chase.com

15-check dossier · scoreboard above, section details below

Get a pack →

Scanning…

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

resolving mx…

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

resolving dmarc…

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

tracing redirects…

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

inspecting web surface…

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.

chase.com

15-check dossier · scoreboard above, section details below

Get a pack →

A-

Audit-ready · 2 minor advisories

Aggregate grade across 15 checks. Auditors typically flag any High-severity finding.

Pass: 13
Warn: 2
Fail: 0

What an auditor would flag first

low
DKIM
no DKIM selectors found — likely not configured
SOC 2 CC6.7
low
DNSSEC
DNSSEC not configured — no DS or DNSKEY records found
SOC 2 CC6.6ISO 27001 A.13.1.1

Need this as an artifact your auditor can verify?

Your chase.com scan flagged 2 low findings. A signed pack covers the apex plus up to 100 CT-discovered subdomains, Ed25519-signed and ISO-timestamped, delivered in 10–30 minutes.

Get a pack →See methodology See a sample$29

Scanning…

15-check summary

DNS recordsA/AAAA records present
MX4 MX record(s) present
SPF-all hardfail — strict policy
DMARCp=reject — strict policy
DKIMno DKIM selectors found — likely not configured
TLS certificatecert valid for 99 days
Redirect chainHTTPS served correctly
Security headers2 security header(s) missing
CORSno CORS headers — cross-origin requests blocked by default
Web surfaceHTTPS surface reachable (robots ✓, sitemap ✓, title ✓)
MTA-STSnot applicable: no _mta-sts TXT record
TLS-RPTnot applicable: no TLSRPT record
DNSSECDNSSEC not configured — no DS or DNSKEY records found
WHOISdomain registered until 2027-10-10
Certificate Transparencycheck failed: crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

dns

info

Open standalone →

A/AAAA records present

Why it matters: Without authoritative A or AAAA records on the apex, the domain is unreachable. Missing baseline DNS shows up in vendor reviews as evidence of unmanaged infrastructure (SOC 2 CC6.6).

A: ttl=891 146.143.13.57
ttl=891 146.143.141.57
ttl=891 146.143.83.57
AAAA: —
NS: ttl=3223 ns1.jpmorganchase.com.
ttl=3223 ns2.jpmorganchase.com.
ttl=3223 ns05.jpmorganchase.com.
ttl=3223 ns06.jpmorganchase.com.
ttl=3223 ns0119.secondary.cloudflare.com.
ttl=3223 ns0140.secondary.cloudflare.com.
SOA: ttl=3600 ns1.jpmorganchase.com. hostmaster.jpmchase.com. 656931298 10800 1800 1209600 3600
CAA: ttl=3600 \# 19 00 05 69 73 73 75 65 64 69 67 69 63 65 72 74 2e 63 6f 6d
ttl=3600 \# 18 00 05 69 73 73 75 65 65 6e 74 72 75 73 74 2e 6e 65 74
TXT: ttl=710 "v=spf1 include:tpo.chase.com exists:%{i}.spf.chase.com exists:%{i}.spf.hc4673-96.iphmx.com exists:%{i}.spf.hc4698-8.iphmx.com -all"
ttl=710 "google-site-verification=w00TwyVREI5RpqAT9hqSLZVvZcZi46578G57D1aMGeE"
ttl=710 "atlassian-domain-verification=wUjrfh2T73RznZOKmEZfc0mRF92bjC7JyjSgRXg9Yt2e9ZMRZwafUO6GPJaecYOh"
ttl=710 "wiz-domain-verification=66aa74155d5e84d10ed4b5a786a66f94063cff3b4c7e11d09fb46f027736dbf0"
ttl=710 "atlassian-domain-verification\\u003dpD6ozLCGDinP/R+vd5R9hpoPCSOmTFTHfWPK633PXEtELa5KlVDw4w1Pnn02aTdC"
ttl=710 "smartsheet-site-validation=JdBS3Kn_332V6dI9U0iq0TV3RZZXTUhL"
ttl=710 "sinch-domain-verification=6848bb42-da6f-49cf-8974-920af9cf1806"
ttl=710 "pendo-domain-verification=1f6e5677-d405-438e-88ba-141766793ce8"
ttl=710 "google-site-verification=iZwZzo1YPl0G29U136Suzn4c1VptcA_LkvvdWOYC6B0"
ttl=710 "_m47rp0d9u3ci4ycif1echp310q0yy09"
ttl=710 "google-site-verification=PfSAyrffyVUKXLc1Ew8C2IFPWkjufFSsbboFz_24Qt4"
ttl=710 "wiz-domain-verification=a0d8d067bcb1cdd44255d0633a31df3ba13c82e30f27c080519b0b85ba734d32"
ttl=710 "atlassian-domain-verification=PZApk1vJjd7scChzBMQy2d4NEwk4Bt26obCVACc7vWiOBVCOxTOV4/EB9LMexMnl"

fetched 2026-06-04T02:34:09.320Z

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

4 MX record(s) present

Why it matters: MX records direct inbound mail. Misconfiguration silently breaks email delivery and lets attackers stand up parallel MX hosts for spoofing campaigns (ISO 27001 A.8.21).

pri=10 cluster14.us.messagelabs.com.
pri=20 cluster14.us.messagelabs.com.
pri=30 cluster14.us.messagelabs.com.
pri=40 cluster14a.us.messagelabs.com.

fetched 2026-06-04T02:34:09.311Z

mx

info

Open standalone →

resolving mx…

spf

info

Open standalone →

-all hardfail — strict policy

Why it matters: SPF tells receiving servers which hosts may send mail for the domain. Without it, any sender can forge the envelope-from — the primary mechanism behind business-email-compromise (SOC 2 CC6.7).

v=spf1 include:tpo.chase.com exists:%{i}.spf.chase.com exists:%{i}.spf.hc4673-96.iphmx.com exists:%{i}.spf.hc4698-8.iphmx.com -all

v=spf1
include:tpo.chase.com
exists:%{i}.spf.chase.com
exists:%{i}.spf.hc4673-96.iphmx.com
exists:%{i}.spf.hc4698-8.iphmx.com
-all

fetched 2026-06-04T02:34:09.321Z

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

p=reject — strict policy

Why it matters: DMARC binds SPF and DKIM into an enforceable policy (quarantine or reject) and surfaces spoofing attempts via aggregate reports. `p=none` or absent means spoofing succeeds silently (SOC 2 CC6.7).

v=DMARC1; p=reject; pct=100; rua=mailto:d@rua.agari.com; ruf=mailto:d@ruf.agari.com;

v=: DMARC1
p=: reject
pct=: 100
rua=: mailto:d@rua.agari.com
ruf=: mailto:d@ruf.agari.com

fetched 2026-06-04T02:34:09.310Z

dmarc

info

Open standalone →

resolving dmarc…

dkim

low

Open standalone →

no DKIM selectors found — likely not configured

Why it matters: DKIM signs outbound mail so receivers can detect tampering. Missing selectors or rotated-away keys break DMARC alignment and let receivers downgrade trust (ISO 27001 A.8.24).

Recommendations

Enable DKIM signing in your mail provider and publish the provided TXT record
Common selectors: google._domainkey, selector1._domainkey (Microsoft), mail._domainkey

no DKIM record on probed selectors (default, google, k1, selector1, selector2, mxvault)

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

cert valid for 99 days

Why it matters: A valid current TLS certificate is the baseline for data in transit. Expiry, weak chain, or hostname mismatch break HTTPS and fail PCI 4.2.1 / SOC 2 CC6.1.

subject cn:: www.chase.com
issuer:: DigiCert EV RSA CA G2 / DigiCert Inc
valid:: Sep 12 00:00:00 2025 GMT → Sep 11 23:59:59 2026 GMT
authorized:: yes
sha256:: 84:E3:30:64:8E:C4:63:97:FB:F7:51:17:6C:22:E7:04:43:2F:6B:6B:EE:1E:15:93:F8:25:5A:A0:00:54:3A:08
sans: www.chase.com
chase.com
www-ndc.chase.com

fetched 2026-06-04T02:34:09.444Z

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

HTTPS served correctly

Why it matters: Bare HTTP requests must redirect to HTTPS without dropping the user mid-chain. Plain-text fallback or open redirects fail PCI 4.2.1 and feed phishing chains (SOC 2 CC6.6).

final status: 200 · 2 hops

[301] https://chase.com/
[200] https://www.chase.com/

fetched 2026-06-04T02:34:09.551Z

redirects

info

Open standalone →

tracing redirects…

headers

info

Open standalone →

2 security header(s) missing

Why it matters: Security headers — HSTS, CSP, X-Frame-Options, Referrer-Policy — defend against XSS, clickjacking, and downgrade attacks. Absent headers map directly to OWASP ASVS V14 findings (ISO 27001 A.8.23).

Recommendations

Add response header — X-Content-Type-Options: nosniff
Add response header — Referrer-Policy: strict-origin-when-cross-origin

final url: https://www.chase.com/

security headers

strict-transport-security: max-age=31536000
content-security-policy: frame-ancestors 'none'
x-frame-options: SAMEORIGIN
x-content-type-options: —
referrer-policy: —
permissions-policy: ch-ua-full-version-list=("https://*.chase.com"),ch-ua-platform-version=("https://*.chase.com"),ch-ua-arch=("https://*.chase.com"),ch-ua-model=("https://*.chase.com"),ch-ua-bitness=("https://*.chase.com"),ch-ua-wow64=("https://*.chase.com")

other headers

accept-ch: Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Bitness, Sec-CH-UA-Wow64
cache-control: public, max-age=1797
connection: keep-alive, Transfer-Encoding
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Thu, 04 Jun 2026 02:34:09 GMT
etag: "luihwo8mhp6jdb"
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1780540449530_389073030_1549161317_35_7460_6_2_-";dur=1
transfer-encoding: chunked
vary: Accept-Encoding
x-akamai-transformed: 9 - 0 pmb=mRUM,2
x-amzn-trace-id: 0.86c83017.1780540449.5c565365
x-content-security-policy: frame-ancestors 'none'
x-envoy-upstream-service-time: 20
x-nextjs-cache: HIT
x-xss-protection: 1; mode=block

fetched 2026-06-04T02:34:09.620Z

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

no CORS headers — cross-origin requests blocked by default

Why it matters: Overly permissive CORS (wildcard with credentials, or reflected origin) lets any origin read authenticated responses from this domain. OWASP A05 misconfiguration territory (NIST AC-4).

origin: https://domainposture.com
method: GET
preflight status: 301

access-control-* headers

access-control-allow-origin: —
access-control-allow-methods: —
access-control-allow-headers: —
access-control-allow-credentials: —
access-control-max-age: —
access-control-expose-headers: —

no access-control-* headers returned — site does not advertise CORS to this origin

fetched 2026-06-04T02:34:09.383Z

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

HTTPS surface reachable (robots ✓, sitemap ✓, title ✓)

Why it matters: Public files — robots.txt, sitemap.xml, head meta — are what attackers see first during reconnaissance. Misadvertised paths, stale sitemaps, and verbose generators leak more than intended (ISO 27001 A.8.9).

robots.txt

present

User-agent: *
Disallow: /cm/
Disallow: /ccpmweb/shared/
Disallow: /ccpmweb/commercial/
Disallow: /ccpmweb/business/
Disallow: /ccpmweb/chase_canada/
Disallow: /ccpmweb/individuals/
Disallow: /ccpmweb/autodealer/
Disallow: /ccpmweb/spanish/
Disallow: /ccpmweb/generic/
Disallow: /ccpmweb/home_equity/
Disallow: /ccpmweb/chf/
Disallow: /inetSearch/
Disallow: /ccp/index.jsp?pg_name=ccpmapp/shared/marketing/page/offer100_old
Disallow: /ccp/index.jsp?pg_name=ccpmapp/shared/marketing/page/Free_Account_Alert5_page
Disallow: /psmhelp/index.jsp?pg_name=ccpmapp/shared/help/page/OLBP_Email_10_offer
Disallow: /ccp/index.jsp?pg_name=ccpmapp/shared/help/page/OLBP_Email_10_offer 
Disallow: /*swf*
Disallow: /online/Checking/
Disallow: /online/common/
Disallow: /online/Credit-Cards/
Disallow: /online/Special-Offers/
Disallow: /online/ink/
Disallow: /online/card_feed/
Disallow: /online/Home-Lending/
Disallow: /online/services/document/
Disallow: /online/investments/
Disallow: /online/commercial-bank/
Disallow: /online/includes/
Disallow: /online/freedom/
Disallow: /online/chase_blueprint/
Disallow: /online/tagging/
Disallow: /online/Special-Offers/blueprint.htm
Disallow: /online/services/article/blackberry-phone.htm.
Disallow: /online/services/article/175517_videoCC.xml
Disallow: /online/chase_blueprint/article/bp-split-floodlight-tag.htm
Disallow: /online/services/article/spanish-findus-pixel-frame.htm.
Disallow: /online/services/article/spanish-home-pixel-frame.htm
Disallow: /online/private_client/article/13587-cpc-artcoll-floodlight-tag.htm
Disallow: /online/private_client/article/13587-cpc-pcbanker-floodlight-tag.htm
Disallow: /online/private_client/article/13587-cpc-invmgt-floodlight-tag.htm
Disallow: /online/Mortgage/article/home-loan_pixel_frameset.htm
Disallow: /online/tagging/article/bb_lending_bluekai_tag.htm
Disallow: /online/services/article/financial-spanish-pixel-frame.htm
Disallow: /online/Special-Offers/article/platinummobile_features_floodlight_artcl.htm
Disallow: /online/services/header/take-a-step-forward_dblclick_artcl.htm
Disallow: /online/private_client/article/13587-cpc-mktinsights-floodlight-tag.htm
Disallow: /online/tagging/article/military_jobs_dbclick_artcl.htm
Disallow: /online/tagging/article/bluekai-mortgage-pixel-tag-artcl.htm
Disallow: /online/private_client/article/13587-cpc-legal-floodlight-tag.htm
Disallow: /online/private_client/article/13587-cpc-commitment-floodlight-tag.htm
Disallow: /online/private_client/article/13587-cpc-finplan-floodlight-tag.htm
Disallow: /online/chase_blueprint/article/bp-trackit-floodlight-tag.htm
Disallow: /online/private_client/article/13587-cpc-bkgsolutions-floodlight-tag.htm
Disallow: /online/private_client/article/13587-cpc-portfoliomgt-floodlight-tag.htm
Disallow: /online/tagging/article/26542-AOD.htm
Disallow: /online/private_client/article/13587-cpc-personalizedbkg-floodlight-tag.htm
Disallow: /online/private_client/article/13587-cpc-mobile-floodlight-tag.htm
Disallow: /online/private_client/article/13587-cpc-jpminvest-floodlight-tag.htm
Disallow: /online/private_client/article/13587-cpc-assetmgt-floodlight-tag.htm
Disallow: /online/tagging/article/bluekai-prospect-dchp-pixel-tag-artcl.htm.
Disallow: /online/tagging/article/military_personal_dbclick_artcl.htm
Disallow: /online/private_client/article/13587-cpc-lendingbenfits-floodlight-tag.htm
Disallow: /online/chase_blueprint/article/bp-home-floodlight-tag.htm
Disallow: /online/tagging/article/military_personal_pixel_artcl.htm
Disallow: /*xml$
Disallow: /*dwt$
Disallow: /*webm$
Disallow: /*mp4$
Disallow: /ccpmweb/shared/document/access_mgr_guide.pdf
Disallow: /content/dam/chaseonline/en/legacy/content/secure/sso/document/CCO_Account_Activity_Quick_Reference-LoRes.pdf
Disallow: /content/dam/chaseonline/en/legacy/content/secure/sso/document/CCO_Account_Transfer_Quick_Reference-lores.pdf
Disallow: /content/dam/chaseonline/en/legacy/content/secure/sso/document/ACH_Collections_New.pdf
Disallow: /content/dam/chaseonline/en/legacy/content/secure/sso/documen

sitemap.xml

present — 183 url(s)

head

title: Credit Card, Mortgage, Banking, Auto | Chase Online | Chase.com
description: Chase online; credit cards, mortgages, commercial banking, auto loans, investing & retirement planning, checking and business banking.

social

no OpenGraph or Twitter meta tags found

fetched 2026-06-04T02:34:09.561Z

web-surface

info

Open standalone →

inspecting web surface…

dnssec

low

Open standalone →

DNSSEC not configured — no DS or DNSKEY records found

Why it matters: DNSSEC cryptographically signs DNS responses, blocking cache-poisoning attacks. US federal civilian agencies are required to enable it under OMB M-22-09 (NIST SC-20).

Recommendations

Enable DNSSEC in your DNS provider's control panel and add the resulting DS record at your registrar

enabled: no
DS records: —
DNSKEY records: —

fetched 2026-06-04T02:34:09.324Z

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

not applicable: no _mta-sts TXT record

Why it matters: MTA-STS forces inbound SMTP to use TLS and refuse downgraded connections. Without it, an in-path attacker can strip TLS and read mail in plaintext (SOC 2 CC6.7).

no _mta-sts TXT record

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

not applicable: no TLSRPT record

Why it matters: TLS-RPT publishes a reporting address for SMTP-TLS failures. Without it, downgrade attacks on inbound mail go unnoticed (SOC 2 CC7.2).

no TLSRPT record

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

domain registered until 2027-10-10

Why it matters: Registrar and expiry tell auditors the domain is owned, current, and not about to lapse. An expired or about-to-expire domain fails business-continuity evidence (SOC 2 A1.2).

registrar: MarkMonitor Inc.
created: 1995-10-11T04:00:00Z
expires: 2027-10-10T04:00:00Z
statuses: clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited, clientTransferProhibited https://icann.org/epp#clientTransferProhibited, clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited, serverDeleteProhibited https://icann.org/epp#serverDeleteProhibited, serverTransferProhibited https://icann.org/epp#serverTransferProhibited, serverUpdateProhibited https://icann.org/epp#serverUpdateProhibited

fetched 2026-06-04T02:34:09.485Z

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

check failed: crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

Why it matters: Every certificate issued for this domain is published in Certificate Transparency logs — including subdomains you may have forgotten. Unknown subdomains in CT are pre-disclosed attack surface (ISO 27001 A.8.16).

crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.