braintreepayments.com

15-check dossier · scoreboard above, section details below

Get a pack →

Scanning…

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

resolving mx…

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

resolving dmarc…

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

tracing redirects…

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

inspecting web surface…

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.

braintreepayments.com

15-check dossier · scoreboard above, section details below

Get a pack →

Mostly compliant · 2 items need attention

Aggregate grade across 15 checks. Auditors typically flag any High-severity finding.

Pass: 13
Warn: 2
Fail: 0

What an auditor would flag first

medium
Redirect chain
redirects to different domain: paypal.com
SOC 2 CC6.6
low
DKIM
1/6 DKIM selectors valid
SOC 2 CC6.7

Need this as an artifact your auditor can verify?

Your braintreepayments.com scan flagged 1 medium and 1 low findings. A signed pack covers the apex plus up to 100 CT-discovered subdomains, Ed25519-signed and ISO-timestamped, delivered in 10–30 minutes.

Get a pack →See methodology See a sample$29

Scanning…

15-check summary

DNS recordsA/AAAA records present
MX2 MX record(s) present
SPF-all hardfail — strict policy
DMARCp=reject — strict policy
DKIM1/6 DKIM selectors valid
TLS certificatecert valid for 134 days
Redirect chainredirects to different domain: paypal.com
Security headers1 security header(s) missing
CORSno CORS headers — cross-origin requests blocked by default
Web surfaceHTTPS surface reachable (robots ✓, sitemap ✓, title ✓)
MTA-STSnot applicable: no _mta-sts TXT record
TLS-RPTnot applicable: no TLSRPT record
DNSSECDNSSEC enabled — DS records present and chain validated (AD flag)
WHOISdomain registered until 2027-04-18
Certificate Transparencycheck failed: crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

dns

info

Open standalone →

A/AAAA records present

Why it matters: Without authoritative A or AAAA records on the apex, the domain is unreachable. Missing baseline DNS shows up in vendor reviews as evidence of unmanaged infrastructure (SOC 2 CC6.6).

A: ttl=300 151.101.3.1
ttl=300 151.101.67.1
AAAA: —
NS: ttl=300 pdns100.ultradns.com.
ttl=300 pdns100.ultradns.net.
ttl=300 ns1-pchnet.paypal.com.
ttl=300 ns2-pchnet.paypal.com.
SOA: ttl=300 ppdns.paypal.com. hostmaster.paypal.com. 2022087521 7200 600 1209600 300
CAA: —
TXT: ttl=3600 "MS=ms64840644"
ttl=3600 "fastly-domain-delegation-bBfUz4scMNZbQnTXJMcE-20210104"
ttl=3600 "atlassian-domain-verification=Q8BdHlO6NYSN5njfC2rlbPQxksVfADlcxarxq4fesYJErtGKylvfcfyfwrPD/wnv"
ttl=3600 "v=spf1 ip4:74.112.67.243 ip4:159.242.240.113 ip4:159.242.240.114 ip4:159.242.241.113 ip4:159.242.241.114 ip4:198.2.128.0/24 ip4:198.2.132.0/22 ip4:198.2.136.0/23 ip4:198.2.145.0/24 ip4:198.2.186.0/23 ip4:205.201.131.128/25 " "ip4:205.201.134.128/25 ip4:205.201.136.0/23 ip4:205.201.139.0/24 ip4:198.2.177.0/24 ip4:198.2.178.0/23 ip4:198.2.180.0/24 include:_spf.google.com include:mail.zendesk.com include:sendgrid.net include:_spf.salesforce.com -all"

fetched 2026-06-04T04:45:39.330Z

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

2 MX record(s) present

Why it matters: MX records direct inbound mail. Misconfiguration silently breaks email delivery and lets attackers stand up parallel MX hosts for spoofing campaigns (ISO 27001 A.8.21).

pri=1 mx1.paypalcorp.com.
pri=1 mx2.paypalcorp.com.

fetched 2026-06-04T04:45:39.329Z

mx

info

Open standalone →

resolving mx…

spf

info

Open standalone →

-all hardfail — strict policy

Why it matters: SPF tells receiving servers which hosts may send mail for the domain. Without it, any sender can forge the envelope-from — the primary mechanism behind business-email-compromise (SOC 2 CC6.7).

v=spf1 ip4:74.112.67.243 ip4:159.242.240.113 ip4:159.242.240.114 ip4:159.242.241.113 ip4:159.242.241.114 ip4:198.2.128.0/24 ip4:198.2.132.0/22 ip4:198.2.136.0/23 ip4:198.2.145.0/24 ip4:198.2.186.0/23 ip4:205.201.131.128/25 ip4:205.201.134.128/25 ip4:205.201.136.0/23 ip4:205.201.139.0/24 ip4:198.2.177.0/24 ip4:198.2.178.0/23 ip4:198.2.180.0/24 include:_spf.google.com include:mail.zendesk.com include:sendgrid.net include:_spf.salesforce.com -all

v=spf1
ip4:74.112.67.243
ip4:159.242.240.113
ip4:159.242.240.114
ip4:159.242.241.113
ip4:159.242.241.114
ip4:198.2.128.0/24
ip4:198.2.132.0/22
ip4:198.2.136.0/23
ip4:198.2.145.0/24
ip4:198.2.186.0/23
ip4:205.201.131.128/25
ip4:205.201.134.128/25
ip4:205.201.136.0/23
ip4:205.201.139.0/24
ip4:198.2.177.0/24
ip4:198.2.178.0/23
ip4:198.2.180.0/24
include:_spf.google.com
include:mail.zendesk.com
include:sendgrid.net
include:_spf.salesforce.com
-all

fetched 2026-06-04T04:45:39.330Z

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

p=reject — strict policy

Why it matters: DMARC binds SPF and DKIM into an enforceable policy (quarantine or reject) and surfaces spoofing attempts via aggregate reports. `p=none` or absent means spoofing succeeds silently (SOC 2 CC6.7).

v=DMARC1; p=reject; rua=mailto:d@rua.agari.com; ruf=mailto:d@ruf.agari.com

v=: DMARC1
p=: reject
rua=: mailto:d@rua.agari.com
ruf=: mailto:d@ruf.agari.com

fetched 2026-06-04T04:45:39.329Z

dmarc

info

Open standalone →

resolving dmarc…

dkim

low

Open standalone →

1/6 DKIM selectors valid

Why it matters: DKIM signs outbound mail so receivers can detect tampering. Missing selectors or rotated-away keys break DMARC alignment and let receivers downgrade trust (ISO 27001 A.8.24).

Recommendations

Check the missing selectors in your DNS provider and re-add any removed records

default:: —
google:: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAoL+UPBRMRHUlMSygNVeb72e4QIQUPE/Yq81FeUCSXM6M+kOanvKyuMX8m4mEt3sCLqZnCSOOtt0nKXhWZ7YB0wGeR8NupNMlqtPtYtMQ5tx/NdNO++J52/Lv2jtvG8R1Fio36ECOX65z2U0eH36Zj6GJThVZ5vsKA+GzJMeX7sJBdFUo6O33RFUjIh7EqpWVJ188b+a4vPW1pC9bkq3YQImQJmpX5tmPABAf4ly+i/Z9++U96n32IQgk7FLNA6BfbHu+50rD19fSix9AVDwaE68NhsyZ/sDffm6b1HyOd9oW99zYxm1x1ugGmUW5xNGRs3ZkX3bC69Q89DVvRj/uqwIDAQAB
k1:: —
selector1:: —
selector2:: —
mxvault:: —

fetched 2026-06-04T04:45:39.450Z

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

cert valid for 134 days

Why it matters: A valid current TLS certificate is the baseline for data in transit. Expiry, weak chain, or hostname mismatch break HTTPS and fail PCI 4.2.1 / SOC 2 CC6.1.

subject cn:: www.paypal.com
issuer:: DigiCert EV RSA CA G2 / DigiCert Inc
valid:: Apr 1 00:00:00 2026 GMT → Oct 16 23:59:59 2026 GMT
authorized:: yes
sha256:: 7F:40:B0:F5:9D:88:F9:2E:CD:35:1A:57:81:B0:C0:87:CE:61:4B:93:8B:C6:84:EA:4A:29:C1:33:94:FB:81:66
sans: www.paypal.com
articles.braintreepayments.com
assets.braintreegateway.com
braintreecharge.com
braintreefinancial.com
braintreepayments.com
braintreepaymentsolutions.com
brand.braintreepayments.com
business.paypal.com
c.paypal.com
c6.paypal.com
checkout.paypal.com
connect.paypal.com
content.paypalobjects.com
cors.api.paypal.com
creditapply.paypal.com
de.paypal-qrc.com
demo.paypal.com
developer.braintreepayments.com
developer.paypal.com
developers.braintreepayments.com
docs.paypal.ai
es.paypal-qrc.com
fastlane.paypal.com
financing.paypal.com
fpdbs.paypal.com
fr.paypal-qrc.com
help.braintreepayments.com
history.paypal.com
id.braintreegateway.com
id.hyperwallet.com
id.joinhoney.com
id.paypal.com
id.venmo.com
id.xoom.com
id.zettle.com
id6.venmo.com
it.paypal-qrc.com
js.braintreegateway.com
login.paypal.com
m.paypal.co.uk
m.paypal.com
m.paypal.com.au
m.paypal.es
m.paypal.fr
m.paypal.it
mobile.paypal.com
now.id.venmo.com
now.venmo.com
onboarding.paypal.com
p.paypal.com
paypal.me
pep.paypal.com
pics.paypal.com
pointofsale-s.paypal.com
pp-au.paypal.com
pp-eu.paypal.com
pp-in.paypal.com
pp-us.paypal.com
py.pl
qwac.paypal.com
safebreach.paypal.com
secure.paypal.com
securepayments.paypal.com
ssp.paypal.com
sspserv.paypal.com
support.braintreepayments.com
t.paypal.com
transfer.paypal.com
uk.paypal-qrc.com
us.paypal-qrc-seller-supplies.com
us.paypal-qrc.com
www-st.paypal.com
www.braintreecharge.com
www.braintreefinancial.com
www.braintreepayments.com
www.braintreepaymentsolutions.com
www.brand.braintreepayments.com
www.fastlane.paypal.com
www.paypal-gifts.com
www.paypal.ai
www.paypal.biz
www.paypal.me
www.paypalobjects.com
www.py.pl
www.xo.paypal.com
zettleintegrations.paypal.com

fetched 2026-06-04T04:45:39.369Z

tls

info

Open standalone →

fetching tls cert…

redirects

medium

Open standalone →

redirects to different domain: paypal.com

Why it matters: Bare HTTP requests must redirect to HTTPS without dropping the user mid-chain. Plain-text fallback or open redirects fail PCI 4.2.1 and feed phishing chains (SOC 2 CC6.6).

Recommendations

Verify this cross-domain redirect is intentional (e.g. domain migration or CDN)
Ensure the destination domain is owned and expected — unintended redirects can leak traffic

final status: 200 · 3 hops

[301] https://braintreepayments.com/
[301] https://www.braintreepayments.com/
[200] https://www.paypal.com/us/braintree?utm_campaign=Braintree_Migration&utm_medium=Website&utm_source=Braintree

fetched 2026-06-04T04:45:40.088Z

redirects

info

Open standalone →

tracing redirects…

headers

info

Open standalone →

1 security header(s) missing

Why it matters: Security headers — HSTS, CSP, X-Frame-Options, Referrer-Policy — defend against XSS, clickjacking, and downgrade attacks. Absent headers map directly to OWASP ASVS V14 findings (ISO 27001 A.8.23).

Recommendations

Add response header — Referrer-Policy: strict-origin-when-cross-origin

final url: https://www.paypal.com/us/braintree?utm_campaign=Braintree_Migration&utm_medium=Website&utm_source=Braintree

security headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
content-security-policy: default-src 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline'; style-src 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline'; script-src 'nonce-/LrjZDHz2QT6EAFOycPqQRyPfgjWz78f5bW4Ak1h5YpEnDQp' 'self' 'unsafe-inline' https://*.paypal.com https://*.paypalobjects.com https://ad.doubleclick.net https://ade.googlesyndication.com https://adservice.google.com https://googleads.g.doubleclick.net https://googletagmanager.com https://pagead2.googlesyndication.com https://pypd.paypal-mktg.com https://tagmanager.google.com https://www.google.com https://www.googleadservices.com https://www.googletagmanager.com; img-src 'self' https: data: https://region1.analytics.google.com https://region1.google-analytics.com https://www.analytics.google.com https://www.google-analytics.com; object-src 'none'; font-src 'self' https://*.paypal.com https://*.paypalobjects.com; frame-src 'self' https://*.company-target.com https://*.paypal.com https://*.paypalobjects.com https://www.googletagmanager.com https://www.youtube-nocookie.com https://*.qualtrics.com; frame-ancestors 'self' https://*.paypal.com; connect-src 'self' 'unsafe-inline' https://*.adsrvr.org https://*.company-target.com https://*.demandbase.com https://*.paypal.com https://*.paypalobjects.com https://ad.doubleclick.net https://adservice.google.com https://browser-intake-us5-datadoghq.com https://google.com https://googleads.g.doubleclick.net https://pagead2.googlesyndication.com https://prod.uidapi.com https://region1.analytics.google.com https://region1.google-analytics.com https://www.analytics.google.com https://www.google-analytics.com https://www.google.com https://www.googleadservices.com https://www.googletagmanager.com www.google.com www.googletagmanager.com https://*.qualtrics.com; form-action 'self' https://*.paypal.com; base-uri 'self' https://*.paypal.com; upgrade-insecure-requests;; report-uri https://www.paypal.com/csplog/api/log/csp
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
referrer-policy: —
permissions-policy: ch-ua-platform-version=(self "https://c.paypal.com"),ch-ua-arch=(self "https://c.paypal.com"),ch-ua-wow64=(self "https://c.paypal.com"),ch-ua-model=(self "https://c.paypal.com"),ch-ua-bitness=(self "https://c.paypal.com"),ch-ua-full-version=(self "https://c.paypal.com"),ch-ua-full-version-list=(self "https://c.paypal.com")

other headers

accept-ch: sec-ch-ua-full, sec-ch-ua-arch, sec-ch-ua-model, sec-ch-ua-platform-version, sec-ch-ua-full-version, sec-ch-ua-full-version-list, sec-ch-ua-bitness, sec-ch-ua-wow64
accept-ranges: bytes
access-control-expose-headers: Server-Timing
cache-control: max-age=0, no-cache, no-store, must-revalidate
connection: keep-alive
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Thu, 04 Jun 2026 04:45:40 GMT
dc: ccg11-origin-www-1.paypal.com
origin-trial: AmF3SS0NWoXo3HaojgmIVVXavukRnZH597u+xZNXRCiKWzSKzfNPHw9NC32GmblY12+HXpkCEYeYGyvRBNkkJg0AAABbeyJvcmlnaW4iOiJodHRwczovL3BheXBhbC5jb206NDQzIiwiZmVhdHVyZSI6IlRwY2QiLCJleHBpcnkiOjE3MzUzNDM5OTksImlzU3ViZG9tYWluIjp0cnVlfQ==
paypal-debug-id: f887761e21f6b
server-timing: traceparent;desc="00-0000000000000000000f887761e21f6b-534f8730452e2da3-01",content-encoding;desc="gzip",x-cdn;desc="fastly"
set-cookie: ts_c=vr%3D90f3882f19e647e1b0a55cc0faa5a474%26vt%3D90f3882f19e647e1b0a55cc0faa5a473; Path=/; Domain=paypal.com; Expires=Fri, 04 Jun 2027 04:45:40 GMT; Secure
transfer-encoding: chunked
vary: Accept-Encoding
via: 1.1 varnish, 1.1 varnish
x-cache: MISS, MISS, MISS
x-cache-hits: 0, 0, 0

fetched 2026-06-04T04:45:40.091Z

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

no CORS headers — cross-origin requests blocked by default

Why it matters: Overly permissive CORS (wildcard with credentials, or reflected origin) lets any origin read authenticated responses from this domain. OWASP A05 misconfiguration territory (NIST AC-4).

origin: https://domainposture.com
method: GET
preflight status: 301

access-control-* headers

access-control-allow-origin: —
access-control-allow-methods: —
access-control-allow-headers: —
access-control-allow-credentials: —
access-control-max-age: —
access-control-expose-headers: —

no access-control-* headers returned — site does not advertise CORS to this origin

fetched 2026-06-04T04:45:39.453Z

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

HTTPS surface reachable (robots ✓, sitemap ✓, title ✓)

Why it matters: Public files — robots.txt, sitemap.xml, head meta — are what attackers see first during reconnaissance. Misadvertised paths, stale sitemaps, and verbose generators leak more than intended (ISO 27001 A.8.9).

robots.txt

present

 <!DOCTYPE html>
  <html lang="en-US" dir="ltr">
  <head><script async src="https://www.paypalobjects.com/webcaptcha/ngrlCaptcha.min.js"></script>
    <meta charset="utf-8">
    <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
    <meta name="theme-color" content="#012169">
     <title>Braintree | Enterprise Payment Solution | PayPal US</title>
<link rel="preconnect" href="https://www.gstatic.com" crossorigin>
<link rel="preconnect" href="https://www.paypalobjects.com" crossorigin>
<link nonce="Jr4jnezrQGyUpkT3iGnBxv4vrgO/iujJn/PDcgc6v+p6zIH4" rel="stylesheet" fetchpriority="high" href="https://www.paypalobjects.com/marketing/pp-com-components/themes/quantumLeapSupreme-Dbhg5InX.css">
<link nonce="Jr4jnezrQGyUpkT3iGnBxv4vrgO/iujJn/PDcgc6v+p6zIH4" rel="stylesheet" fetchpriority="high" href="https://www.paypalobjects.com/marketing/pp-com-components/component-chunks/helpers-b84a3429.css">
<link nonce="Jr4jnezrQGyUpkT3iGnBxv4vrgO/iujJn/PDcgc6v+p6zIH4" rel="stylesheet" fetchpriority="high" href="https://www.paypalobjects.com/marketing/pp-com-components/component-chunks/NavButton-c0581edf.css">
<link nonce="Jr4jnezrQGyUpkT3iGnBxv4vrgO/iujJn/PDcgc6v+p6zIH4" rel="stylesheet" fetchpriority="high" href="https://www.paypalobjects.com/marketing/pp-com-components/component-chunks/SubNav-645d647b.css">
<style nonce="Jr4jnezrQGyUpkT3iGnBxv4vrgO/iujJn/PDcgc6v+p6zIH4">.qr-code-image-container{overflow:hidden;display:inline-block}.qr-code-appearance-default{background-color:#fff}.qr-code-appearance-inverse{background-color:#000}.qr-code.qr-code-large .qr-code-image-container{padding:.5rem .5rem .25rem;box-shadow:.25rem .25rem 1.75rem .375rem #00000024;border-radius:.5rem}.qr-code.qr-code-large .qr-code-image-container svg{border-radius:.5rem}.qr-code.qr-code-x-large .qr-code-image-container{padding:.75rem .75rem .5rem;box-shadow:.25rem .25rem 1.75rem .375rem #00000024;border-radius:.75rem}.qr-code.qr-code-small .qr-code-image-container{padding:.25rem}.qr-code-show{display:block}.qr-code-hide{display:none!important}.qr-code-fallback-small{width:5.375rem;height:5.375rem}.qr-code-fallback-small img,.qr-code-fallback-large img,.qr-code-fallback-x-large img{width:100%}
</style>
<style nonce="Jr4jnezrQGyUpkT3iGnBxv4vrgO/iujJn/PDcgc6v+p6zIH4">.app-download-group .app-download-group-row{display:none}.app-download-group .app-download-group-row-mobile{display:flex}@media (max-width: 47rem){.app-download-group .app-download-group-row-mobile.app-download-group-row-mobile-full-width{display:block}}.app-download-group .app-download-group-row-no-cta-mobile{display:flex}.app-download-group .app-download-group-row-align-center{justify-content:center;text-align:center}.app-download-group .app-download-group-row-align-end{justify-content:flex-end}.app-download-group .app-download-group-disclaimer{font-size:.875rem;line-height:1.375rem;margin-top:1.5rem;max-width:21.25rem;margin-bottom:0;padding-top:0}.app-download-group .app-download-group-disclaimer>*:first-child{margin-bottom:0;padding-top:0}.app-download-group .app-download-group-cta-sms-loading{opacity:.7;pointer-events:none}.app-download-group .app-download-group-col{flex:1}.app-download-group .app-download-group-text{margin-bottom:1.5rem}.app-download-group .app-download-group-image-col,.app-download-group .app-download-group-image-container{display:none}.app-download-group .app-download-group-phone-input-row{width:100%}.app-download-group .app-download-group-phone-input-wrapper{width:100%;max-width:24.25rem}.app-download-group .app-download-group-phone-input{display:flex;align-items:center;flex-direction:column;width:100%}.app-download-group .app-download-group-phone-input>input,.app-download-group .app-download-group-phone-input label{max-width:24.25rem}.app-download-group .app-download-group-phone-input div[id^=message_text-input]{color:var(--style-general-text)}.app-download-group .app-download-group-cta-desktop-container{margin-top:1rem;min-width:9.25rem}.app-download-group .app-download-group-success-msg-container{background-color:#0f8514;border-radius:.75rem

sitemap.xml

present — 0 url(s)

head

title: Braintree | Enterprise Payment Solution | PayPal US
description: Explore PayPal Braintree and how our end-to-end payment platform can help drive growth. Learn more about PayPal Braintree on the PayPal website.

social

og:type: website
og:url: https://www.paypal.com/us/braintree
og:title: Braintree | Enterprise Payment Solution | PayPal US
og:image: https://www.paypalobjects.com/marketing/web23/us/braintree/handshake/meta-image-size-all.jpg
og:description: Explore PayPal Braintree and how our end-to-end payment platform can help drive growth. Learn more about PayPal Braintree on the PayPal website.
twitter:card: summary
twitter:site: @paypal
twitter:title: Braintree | Enterprise Payment Solution | PayPal US
twitter:image: https://www.paypalobjects.com/marketing/web23/us/braintree/handshake/meta-image-size-all.jpg
twitter:description: Explore PayPal Braintree and how our end-to-end payment platform can help drive growth. Learn more about PayPal Braintree on the PayPal website.

fetched 2026-06-04T04:45:40.122Z

web-surface

info

Open standalone →

inspecting web surface…

dnssec

info

Open standalone →

DNSSEC enabled — DS records present and chain validated (AD flag)

Why it matters: DNSSEC cryptographically signs DNS responses, blocking cache-poisoning attacks. US federal civilian agencies are required to enable it under OMB M-22-09 (NIST SC-20).

enabled: yes
DS records: 28062 ECDSAP256SHA256 2 81a039db8a3a00cd406dea3e683524e3bb6b8ba26b6914c4e0ca33c773de6055, 37906 ECDSAP256SHA256 2 20f760c6944b049817d1a93c1a266d868157bfafef90173397df7b59f6bf1ca0, DS ECDSAP256SHA256 2 86400 1780878685 1780269685 27677 com. tsmG5PDUZDK/sz3Evmd0dXX/siqiIIXaF3O5iWKuoaZkT0gvuurbDDRczLkVguT3lPsK/uKso4jTxZvZVVt0/w==
DNSKEY records: 5 key(s)

fetched 2026-06-04T04:45:39.456Z

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

not applicable: no _mta-sts TXT record

Why it matters: MTA-STS forces inbound SMTP to use TLS and refuse downgraded connections. Without it, an in-path attacker can strip TLS and read mail in plaintext (SOC 2 CC6.7).

no _mta-sts TXT record

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

not applicable: no TLSRPT record

Why it matters: TLS-RPT publishes a reporting address for SMTP-TLS failures. Without it, downgrade attacks on inbound mail go unnoticed (SOC 2 CC7.2).

no TLSRPT record

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

domain registered until 2027-04-18

Why it matters: Registrar and expiry tell auditors the domain is owned, current, and not about to lapse. An expired or about-to-expire domain fails business-continuity evidence (SOC 2 A1.2).

registrar: MarkMonitor Inc.
created: 2011-04-18T23:32:38Z
expires: 2027-04-18T23:32:38Z
statuses: clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited, clientTransferProhibited https://icann.org/epp#clientTransferProhibited, clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited

fetched 2026-06-04T04:45:39.838Z

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

check failed: crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

Why it matters: Every certificate issued for this domain is published in Certificate Transparency logs — including subdomains you may have forgotten. Unknown subdomains in CT are pre-disclosed attack surface (ISO 27001 A.8.16).

crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.