched 2026-06-04T02:34:22.784Z

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

no CORS headers — cross-origin requests blocked by default

Why it matters: Overly permissive CORS (wildcard with credentials, or reflected origin) lets any origin read authenticated responses from this domain. OWASP A05 misconfiguration territory (NIST AC-4).

origin: https://domainposture.com
method: GET
preflight status: 301

access-control-* headers

access-control-allow-origin: —
access-control-allow-methods: —
access-control-allow-headers: —
access-control-allow-credentials: —
access-control-max-age: —
access-control-expose-headers: —

no access-control-* headers returned — site does not advertise CORS to this origin

fetched 2026-06-04T02:34:22.437Z

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

HTTPS surface reachable (robots ✓, sitemap ✗, title ✓)

Why it matters: Public files — robots.txt, sitemap.xml, head meta — are what attackers see first during reconnaissance. Misadvertised paths, stale sitemaps, and verbose generators leak more than intended (ISO 27001 A.8.9).

robots.txt

present

# robots.txt for https://www.bigcommerce.com/
User-agent: deepcrawl
Disallow: /

User-agent: *
# Directories
Disallow: /includes/
Disallow: /misc/
Disallow: /modules/
Disallow: /profiles/
Disallow: /scripts/
Disallow: /themes/
Disallow: /mojocheck/
Disallow: /split/

# Files
Disallow: /CHANGELOG.txt
Disallow: /cron.php
Disallow: /INSTALL.mysql.txt
Disallow: /INSTALL.pgsql.txt
Disallow: /INSTALL.sqlite.txt
Disallow: /install.php
Disallow: /INSTALL.txt
Disallow: /LICENSE.txt
Disallow: /MAINTAINERS.txt
Disallow: /update.php
Disallow: /UPGRADE.txt
Disallow: /xmlrpc.php
Disallow: /index.php

# Paths (clean URLs)
Disallow: /admin/
Disallow: /hub/
Disallow: /comment/reply/
Disallow: /*filter=
Disallow: /?filter=
Disallow: /comment/
Disallow: /*price=
Disallow: /?price=
Disallow: /filter/tips/
Disallow: /node/add/
Disallow: /search/
Disallow: /user/
Disallow: /lp

# Paths (Don't index any unclean paths)
# Paths (Don't index any unclean paths)
Disallow: */?q=
Disallow: */?s=
Disallow: */?marketplaceCosts=
Disallow: */?ajs_aid=
Disallow: */?utm
Disallow: */?fl_
Disallow: */?industry=
Disallow: */?preview
Disallow: */?kme
Disallow: */?search=
Disallow: */s_id=
Disallow: */?costPlans=
Disallow: */?sort=
Disallow: */?collection=
Disallow: */?price=


Sitemap: https://www.bigcommerce.com/blog/sitemap-blog.xml
Sitemap: https://www.bigcommerce.com/apps/sitemap-marketplace-apps.xml
Sitemap: https://www.bigcommerce.com/apps/sitemap-marketplace-apps-categories.xml
Sitemap: https://www.bigcommerce.com/apps/sitemap-marketplace-apps-collections.xml
Sitemap: https://www.bigcommerce.com/theme/sitemap-marketplace-themes.xml
Sitemap: https://www.bigcommerce.com/theme/sitemap-marketplace-theme-industries.xml
Sitemap: https://www.bigcommerce.com/showcase/sitemap-showcase.xml
Sitemap: https://www.bigcommerce.com/sitemap-main.xml
Sitemap: https://www.bigcommerce.com/articles/sitemap-articles.xml
Sitemap: https://www.bigcommerce.com/press/sitemap-press.xml
Sitemap: https://www.bigcommerce.com/case-study/case-study.xml
Sitemap: https://www.bigcommerce.com/resources/resources.xml
Sitemap: https://www.bigcommerce.com/glossary/glossary-categories.xml
Sitemap: https://www.bigcommerce.com/glossary/glossary.xml
# Algolia-Crawler-Verif: 46E447DA7CAB443ABCE

sitemap.xml

absent

head

title: Commerce built for momentum. | BigCommerce
description: Power modern buying experiences across brands, regions, and channels — all from a single, scalable foundation. Learn more.

social

og:type: website
og:locale: en_US
og:site_name: BigCommerce
og:url: https://www.bigcommerce.com/
og:description: Power modern buying experiences across brands, regions, and channels — all from a single, scalable foundation. Learn more.
og:image: https://storage.googleapis.com/s.mkswft.com/RmlsZToyOTllMzFlYS00OGI4LTQ4ZTAtOTA0Ny1kNzIxNTBkODNhMjE=/BigCommerce-Social-Image-Generic-Facebook.jpg
og:image:type: image/jpeg
twitter:card: summary_large_image
twitter:site: @BigCommerce
twitter:creator: @BigCommerce
twitter:description: Power modern buying experiences across brands, regions, and channels — all from a single, scalable foundation. Learn more.
twitter:image: https://storage.googleapis.com/s.mkswft.com/RmlsZToyOTllMzFlYS00OGI4LTQ4ZTAtOTA0Ny1kNzIxNTBkODNhMjE=/BigCommerce-Social-Image-Generic-Facebook.jpg

fetched 2026-06-04T02:34:22.708Z

web-surface

info

Open standalone →

inspecting web surface…

dnssec

low

Open standalone →

DNSSEC not configured — no DS or DNSKEY records found

Why it matters: DNSSEC cryptographically signs DNS responses, blocking cache-poisoning attacks. US federal civilian agencies are required to enable it under OMB M-22-09 (NIST SC-20).

Recommendations

Enable DNSSEC in your DNS provider's control panel and add the resulting DS record at your registrar

enabled: no
DS records: —
DNSKEY records: —

fetched 2026-06-04T02:34:22.377Z

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

not applicable: no _mta-sts TXT record

Why it matters: MTA-STS forces inbound SMTP to use TLS and refuse downgraded connections. Without it, an in-path attacker can strip TLS and read mail in plaintext (SOC 2 CC6.7).

no _mta-sts TXT record

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

not applicable: no TLSRPT record

Why it matters: TLS-RPT publishes a reporting address for SMTP-TLS failures. Without it, downgrade attacks on inbound mail go unnoticed (SOC 2 CC7.2).

no TLSRPT record

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

domain registered until 2028-02-08

Why it matters: Registrar and expiry tell auditors the domain is owned, current, and not about to lapse. An expired or about-to-expire domain fails business-continuity evidence (SOC 2 A1.2).

registrar: SafeNames Ltd.
created: 1999-02-08T05:00:00Z
expires: 2028-02-08T05:00:00Z
statuses: clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited, clientTransferProhibited https://icann.org/epp#clientTransferProhibited, clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited

fetched 2026-06-04T02:34:22.780Z

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

check failed: crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

Why it matters: Every certificate issued for this domain is published in Certificate Transparency logs — including subdomains you may have forgotten. Unknown subdomains in CT are pre-disclosed attack surface (ISO 27001 A.8.16).

crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.