blackrock.com

15-check dossier · scoreboard above, section details below

embed badge

Markdown

[![Domain posture](https://www.domainposture.com/d/blackrock.com/badge.svg)](https://www.domainposture.com/d/blackrock.com)

HTML

<a href="https://www.domainposture.com/d/blackrock.com"><img src="https://www.domainposture.com/d/blackrock.com/badge.svg" alt="Domain posture" /></a>

Scanning…

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

resolving mx…

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

resolving dmarc…

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

tracing redirects…

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

inspecting web surface…

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.

blackrock.com

15-check dossier · scoreboard above, section details below

Get a pack →

embed badge

Markdown

[![Domain posture](https://www.domainposture.com/d/blackrock.com/badge.svg)](https://www.domainposture.com/d/blackrock.com)

HTML

<a href="https://www.domainposture.com/d/blackrock.com"><img src="https://www.domainposture.com/d/blackrock.com/badge.svg" alt="Domain posture" /></a>

Mostly compliant · 3 items need attention

Aggregate grade across 15 checks. Auditors typically flag any High-severity finding.

Pass: 12
Warn: 3
Fail: 0

What an auditor would flag first

medium
SPF
~all softfail — receivers may still accept
SOC 2 CC6.7ISO 27001 A.8.20
low
DMARC
p=quarantine — receivers send to spam
SOC 2 CC6.7ISO 27001 A.5.14
low
DKIM
no DKIM selectors found — likely not configured
SOC 2 CC6.7

Need this as an artifact your auditor can verify?

Your blackrock.com scan flagged 1 medium and 2 low findings. A signed pack covers the apex plus up to 100 CT-discovered subdomains, Ed25519-signed and ISO-timestamped, delivered in 10–30 minutes.

Get a pack →See methodology See a sample$29

Scanning…

15-check summary

DNS recordsA/AAAA records present
MX2 MX record(s) present
SPF~all softfail — receivers may still accept
DMARCp=quarantine — receivers send to spam
DKIMno DKIM selectors found — likely not configured
TLS certificatecert valid for 177 days
Redirect chainHTTPS served correctly
Security headers1 security header(s) missing
CORSno CORS headers — cross-origin requests blocked by default
Web surfaceHTTPS surface reachable (robots ✓, sitemap ✗, title ✓)
MTA-STSnot applicable: no _mta-sts TXT record
TLS-RPTnot applicable: no TLSRPT record
DNSSECDNSSEC enabled — DS records present and chain validated (AD flag)
WHOISdomain registered until 2026-11-25
Certificate Transparencycheck failed: crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

dns

info

Open standalone →

A/AAAA records present

Why it matters: Without authoritative A or AAAA records on the apex, the domain is unreachable. Missing baseline DNS shows up in vendor reviews as evidence of unmanaged infrastructure (SOC 2 CC6.6).

A: ttl=300 69.52.2.199
ttl=300 69.52.13.199
AAAA: —
NS: ttl=86400 ns1.blackrock.com.
ttl=86400 ns2.blackrock.com.
ttl=86400 ns3.blackrock.com.
ttl=86400 ns4.blackrock.com.
ttl=86400 ns5.blackrock.com.
ttl=86400 ns6.blackrock.com.
SOA: ttl=3600 ns1.blackrock.com. netops.blackrock.com. 2026060603 3600 900 604800 3600
CAA: —
TXT: ttl=300 "MS=ms38828697"
ttl=300 "_slack-challenge"
ttl=300 "00DcT000002htHp=1TBcT000000009h"
ttl=300 "00Df4000001SWZk=1TBQm00000006YU"
ttl=300 "_9duhsauogp5bndkjabtkk5hacebwcch"
ttl=300 "_mv3vc0paxjh9yetwpw0f8mhpxn3oksc"
ttl=300 "LastPass-ty@2D8o^qLhx3B8CYS3h9G^q"
ttl=300 "ZOOM_verify_FsOJw095SMyypVXs8wlBQQ"
ttl=300 "ZOOM_verify_u51YW9QoScOHBUzIhbDgtg"
ttl=300 "0f1815be-65d1-4cbf-9fda-f331702621b5"
ttl=300 "18E2-B4A1-A780-E9D8-DE27-00BD-E084-6F52"
ttl=300 "2FE6-F3BB-EDF8-C58F-D2A4-8035-EDCF-AFB0"
ttl=300 "ibmid=50361729-4788-493b-babc-bc3e853dbcb7"
ttl=300 "docusign=a2dbcd74-2a86-49de-b3f6-0c5d794d9f70"
ttl=300 "docusign=b627a610-c752-4e1d-8de5-13f584944729"
ttl=300 "jamf-site-verification=vkr91zki8qtmKiMDd0tVgA"
ttl=300 "canva-site-verification=2AxQuQbX2q8uqx6olltpBA"
ttl=300 "astro-domain-verification=cmcccdx4h018d01gvk7ehyv61"
ttl=300 "amazonses:1HI9lAXiWsijpz4JNXwXz2gQaHC2wXzskAqDUj3RTg8="
ttl=300 "openai-domain-verification=dv-t8zlUHqPKw7yePArKHz0zNoz"
ttl=300 "v=spf1 include:%{ir}.%{v}.%{d}.spf.has.pphosted.com ~all"
ttl=300 "miro-verification=c251e96c2eabddce3b22b2df374ab39e88970a44"
ttl=300 "miro-verification=eceb7135b08ca0b6c70bfa3efeb5d7a66f1ea1bb"
ttl=300 "mongodb-site-verification=ocUum2f1wfuEq7KWecCMvS3K0fWQLjaP"
ttl=300 "facebook-domain-verification=jgst7ahvoqwagulxzu7zstebenl0nh"
ttl=300 "lutron-domain-verification-c654xa=rAODDyHiWZEBSCvuKbUWqNGvt"
ttl=300 "smartsheet-site-validation=DhO08aWdiKQgWHj44tKwLySIpkgYcV7V"
ttl=300 "onetrust-domain-verification=325159a07083492d9c6b3d8986a51286"
ttl=300 "anthropic-domain-verification-p2md8z=rt7WGZu8bPVVrFPRfiSUdIlWJ"
ttl=300 "intercom-domain-validation=6c808e04-1e9c-4301-b565-60af75f09d6a"
ttl=300 "5c6b3a4f931e1cee133989872555093bf795d13585b18b9815abae5b154b34b2"
ttl=300 "gitpod-verification=KpVeT9c6JQ1tzXbldhdFbUkDrjI1ypJ7pbCzrYVlKHc="
ttl=300 "google-site-verification=z1Aw-cih_E2FKOWotfSW8RUFHKmTIfB1VXHbV_J6bM8"
ttl=300 "passthrough-domain-verification=8038ac2a-be11-480b-a6e7-f5e44be2e61f"
ttl=300 "censys-domain-verification=10dhRNVA4LQ-8TgjCYUytGfLfyvQy-1-JvrSVHn_RTmP"
ttl=300 "h1-domain-verification=ktpxEvEwdQXJNsQuFywMvSrzMVyqLQXdXK4LzzPHBeUwK6Sa"
ttl=300 "zapier-domain-verification-challenge=67f2bc72-40e3-4f27-a7ea-09d6a4753da2"
ttl=300 "atlassian-sending-domain-verification=2f929226-2c0c-4306-ac9a-43dc18508fb8"
ttl=300 "intersight=162938a7f29649663d27ccf1b81d58259224c4820fdd02fa3612e95c123f8ce7"
ttl=300 "duo_sso_verification=4Rjlata2GmnHS66E9wbFXjZGtssVPUzUaV5XE4YjDS726aDgVMQOkbZTdmUwjG9m"
ttl=300 "duo_sso_verification=JnQQBWIliQ5FriK2DOPrGg16cJoZiSOfSLUCv02CQtvxU8NXyRChuWaXLem8RizK"
ttl=300 "QKhkBUJSEzOyADjEzY5RtC49rqKCWcl+c1NvPPP3l0+9gSO+nqR+Np2Zs2cpzzvf7BLyScIteZHHljt5j4EuSQ=="
ttl=300 "drift-domain-verification=f5a2bbc86ce9fdecab7db01d6dc30ec356433bbc94c69811bf448b99fa661526"
ttl=300 "atlassian-domain-verification=/7tbKaFSdZhcOO/GdUR3mRtktoygLTnQQB/iYPocT7G/NaOQ2qqytmawjnGdINlF"
ttl=300 "atlassian-domain-verification=382cypeoFrrqy4R9MkRopItq5Cbixu5CS3S0UGcjZHHS6Rf6Lq/NICGahGifaMk5"
ttl=300 "atlassian-domain-verification=VDrpZs9FnE3/l/dJxRC+0mkjndLafqB2r3l/ztET32a5TZyDfavvWoxVWw+OeokX"
ttl=300 "atlassian-domain-verification=WJ8MzekF2peo6fDKQYCdEEjA3lSWMu4d9RzmwTIy57ZQgyvGhiYQugx88HAOgv6H"
ttl=300 "atlassian-domain-verification=gKyJvs5LHKSU2cnhoDphrlXuha6402LZ6H5FuWqZQ5XyBmqxQ29zWdguF7mxQBcj"
ttl=300 "atlassian-domain-verification=gpaZ6yD5DHLQQ/PnbDYc6mniHJSy0NQVRJpoOaOi35f1NPuZ10fglqT95dYta218"
ttl=300 "atlassian-domain-verification=hZorrHGXbuJUq3Jvcxg5W1DmpbQMDNbxaijAJjD8a9ysCLigs0sCnQfS3efeXmsr"
ttl=300 "figma-domain-verification=51041a35bcb8b65a438d169362eb0ec479cd7c25e3f5e5b1c7530f76e5bd8217-1723484428"
ttl=300 "postman-domain-verification=1f2166c59f809215f1f2302acee74f2135a8be53fced04f4e9739de6ac7af54be6894cefd27d71d81a9ebae32bf278430985e561d1ab1a216838267a847a3925"

fetched 2026-06-17T08:40:43.412Z

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

2 MX record(s) present

Why it matters: MX records direct inbound mail. Misconfiguration silently breaks email delivery and lets attackers stand up parallel MX hosts for spoofing campaigns (ISO 27001 A.8.21).

pri=10 mxa-00162b01.gslb.pphosted.com.
pri=10 mxb-00162b01.gslb.pphosted.com.

fetched 2026-06-17T08:40:43.410Z

mx

info

Open standalone →

resolving mx…

spf

medium

Open standalone →

~all softfail — receivers may still accept

Why it matters: SPF tells receiving servers which hosts may send mail for the domain. Without it, any sender can forge the envelope-from — the primary mechanism behind business-email-compromise (SOC 2 CC6.7).

Recommendations

Move to -all (hardfail) once your mail flow is confirmed — softfail gives no real protection

v=spf1 include:%{ir}.%{v}.%{d}.spf.has.pphosted.com ~all

v=spf1
include:%{ir}.%{v}.%{d}.spf.has.pphosted.com
~all

fetched 2026-06-17T08:40:43.412Z

spf

info

Open standalone →

resolving spf…

dmarc

low

Open standalone →

p=quarantine — receivers send to spam

Why it matters: DMARC binds SPF and DKIM into an enforceable policy (quarantine or reject) and surfaces spoofing attempts via aggregate reports. `p=none` or absent means spoofing succeeds silently (SOC 2 CC6.7).

Recommendations

Upgrade to p=reject once your SPF and DKIM pass rates are consistently high

v=DMARC1; p=quarantine; fo=1; rua=mailto:[email protected]; ruf=mailto:[email protected];

v=: DMARC1
p=: quarantine
fo=: 1
rua=: mailto:[email protected]
ruf=: mailto:[email protected]

fetched 2026-06-17T08:40:43.643Z

dmarc

info

Open standalone →

resolving dmarc…

dkim

low

Open standalone →

no DKIM selectors found — likely not configured

Why it matters: DKIM signs outbound mail so receivers can detect tampering. Missing selectors or rotated-away keys break DMARC alignment and let receivers downgrade trust (ISO 27001 A.8.24).

Recommendations

Enable DKIM signing in your mail provider and publish the provided TXT record
Common selectors: google._domainkey, selector1._domainkey (Microsoft), mail._domainkey

no DKIM record on probed selectors (default, google, k1, selector1, selector2, mxvault)

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

cert valid for 177 days

Why it matters: A valid current TLS certificate is the baseline for data in transit. Expiry, weak chain, or hostname mismatch break HTTPS and fail PCI 4.2.1 / SOC 2 CC6.1.

subject cn:: www.blackrock.com
issuer:: DigiCert Global G2 TLS RSA SHA256 2020 CA1 / DigiCert Inc
valid:: May 27 00:00:00 2026 GMT → Dec 11 23:59:59 2026 GMT
authorized:: yes
sha256:: 6A:EC:1F:29:8B:5B:C7:08:F3:13:BC:D0:DF:FC:9D:0C:E8:B0:E0:D5:EF:1E:53:F9:20:26:CE:6C:87:DB:82:9D
sans: www.blackrock.com
blackrock.com

fetched 2026-06-17T08:40:44.560Z

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

HTTPS served correctly

Why it matters: Bare HTTP requests must redirect to HTTPS without dropping the user mid-chain. Plain-text fallback or open redirects fail PCI 4.2.1 and feed phishing chains (SOC 2 CC6.6).

final status: 200 · 3 hops

[301] https://blackrock.com/
[301] https://www.blackrock.com/
[200] https://www.blackrock.com/corporate

fetched 2026-06-17T08:40:45.285Z

redirects

info

Open standalone →

tracing redirects…

headers

info

Open standalone →

1 security header(s) missing

Why it matters: Security headers — HSTS, CSP, X-Frame-Options, Referrer-Policy — defend against XSS, clickjacking, and downgrade attacks. Absent headers map directly to OWASP ASVS V14 findings (ISO 27001 A.8.23).

Recommendations

Add permissions-policy response header

final url: https://www.blackrock.com/corporate

security headers

strict-transport-security: max-age=31536000;preload
content-security-policy: default-src https:; font-src https: data:; img-src https: data:; base-uri 'self'; object-src 'self'; media-src https: blob:; child-src https: blob:; worker-src https: blob:; frame-ancestors 'self' https://*.blackrock.com https://*.ishares.com; style-src https: 'unsafe-inline'; script-src https: 'nonce-XLzWX+PmOBiDQ1R4vSRsrg==';
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
referrer-policy: no-referrer-when-downgrade
permissions-policy: —

other headers

cache-control: no-cache, no-store
connection: keep-alive
content-encoding: br
content-length: 14802
content-type: text/html;charset=UTF-8
date: Wed, 17 Jun 2026 08:40:45 GMT
expires: Wed, 17 Jun 2026 08:40:45 GMT
link: </blk-corp-assets/cache-1780925615000/include/common/fonts/fontawesome-5pro/fa-solid-900.woff2>; rel="preload"; as="font"; type="font/woff2"; crossorigin, </blk-corp-assets/cache-1780925615000/include/common/fonts/fontawesome-5pro/fa-regular-400.woff2>; rel="preload"; as="font"; type="font/woff2"; crossorigin, </blk-corp-assets/cache-1780925615000/include/common/fonts/fontawesome-5pro/fa-light-300.woff2>; rel="preload"; as="font"; type="font/woff2"; crossorigin, </blk-corp-assets/cache-1780925615000/include/common/fonts/blk-fort/BLKFort-Extrabold.woff2>; rel="preload"; as="font"; type="font/woff2"; crossorigin, </blk-corp-assets/cache-1780925615000/include/common/fonts/blk-fort/BLKFort-Book.woff2>; rel="preload"; as="font"; type="font/woff2"; crossorigin, </blk-corp-assets/cache-1780925615000/include/common/fonts/blk-fort/BLKFort-Bold.woff2>; rel="preload"; as="font"; type="font/woff2"; crossorigin, </blk-corp-assets/cache-1780925615000/include/common/fonts/blk-fort/BLKFortCond-Book.woff2>; rel="preload"; as="font"; type="font/woff2"; crossorigin, </blk-corp-assets/cache-1780925615000/include/common/fonts/blk-fort/BLKFortCond-BookItalic.woff2>; rel="preload"; as="font"; type="font/woff2"; crossorigin, </blk-corp-assets/cache-1780925615000/include/common/fonts/blk-fort/BLKFortCond-Bold.woff2>; rel="preload"; as="font"; type="font/woff2"; crossorigin, </blk-corp-assets/cache-1780925615000/include/common/fonts/blk-fort/BLKFortCond-BoldItalic.woff2>; rel="preload"; as="font"; type="font/woff2"; crossorigin, </blk-corp-assets/cache-1780925615000/include/common/fonts/blk-fort/BLKFortCond-Light.woff2>; rel="preload"; as="font"; type="font/woff2"; crossorigin, </blk-corp-assets/cache-1780925615000/include/common/fonts/blk-fort/BLKFortCond-LightItalic.woff2>; rel="preload"; as="font"; type="font/woff2"; crossorigin, <https://sourcedefense.blackrock.com>; rel=preconnect; crossorigin, <https://tags.tiqcdn.com>; rel=preconnect; crossorigin, <https://services.sdiapi.com>; rel=preconnect; crossorigin
server: istio-envoy
set-cookie: DC_STICKY_SESSION_COOKIE=muse2; Path=/; Max-Age=28800; HttpOnly; Secure; SameSite=None
x-cache-status: MISS
x-envoy-upstream-service-time: 16
x-host-ref: blk-corp01-live-5bc66ccdd6-lznxx/orca
x-locale: en_US
x-page-name: home
x-region-ref: muse2
x-request-id: 60788154-19ebdd779bd
x-site-name: corporate-one
x-ua-compatible: IE=edge
x-xss-protection: 1; mode=block

fetched 2026-06-17T08:40:45.513Z

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

no CORS headers — cross-origin requests blocked by default

Why it matters: Overly permissive CORS (wildcard with credentials, or reflected origin) lets any origin read authenticated responses from this domain. OWASP A05 misconfiguration territory (NIST AC-4).

origin: https://domainposture.com
method: GET
preflight status: 301

access-control-* headers

access-control-allow-origin: —
access-control-allow-methods: —
access-control-allow-headers: —
access-control-allow-credentials: —
access-control-max-age: —
access-control-expose-headers: —

no access-control-* headers returned — site does not advertise CORS to this origin

fetched 2026-06-17T08:40:44.776Z

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

HTTPS surface reachable (robots ✓, sitemap ✗, title ✓)

Why it matters: Public files — robots.txt, sitemap.xml, head meta — are what attackers see first during reconnaissance. Misadvertised paths, stale sitemaps, and verbose generators leak more than intended (ISO 27001 A.8.9).

robots.txt

present

User-agent: Brightbot 1.0
Disallow: /

User-agent: *

Disallow: /au-institutional-iframe*
Disallow: /pensions-planning-iframe*
Disallow: /capstone*

Disallow: /*.dl$

Disallow: /*sign-on.oauth
Disallow: /*sign-on.saml
Disallow: /*sign-on-popup.saml
Disallow: /user-platform/
Disallow: /userplatform/
Disallow: /search/
Disallow: /*?truepdf*
Disallow: /*?norepdf*
  
Disallow: /X/
Disallow: /compliance/
  
Disallow: /ref/docs

Disallow: /api-tester/

Disallow: /ee$
Disallow: /gr$
Disallow: /is$
Disallow: /ie$
Disallow: /lv$
Disallow: /li$
Disallow: /lt$
Disallow: /mt$
Disallow: /cy$
Disallow: /gg$
Disallow: /gi$
Disallow: /im$
Disallow: /je$
Disallow: /bg$
Disallow: /hr$
Disallow: /ro$
Disallow: /si$

Disallow: /ee/
Disallow: /gr/
Disallow: /is/
Disallow: /ie/
Disallow: /lv/
Disallow: /li/
Disallow: /lt/
Disallow: /mt/
Disallow: /cy/
Disallow: /gg/
Disallow: /gi/
Disallow: /im/
Disallow: /je/
Disallow: /bg/
Disallow: /hr/
Disallow: /ro/
Disallow: /si/

Disallow: /us/financial-professionals/*.pdf$

SITEMAP: https://www.blackrock.com/ae/sitemap.xml
SITEMAP: https://www.blackrock.com/ae/product-sitemap.xml
SITEMAP: https://www.blackrock.com/aladdin/sitemap.xml
SITEMAP: https://www.blackrock.com/americas-offshore/sitemap.xml
SITEMAP: https://www.blackrock.com/americas-offshore/product-sitemap.xml
SITEMAP: https://www.blackrock.com/at/sitemap.xml
SITEMAP: https://www.blackrock.com/at/product-sitemap.xml
SITEMAP: https://www.blackrock.com/au/sitemap.xml
SITEMAP: https://www.blackrock.com/au/product-sitemap.xml
SITEMAP: https://www.blackrock.com/be/sitemap.xml
SITEMAP: https://www.blackrock.com/be/product-sitemap.xml
SITEMAP: https://www.blackrock.com/br/sitemap.xml
SITEMAP: https://www.blackrock.com/br/product-sitemap.xml
SITEMAP: https://www.blackrock.com/ca/sitemap.xml
SITEMAP: https://www.blackrock.com/ca/product-sitemap.xml
SITEMAP: https://www.blackrock.com/cash/sitemap.xml
SITEMAP: https://www.blackrock.com/cash/product-sitemap.xml
SITEMAP: https://www.blackrock.com/ch/sitemap.xml
SITEMAP: https://www.blackrock.com/ch/product-sitemap.xml
SITEMAP: https://www.blackrock.com/cl/sitemap.xml
SITEMAP: https://www.blackrock.com/cl/product-sitemap.xml
SITEMAP: https://www.blackrock.com/cn/sitemap.xml
SITEMAP: https://www.blackrock.com/cn/product-sitemap.xml
SITEMAP: https://www.blackrock.com/co/sitemap.xml
SITEMAP: https://www.blackrock.com/co/product-sitemap.xml
SITEMAP: https://www.blackrock.com/corporate/sitemap.xml
SITEMAP: https://www.blackrock.com/cz/sitemap.xml
SITEMAP: https://www.blackrock.com/cz/product-sitemap.xml
SITEMAP: https://www.blackrock.com/de/sitemap.xml
SITEMAP: https://www.blackrock.com/de/product-sitemap.xml
SITEMAP: https://www.blackrock.com/dk/sitemap.xml
SITEMAP: https://www.blackrock.com/dk/product-sitemap.xml
SITEMAP: https://www.blackrock.com/es/sitemap.xml
SITEMAP: https://www.blackrock.com/es/product-sitemap.xml
SITEMAP: https://www.blackrock.com/fi/sitemap.xml
SITEMAP: https://www.blackrock.com/fi/product-sitemap.xml
SITEMAP: https://www.blackrock.com/financial-markets-advisory/sitemap.xml
SITEMAP: https://www.blackrock.com/fr/sitemap.xml
SITEMAP: https://www.blackrock.com/fr/product-sitemap.xml
SITEMAP: https://www.blackrock.com/hk/sitemap.xml
SITEMAP: https://www.blackrock.com/hk/product-sitemap.xml
SITEMAP: https://www.blackrock.com/hu/sitemap.xml
SITEMAP: https://www.blackrock.com/hu/product-sitemap.xml
SITEMAP: https://www.blackrock.com/il/sitemap.xml
SITEMAP: https://www.blackrock.com/il/product-sitemap.xml
SITEMAP: https://www.blackrock.com/institutions/sitemap.xml
SITEMAP: https://www.blackrock.com/it/sitemap.xml
SITEMAP: https://www.blackrock.com/it/product-sitemap.xml
SITEMAP: https://www.blackrock.com/jp/sitemap.xml
SITEMAP: https://www.blackrock.com/jp/product-sitemap.xml
SITEMAP: https://www.blackrock.com/kiid/sitemap.xml
SITEMAP: https://www.blackrock.com/kr/sitemap.xml
SITEMAP: https://www.blackrock.com/lu/sitemap.xml
SITEMAP: https://www.blackrock.com/lu/product-sitemap.xml
SITEMAP: https://www.blackrock.com/mx/sitemap.xml
SITEMAP: https://www.blackrock.com/mx/product-sitemap.xml
SITEM

sitemap.xml

absent

head

title: BlackRock Corporate Website | BlackRock
description: BlackRock invests on behalf of our clients, from institutions to individuals in any stage of life, who entrust their savings to us. Learn more about us.

social

og:title: BlackRock Corporate Website | BlackRock
og:type: website
og:image: /blk-corp-assets/include/common/images/blackrock_logo.png
og:site_name: BlackRock
og:locale: en_US
og:url: https://www.blackrock.com/corporate

fetched 2026-06-17T08:40:45.677Z

web-surface

info

Open standalone →

inspecting web surface…

dnssec

info

Open standalone →

DNSSEC enabled — DS records present and chain validated (AD flag)

Why it matters: DNSSEC cryptographically signs DNS responses, blocking cache-poisoning attacks. US federal civilian agencies are required to enable it under OMB M-22-09 (NIST SC-20).

enabled: yes
DS records: 37972 ECDSAP256SHA256 2 1f2e19011a494d7a85f9889f4a0a1a09200af15a96bc727a1e917f83a525d4b9, DS ECDSAP256SHA256 2 86400 1782174435 1781565435 27677 com. iPYLj5PBf+JRD8ve6lLKkSFh7aYMlNXGFPZD8KWhzrvYqZw32DlT78rtJ/iQPCRvphpmr4DMWIGcdO8UV+SEyg==
DNSKEY records: 6 key(s)

fetched 2026-06-17T08:40:43.413Z

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

not applicable: no _mta-sts TXT record

Why it matters: MTA-STS forces inbound SMTP to use TLS and refuse downgraded connections. Without it, an in-path attacker can strip TLS and read mail in plaintext (SOC 2 CC6.7).

no _mta-sts TXT record

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

not applicable: no TLSRPT record

Why it matters: TLS-RPT publishes a reporting address for SMTP-TLS failures. Without it, downgrade attacks on inbound mail go unnoticed (SOC 2 CC7.2).

no TLSRPT record

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

domain registered until 2026-11-25

Why it matters: Registrar and expiry tell auditors the domain is owned, current, and not about to lapse. An expired or about-to-expire domain fails business-continuity evidence (SOC 2 A1.2).

registrar: CSC Corporate Domains, Inc.
created: 1997-11-26T05:00:00Z
expires: 2026-11-25T05:00:00Z
statuses: clientTransferProhibited https://icann.org/epp#clientTransferProhibited, serverDeleteProhibited https://icann.org/epp#serverDeleteProhibited, serverTransferProhibited https://icann.org/epp#serverTransferProhibited, serverUpdateProhibited https://icann.org/epp#serverUpdateProhibited

fetched 2026-06-17T08:40:46.007Z

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

check failed: crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

Why it matters: Every certificate issued for this domain is published in Certificate Transparency logs — including subdomains you may have forgotten. Unknown subdomains in CT are pre-disclosed attack surface (ISO 27001 A.8.16).

crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.