cdc.gov

15-check dossier · scoreboard above, section details below

Get a pack →

Scanning…

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

resolving mx…

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

resolving dmarc…

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

tracing redirects…

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

inspecting web surface…

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.

cdc.gov

15-check dossier · scoreboard above, section details below

Get a pack →

A-

Audit-ready · 4 minor advisories

Aggregate grade across 15 checks. Auditors typically flag any High-severity finding.

Pass: 11
Warn: 4
Fail: 0

What an auditor would flag first

low
DKIM
2/6 DKIM selectors valid
SOC 2 CC6.7
low
Security headers
5 security header(s) missing
SOC 2 CC6.6ISO 27001 A.14.1.2
low
CORS
CORS allows all origins (wildcard)
SOC 2 CC6.1

Need this as an artifact your auditor can verify?

Your cdc.gov scan flagged 4 low findings. A signed pack covers the apex plus up to 100 CT-discovered subdomains, Ed25519-signed and ISO-timestamped, delivered in 10–30 minutes.

Get a pack →See methodology See a sample$29

Scanning…

15-check summary

DNS recordsA/AAAA records present
MX4 MX record(s) present
SPF-all hardfail — strict policy
DMARCp=reject — strict policy
DKIM2/6 DKIM selectors valid
TLS certificatecert valid for 149 days
Redirect chainHTTPS served correctly
Security headers5 security header(s) missing
CORSCORS allows all origins (wildcard)
Web surfaceHTTPS surface reachable (robots ✓, sitemap ✗, title ✓)
MTA-STSnot applicable: no _mta-sts TXT record
TLS-RPTnot applicable: no TLSRPT record
DNSSECDNSSEC enabled — DS records present and chain validated (AD flag)
WHOISdomain expires in 78 days — renew soon
Certificate Transparencycheck failed: crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

dns

info

Open standalone →

A/AAAA records present

Why it matters: Without authoritative A or AAAA records on the apex, the domain is unreachable. Missing baseline DNS shows up in vendor reviews as evidence of unmanaged infrastructure (SOC 2 CC6.6).

A: ttl=22 23.73.207.173
AAAA: ttl=20 2600:1408:c400:11::17cd:6b44
ttl=20 2600:1408:c400:11::17cd:6b56
NS: ttl=252 a28-65.akam.net.
ttl=252 a2-64.akam.net.
ttl=252 a8-67.akam.net.
ttl=252 a9-64.akam.net.
ttl=252 a1-43.akam.net.
ttl=252 a5-66.akam.net.
SOA: ttl=3469 a1-43.akam.net. hostmaster.cdc.gov. 746129409 10800 3600 604800 3600
CAA: —
TXT: ttl=619 "MS=ms84056562"
ttl=619 "_bthbaxy8p6mr5c0o5r7pit3d25lgztb"
ttl=619 "_ddb344bjip99et71u5cidtx1t53ezdl"
ttl=619 "_mhpeli9n9zj3rasw6wfiuch30t2sjlw"
ttl=619 "_v0e31vq52ru6qgumyh95pylxoe5kmby"
ttl=619 "ZOOM_verify_yEK5MgTwT72nP5URz-eoaA"
ttl=619 "4FF7-1931-E8C2-912B-94CF-BCB0-806A-7442"
ttl=619 "apple-domain-verification=VOKePKhT9MhX9zmq"
ttl=619 "google-gws-recovery-domain-verification=42225222"
ttl=619 "amazonses:OhxI8Nxovqf1xBmhK5S9kNk7vo9XV4GmGe6LVc+ji80="
ttl=619 "openai-domain-verification=dv-hbgCCuVm9CpZSVXjvFPfivD5"
ttl=619 "geneious.com:domain-verification=DP8tae0qCr-FH6KGRvMwWA"
ttl=619 "identrust_validate=B/Pm/IvNx8tLDDFRsJXBs+oweQGmx08QZ6xK0IvBQn3R"
ttl=619 "268BC041572123F15C5566E5F3D88675FABCC028427B501AE228CA9BB31630D5"
ttl=619 "dtm-domain-verification=KQ1rIgUP8GpiV9mSmysS40YKtHjVrI0VF938cuCAWXQ"
ttl=619 "google-site-verification=GkbnFA_aF3RXaZOC3deEsrGqs0fmTXyys2hbIn1nVcM"
ttl=619 "google-site-verification=nZIK8Rc0sw4MxlgnsYseSBTdcyDXeLFR6P5FIAbgSEM"
ttl=619 "google-site-verification=qZbBdujV5kZQv_pCqV2wpfSU25odH35HQukm5ACyLNs"
ttl=619 "atlassian-sending-domain-verification=977cbfcd-c314-42dc-9d86-32e2abca00ac"
ttl=619 "atlassian-sending-domain-verification=f2ef9649-6a78-47f6-9990-44a295ae5b5a"
ttl=619 "v4ixju/hXVFXszYswwinkbStpHoDb361lQekI6rkjQ2DV4HHKdN/FJPvMAO88x1rTaRwf29UYwPAq6LqldNWZQ=="
ttl=619 "adobe-idp-site-verification=4089552e88740d878b0400d184ab01c0b7391e6dc85796732000450e3476fc93"
ttl=619 "atlassian-domain-verification=qjHCJ33pyZHmggxdcFDtGiegrc/iLSyVUIG0LAu1g7XW1JnMdaY8G8pbMUY1Z4hm"
ttl=619 "v=spf1 ip4:51.5.72.0/24 ip4:172.81.81.38 ip4:51.4.72.0/24 ip4:51.5.80.0/27 ip4:51.4.80.0/27 ip4:172.81.81.50 ip4:172.81.82.50 ip4:63.123.152.4 ip4:40.92.0.0/15 ip4:172.81.82.79 ip4:172.81.80.64 ip4:172.81.81.39 ip4:172.81.82.87 ip4:172.81.82.88 ip4:155.95" ".96.50 ip4:155.95.86.50 ip4:23.90.98.102 ip4:124.17.27.36 ip4:149.72.0.0/16 ip4:198.21.0.0/21 ip4:50.31.32.0/19 ip4:167.89.0.0/17 ip4:68.232.140.57 ip4:68.232.140.79 include:_s0.cdc.gov -all"

fetched 2026-06-04T01:29:23.337Z

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

4 MX record(s) present

Why it matters: MX records direct inbound mail. Misconfiguration silently breaks email delivery and lets attackers stand up parallel MX hosts for spoofing campaigns (ISO 27001 A.8.21).

pri=10 primary.us.etp.fireeyegov.com.
pri=20 alt1.us.etp.fireeyegov.com.
pri=30 alt2.us.etp.fireeyegov.com.
pri=40 alt3.us.etp.fireeyegov.com.

fetched 2026-06-04T01:29:23.168Z

mx

info

Open standalone →

resolving mx…

spf

info

Open standalone →

-all hardfail — strict policy

Why it matters: SPF tells receiving servers which hosts may send mail for the domain. Without it, any sender can forge the envelope-from — the primary mechanism behind business-email-compromise (SOC 2 CC6.7).

v=spf1 ip4:51.5.72.0/24 ip4:172.81.81.38 ip4:51.4.72.0/24 ip4:51.5.80.0/27 ip4:51.4.80.0/27 ip4:172.81.81.50 ip4:172.81.82.50 ip4:63.123.152.4 ip4:40.92.0.0/15 ip4:172.81.82.79 ip4:172.81.80.64 ip4:172.81.81.39 ip4:172.81.82.87 ip4:172.81.82.88 ip4:155.95.96.50 ip4:155.95.86.50 ip4:23.90.98.102 ip4:124.17.27.36 ip4:149.72.0.0/16 ip4:198.21.0.0/21 ip4:50.31.32.0/19 ip4:167.89.0.0/17 ip4:68.232.140.57 ip4:68.232.140.79 include:_s0.cdc.gov -all

v=spf1
ip4:51.5.72.0/24
ip4:172.81.81.38
ip4:51.4.72.0/24
ip4:51.5.80.0/27
ip4:51.4.80.0/27
ip4:172.81.81.50
ip4:172.81.82.50
ip4:63.123.152.4
ip4:40.92.0.0/15
ip4:172.81.82.79
ip4:172.81.80.64
ip4:172.81.81.39
ip4:172.81.82.87
ip4:172.81.82.88
ip4:155.95.96.50
ip4:155.95.86.50
ip4:23.90.98.102
ip4:124.17.27.36
ip4:149.72.0.0/16
ip4:198.21.0.0/21
ip4:50.31.32.0/19
ip4:167.89.0.0/17
ip4:68.232.140.57
ip4:68.232.140.79
include:_s0.cdc.gov
-all

fetched 2026-06-04T01:29:23.169Z

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

p=reject — strict policy

Why it matters: DMARC binds SPF and DKIM into an enforceable policy (quarantine or reject) and surfaces spoofing attempts via aggregate reports. `p=none` or absent means spoofing succeeds silently (SOC 2 CC6.7).

v=DMARC1; p=reject; fo=1; ri=3600; rua=mailto:8idhoybh@ag.us.dmarcian.com,mailto:reports@dmarc.cyber.dhs.gov; ruf=mailto:8idhoybh@fr.us.dmarcian.com;

v=: DMARC1
p=: reject
fo=: 1
ri=: 3600
rua=: mailto:8idhoybh@ag.us.dmarcian.com,mailto:reports@dmarc.cyber.dhs.gov
ruf=: mailto:8idhoybh@fr.us.dmarcian.com

fetched 2026-06-04T01:29:23.168Z

dmarc

info

Open standalone →

resolving dmarc…

dkim

low

Open standalone →

2/6 DKIM selectors valid

Why it matters: DKIM signs outbound mail so receivers can detect tampering. Missing selectors or rotated-away keys break DMARC alignment and let receivers downgrade trust (ISO 27001 A.8.24).

Recommendations

Check the missing selectors in your DNS provider and re-add any removed records

default:: —
google:: —
k1:: —
selector1:: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxc86u7V3s8hHRBCjAlB162wGauXlxdG2jTTrb/cZ+Mhxi72S6MImgcjQ7TohgGB+7IF5UHN2xVL3IJyaNcAN7zFfsMhImt3TbS3MrDlkATLvVavOKsxmKGCh/jUJFUSYsalATaC8tdVtkC64j2XWOUhmTJsc4CUxeuiKNuAH2XUDflMpc2W4cTKkA5htlmyU+++Vn+gPxYZM2e0UQ3zGBME6ut2JxWnkYzVGBlIzj6g7WE6aHiStlpM67gpHdBXQcXIaC/V45qF3v462VfXxODx+ubRgN+NhxrvsMotcimlQG94qIUWPnRA/VJm8WHd5Mz1De+Q1YrNmGOX0U/BFmQIDAQAB;
selector2:: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnJL4BSJA70HCqbylDHlr4nF5CgRNxH0+msoqrj93cqXRaXyCxPfjA+Qn1xqMH8ZjO4wczL5sDQiVV1l6Gntd02G1k/GXd/r5xlk3rV5LCcL/Vh3UVoBpQgapHHdoAc9a9K8MO+qudPGOfG4hu+xXNk3wWpUExQBMp19BsbFuS8OnH+tlZSQot0Rp5fRpkajsZId8rVh/TisSMlfZMTfeaberp9ORQiQaonVdrDLQusq468wpA7+vPtrCgcm/CCCLdUEN/fr3eRuTKkgqUFW0jpE5DylmylAR5HKCHnhOf9TnAUeGeKzdaNyNK0Qh24Ns+cPm4/gQyC+eliHpD7H/XQIDAQAB;
mxvault:: —

fetched 2026-06-04T01:29:23.176Z

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

cert valid for 149 days

Why it matters: A valid current TLS certificate is the baseline for data in transit. Expiry, weak chain, or hostname mismatch break HTTPS and fail PCI 4.2.1 / SOC 2 CC6.1.

subject cn:: *.cdc.gov
issuer:: DigiCert Global G3 TLS ECC SHA384 2020 CA1 / DigiCert Inc
valid:: Apr 16 00:00:00 2026 GMT → Oct 31 23:59:59 2026 GMT
authorized:: yes
sha256:: 3E:90:6D:C0:50:00:B1:1D:59:72:52:83:3D:56:09:A5:EB:4B:7C:BB:72:C4:24:FC:1B:D5:A0:D3:A7:C5:B4:85
sans: *.cdc.gov
cdc.gov

fetched 2026-06-04T01:29:23.198Z

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

HTTPS served correctly

Why it matters: Bare HTTP requests must redirect to HTTPS without dropping the user mid-chain. Plain-text fallback or open redirects fail PCI 4.2.1 and feed phishing chains (SOC 2 CC6.6).

final status: 200 · 1 hop

[200] https://cdc.gov/

fetched 2026-06-04T01:29:23.232Z

redirects

info

Open standalone →

tracing redirects…

headers

low

Open standalone →

5 security header(s) missing

Why it matters: Security headers — HSTS, CSP, X-Frame-Options, Referrer-Policy — defend against XSS, clickjacking, and downgrade attacks. Absent headers map directly to OWASP ASVS V14 findings (ISO 27001 A.8.23).

Recommendations

Add response header — Content-Security-Policy: default-src 'self' (tune per app)
Add response header — X-Frame-Options: DENY (or SAMEORIGIN if framing is intended)
Add response header — X-Content-Type-Options: nosniff
Add response header — Referrer-Policy: strict-origin-when-cross-origin
Add permissions-policy response header

final url: https://cdc.gov/

security headers

strict-transport-security: max-age=31536000 ; includeSubDomains ; preload
content-security-policy: —
x-frame-options: —
x-content-type-options: —
referrer-policy: —
permissions-policy: —

other headers

accept-ranges: bytes
access-control-allow-headers: Access-Control-Allow-Headers, Origin, Accept, X-Requested-With, Content-Type, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-origin: *
connection: keep-alive
content-encoding: gzip
content-length: 9514
content-type: text/html
date: Thu, 04 Jun 2026 01:29:23 GMT
set-cookie: Akamai-Request-ID=460f341736563afdcc0d; path=/; domain=.cdc.gov; secure; SameSite=none
vary: Accept-Encoding
x-azure-ref: 20260604T005745Z-17997c87696c79xxhC1IADqksc00000001u00000000010ah
x-powered-by: ASP.NET

fetched 2026-06-04T01:29:23.233Z

headers

info

Open standalone →

fetching headers…

cors

low

Open standalone →

CORS allows all origins (wildcard)

Why it matters: Overly permissive CORS (wildcard with credentials, or reflected origin) lets any origin read authenticated responses from this domain. OWASP A05 misconfiguration territory (NIST AC-4).

Recommendations

Restrict Access-Control-Allow-Origin to specific trusted origins if this API is not fully public

origin: https://domainposture.com
method: GET
preflight status: 200

access-control-* headers

access-control-allow-origin: *
access-control-allow-methods: —
access-control-allow-headers: Access-Control-Allow-Headers, Origin, Accept, X-Requested-With, Content-Type, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-credentials: —
access-control-max-age: —
access-control-expose-headers: —

fetched 2026-06-04T01:29:23.362Z

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

HTTPS surface reachable (robots ✓, sitemap ✗, title ✓)

Why it matters: Public files — robots.txt, sitemap.xml, head meta — are what attackers see first during reconnaissance. Misadvertised paths, stale sitemaps, and verbose generators leak more than intended (ISO 27001 A.8.9).

robots.txt

present

# Ignore FrontPage files
User-agent: *
Disallow: /_borders
Disallow: /_derived
Disallow: /_fpclass
Disallow: /_overlay
Disallow: /_private
Disallow: /_themes
Disallow: /_vti_bin
Disallow: /_vti_cnf
Disallow: /_vti_log
Disallow: /_vti_map
Disallow: /_vti_pvt
Disallow: /_vti_txt

# Do not index the following URLs
Disallow: /travel/
Disallow: /flu/espanol/
Disallow: /migration/
Disallow: /Features/SpinaBifidaProgram/
Disallow: /concussion/HeadsUp/training/
Disallow: /niosh/archive/
Disallow: /TemplatePackage/examples
Disallow: /TemplatePackage/gadgets
Disallow: /TemplatePackage/modules
Disallow: /TemplatePackage/subtopic
Disallow: /TemplatePackage/Templates
Disallow: /TemplatePackage/3.0/examples
Disallow: /TemplatePackage/3.0/Templates
Disallow: /TemplatePackage/4.0/docs
Disallow: /TemplatePackage/4.0/gallery-internal
Disallow: /templatepackage/examples
Disallow: /templatepackage/gadgets
Disallow: /templatepackage/modules
Disallow: /templatepackage/subtopic
Disallow: /templatepackage/Templates
Disallow: /templatepackage/templates
Disallow: /templatepackage/3.0/examples
Disallow: /templatepackage/3.0/Templates
Disallow: /templatepackage/3.0/templates
Disallow: /templatepackage/4.0/docs
Disallow: /templatepackage/4.0/gallery-internal
Disallow: /templatepackage/dmat

# Rover is a bad dog
User-agent: Roverbot
Disallow: /

# EmailSiphon is a hunter/gatherer which extracts email addresses for spam-mailers to use
User-agent: EmailSiphon
Disallow: /

# Exclude MindSpider since it appears to be ill-behaved
User-agent: MindSpider
Disallow: /

# Sitemap link per CR14586
Sitemap: https://www.cdc.gov/wcms-auto-sitemap-index.xml

sitemap.xml

absent

head

title: Centers for Disease Control and Prevention | CDC
description: —

social

og:type: article
og:title: Centers for Disease Control and Prevention
og:url: https://www.cdc.gov/index.html
og:author: CDC
og:updated_time: 2026-06-02T14:04:23-04:00
twitter:card: summary
twitter:title: Centers for Disease Control and Prevention
twitter:url: https://www.cdc.gov/index.html
twitter:site: @CDCgov
twitter:creator: @CDCgov

fetched 2026-06-04T01:29:23.321Z

web-surface

info

Open standalone →

inspecting web surface…

dnssec

info

Open standalone →

DNSSEC enabled — DS records present and chain validated (AD flag)

Why it matters: DNSSEC cryptographically signs DNS responses, blocking cache-poisoning attacks. US federal civilian agencies are required to enable it under OMB M-22-09 (NIST SC-20).

enabled: yes
DS records: 30024 ECDSAP256SHA256 2 b8b55ae32d127497a5e95f95f30a957a3eeafa0aca08eb08a5f4d7cd602b10de, DS ECDSAP256SHA256 2 3600 1780626400 1780446400 35496 gov. dxEzU5QqCvAj+qRMW9Z8WYUzfy1/jVHF4bC2JHZGaUugQ1PuBswpJNZnW+B0/6d04zRJDzqqBqveuGZQvc9zFw==
DNSKEY records: —

fetched 2026-06-04T01:29:23.249Z

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

not applicable: no _mta-sts TXT record

Why it matters: MTA-STS forces inbound SMTP to use TLS and refuse downgraded connections. Without it, an in-path attacker can strip TLS and read mail in plaintext (SOC 2 CC6.7).

no _mta-sts TXT record

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

not applicable: no TLSRPT record

Why it matters: TLS-RPT publishes a reporting address for SMTP-TLS failures. Without it, downgrade attacks on inbound mail go unnoticed (SOC 2 CC7.2).

no TLSRPT record

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

low

Open standalone →

domain expires in 78 days — renew soon

Why it matters: Registrar and expiry tell auditors the domain is owned, current, and not about to lapse. An expired or about-to-expire domain fails business-continuity evidence (SOC 2 A1.2).

Recommendations

Enable auto-renewal at your registrar to avoid accidental expiry

registrar: get.gov
created: 1997-10-02T01:29:21Z
expires: 2026-08-21T17:01:46Z
statuses: serverTransferProhibited https://icann.org/epp#serverTransferProhibited

fetched 2026-06-04T01:29:23.434Z

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

check failed: crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

Why it matters: Every certificate issued for this domain is published in Certificate Transparency logs — including subdomains you may have forgotten. Unknown subdomains in CT are pre-disclosed attack surface (ISO 27001 A.8.16).

crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.