commbank.com.au

15-check dossier · scoreboard above, section details below

Get a pack →

Scanning…

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

resolving mx…

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

resolving dmarc…

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

tracing redirects…

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

inspecting web surface…

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.

commbank.com.au

15-check dossier · scoreboard above, section details below

Get a pack →

Mostly compliant · 6 items need attention

Aggregate grade across 15 checks. Auditors typically flag any High-severity finding.

Pass: 9
Warn: 6
Fail: 0

What an auditor would flag first

medium
SPF
~all softfail — receivers may still accept
SOC 2 CC6.7ISO 27001 A.13.2.1
low
DKIM
1/6 DKIM selectors valid
SOC 2 CC6.7
low
TLS certificate
cert expires in 50 days
SOC 2 CC6.6ISO 27001 A.13.1.1

Need this as an artifact your auditor can verify?

Your commbank.com.au scan flagged 1 medium and 5 low findings. A signed pack covers the apex plus up to 100 CT-discovered subdomains, Ed25519-signed and ISO-timestamped, delivered in 10–30 minutes.

Get a pack →See methodology See a sample$29

Scanning…

15-check summary

DNS recordsA/AAAA records present
MX1 MX record(s) present
SPF~all softfail — receivers may still accept
DMARCp=reject — strict policy
DKIM1/6 DKIM selectors valid
TLS certificatecert expires in 50 days
Redirect chainHTTPS served correctly
Security headers3 security header(s) missing
CORSno CORS headers — cross-origin requests blocked by default
Web surfaceHTTPS surface reachable (robots ✓, sitemap ✓, title ✓)
MTA-STSnot applicable: no _mta-sts TXT record
TLS-RPTnot applicable: no TLSRPT record
DNSSECDNSSEC not configured — no DS or DNSKEY records found
WHOISWHOIS expiry date unavailable — cannot assess renewal risk
Certificate Transparencycheck failed: crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

dns

info

Open standalone →

A/AAAA records present

Why it matters: Without authoritative A or AAAA records on the apex, the domain is unreachable. Missing baseline DNS shows up in vendor reviews as evidence of unmanaged infrastructure (SOC 2 CC6.6).

A: ttl=60 172.66.1.168
ttl=60 162.159.141.172
AAAA: —
NS: ttl=170416 ns-1077.awsdns-06.org.
ttl=170416 ns-1901.awsdns-45.co.uk.
ttl=170416 ns-24.awsdns-03.com.
ttl=170416 ns-845.awsdns-41.net.
SOA: ttl=3600 ns-748.awsdns-29.net. awsdns-hostmaster.amazon.com. 1 7200 900 1209600 86400
CAA: —
TXT: ttl=3600 "MS=ms68246048"
ttl=3600 "dtm-domain-verification=977Uxjp-VyM5SRUebnl8wn6M4ze09q4a500Zap-6TV0"
ttl=3600 "e59ad446-f0e7-49ea-9146-d9eedcdde784"
ttl=3600 "string: C0O4M11565"
ttl=3600 "v=spf1 include:spf1.cba.com.au include:spf2.cba.com.au ip4:144.49.240.0/21 include:spf.protection.outlook.com ~all"

fetched 2026-06-04T04:39:14.829Z

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

1 MX record(s) present

Why it matters: MX records direct inbound mail. Misconfiguration silently breaks email delivery and lets attackers stand up parallel MX hosts for spoofing campaigns (ISO 27001 A.8.21).

pri=10 commbank-com-au.mail.protection.outlook.com.

fetched 2026-06-04T04:39:14.821Z

mx

info

Open standalone →

resolving mx…

spf

medium

Open standalone →

~all softfail — receivers may still accept

Why it matters: SPF tells receiving servers which hosts may send mail for the domain. Without it, any sender can forge the envelope-from — the primary mechanism behind business-email-compromise (SOC 2 CC6.7).

Recommendations

Move to -all (hardfail) once your mail flow is confirmed — softfail gives no real protection

v=spf1 include:spf1.cba.com.au include:spf2.cba.com.au ip4:144.49.240.0/21 include:spf.protection.outlook.com ~all

v=spf1
include:spf1.cba.com.au
include:spf2.cba.com.au
ip4:144.49.240.0/21
include:spf.protection.outlook.com
~all

fetched 2026-06-04T04:39:14.816Z

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

p=reject — strict policy

Why it matters: DMARC binds SPF and DKIM into an enforceable policy (quarantine or reject) and surfaces spoofing attempts via aggregate reports. `p=none` or absent means spoofing succeeds silently (SOC 2 CC6.7).

v=DMARC1; p=reject; sp=reject; pct=100; rua=mailto:dmarc-rua@cba.com.au; ruf=mailto:dmarc-ruf@cba.com.au; adkim=s; aspf=s; fo=1; rf=afrf; ri=86400

v=: DMARC1
p=: reject
sp=: reject
pct=: 100
rua=: mailto:dmarc-rua@cba.com.au
ruf=: mailto:dmarc-ruf@cba.com.au
adkim=: s
aspf=: s
fo=: 1
rf=: afrf
ri=: 86400

fetched 2026-06-04T04:39:15.080Z

dmarc

info

Open standalone →

resolving dmarc…

dkim

low

Open standalone →

1/6 DKIM selectors valid

Why it matters: DKIM signs outbound mail so receivers can detect tampering. Missing selectors or rotated-away keys break DMARC alignment and let receivers downgrade trust (ISO 27001 A.8.24).

Recommendations

Check the missing selectors in your DNS provider and re-add any removed records

default:: —
google:: —
k1:: —
selector1:: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArVe8mffvyhnNesDn2rCqlIPxm7ACDWIy1t2c9xaUkr0ikZxPSQQcvw9VOVPVc6tGIG7aRjFt6rCOCIHtND77xz2cwjcjnkrEd7xaP2q8MPKpX/5yBjRPNB51lqwLGqj5bBj0q47RI0k8vA1d1hqlTktPS18Sf7GrBI0UTOZ3Ia8EjtWFwuUl/S3ULvujiT6chOLWJpf3GG8i+Qol+kO/jc0vYWj0KsavOPTzJns6Jzb+M+7eN/absJjqxgBP2+ktcYZQDzyy1nZESd4ZMTnLdlqnR7pLHdmvYltySdR1E/elecVBo2zNVAd0swIaH+934vgPeQ6oXMpQa5EF1xw6YQIDAQAB;
selector2:: —
mxvault:: —

fetched 2026-06-04T04:39:14.821Z

dkim

info

Open standalone →

probing dkim selectors…

tls

low

Open standalone →

cert expires in 50 days

Why it matters: A valid current TLS certificate is the baseline for data in transit. Expiry, weak chain, or hostname mismatch break HTTPS and fail PCI 4.2.1 / SOC 2 CC6.1.

Recommendations

Schedule certificate renewal — consider enabling auto-renewal

subject cn:: www.commbank.com.au
issuer:: DigiCert EV RSA CA G2 / DigiCert Inc
valid:: Jul 25 00:00:00 2025 GMT → Jul 24 23:59:59 2026 GMT
authorized:: yes
sha256:: 30:83:00:A0:6E:2A:9C:C7:00:2B:EA:73:DD:CF:1D:B1:D3:E4:87:22:7F:26:54:8F:6D:8F:6C:F4:E8:42:E7:E3
sans: www.commbank.com.au
mobile-app-redirect.commbank.com.au
developer.commbank.com.au
commbank.com.au
assets.commbank.com.au

fetched 2026-06-04T04:39:14.855Z

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

HTTPS served correctly

Why it matters: Bare HTTP requests must redirect to HTTPS without dropping the user mid-chain. Plain-text fallback or open redirects fail PCI 4.2.1 and feed phishing chains (SOC 2 CC6.6).

final status: 200 · 2 hops

[301] https://commbank.com.au/
[200] https://www.commbank.com.au/

fetched 2026-06-04T04:39:14.968Z

redirects

info

Open standalone →

tracing redirects…

headers

low

Open standalone →

3 security header(s) missing

Why it matters: Security headers — HSTS, CSP, X-Frame-Options, Referrer-Policy — defend against XSS, clickjacking, and downgrade attacks. Absent headers map directly to OWASP ASVS V14 findings (ISO 27001 A.8.23).

Recommendations

Add response header — Content-Security-Policy: default-src 'self' (tune per app)
Add response header — Referrer-Policy: strict-origin-when-cross-origin
Add permissions-policy response header

final url: https://www.commbank.com.au/

security headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: —
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
referrer-policy: —
permissions-policy: —

other headers

age: 52
cache-control: max-age=60
cf-cache-status: HIT
cf-ray: a06440ae7a892fd6-IAD
connection: keep-alive
content-encoding: br
content-type: text/html;charset=utf-8
date: Thu, 04 Jun 2026 04:39:14 GMT
last-modified: Thu, 04 Jun 2026 04:38:02 GMT
server: cloudflare
set-cookie: __cf_bm=3W5xUMH3KXbeyLzjqBct.cV8e9iMWGjVi8FS0Sj_WC8-1780547954.957173-1.0.1.1-Dah3KYVo4ZlRM5WrwV2RwJgTBTK5nip8gAvRmiA_tQZls0PjLF.BSnFd7Y.DskV3g2aUOVzksrGT_ps_gu3_wQr6puFSqlodbTSdNLAFbI1ctas2HxYJCydCrhl8AHSB; HttpOnly; SameSite=None; Secure; Path=/; Domain=commbank.com.au; Expires=Thu, 04 Jun 2026 05:09:14 GMT
transfer-encoding: chunked
vary: Accept-Encoding,User-Agent
x-dispatcher: dispatcher1apsoutheast2-28590565
x-vhost: publish

fetched 2026-06-04T04:39:14.979Z

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

no CORS headers — cross-origin requests blocked by default

Why it matters: Overly permissive CORS (wildcard with credentials, or reflected origin) lets any origin read authenticated responses from this domain. OWASP A05 misconfiguration territory (NIST AC-4).

origin: https://domainposture.com
method: GET
preflight status: 301

access-control-* headers

access-control-allow-origin: —
access-control-allow-methods: —
access-control-allow-headers: —
access-control-allow-credentials: —
access-control-max-age: —
access-control-expose-headers: —

no access-control-* headers returned — site does not advertise CORS to this origin

fetched 2026-06-04T04:39:14.870Z

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

HTTPS surface reachable (robots ✓, sitemap ✓, title ✓)

Why it matters: Public files — robots.txt, sitemap.xml, head meta — are what attackers see first during reconnaissance. Misadvertised paths, stale sitemaps, and verbose generators leak more than intended (ISO 27001 A.8.9).

robots.txt

present

User-agent: Swiftbot
Allow: /latest/lpi-refunds.html
Allow: /latest/loan-repayment-cover-refund.html
Allow: /latest/loan-protection-insurance-refund.html

# /robots.txt file for https://www.commbank.com.au/
User-agent: *
Disallow: /example-pages/
Disallow: /test/
Disallow: /references/
Disallow: /merchants/
Disallow: /mobile/
Disallow: /about-us/securitisation/
Disallow: /content/dam/commbank/corporate/research/
Disallow: /corporate/research/
Disallow: /personal/utility-nav-content/
Disallow: /business/utility-nav-content/
Disallow: /corporate/utility-nav-content/
Disallow: /about-us/utility-nav-content/
Disallow: /utility-nav-content/
Disallow: /bin/cba/nimbus/getPageInfo
Disallow: /personal/financial-planning/planners/
Disallow: /business/dig-festival-terms.html
Disallow: /business/can/Agri-insights-state-reports.html
Disallow: /content/dam/commbank/corporate/research/restricted/
Disallow: /microsite/
Disallow: /other-sites/
Disallow: /tiles/
Disallow: /support/dynamic/
Disallow: /netbank/learn-about-netbank/demos/
Disallow: /nps/
Disallow: /about-us/shaping-australia/
Disallow: /articles/news/
Disallow: /content/dam/caas/news/
Disallow: /content/commbank-neo/commbank-cards/
Disallow: /personal/articles.html
Disallow: /personal/articles
Disallow: /personal/home-buying-dp.html
Disallow: /digital/everydaybanking/
Disallow: /content/shared/consumer-finance/2017/05/your-fwb-behavioural-economics.html
Disallow: /content/shared/consumer-finance/2017/05/your-fwb-decision-making.html
Disallow: /content/shared/consumer-finance/2017/05/your-fwb-habit-forming.html
Disallow: /content/shared/consumer-finance/2017/05/your-fwb-take-control.html
Disallow: /content/shared/consumer-finance/2017/06/your-fwb-rainy-day.html
Disallow: /product-catalogue/
Disallow: /commbank-product-catalogue/ 
Disallow: /tools/dream-big-savings-calculator.html
Disallow: /support/home.html 
Disallow: /digital/home-loans/make-an-appointment 
Disallow: /digital/feedback
Disallow: /home-buying/education-content/
Disallow: /etc/
Disallow: /latest/lpi-refunds.html
Disallow: /latest/loan-repayment-cover-refund.html
Disallow: /latest/loan-protection-insurance-refund.html
Disallow: /retail/complaints-compliments-form/
Disallow: /personal/eform/lpi-premium-hlt.html
Disallow: /personal/eform/lpi-premium-hlt-joint.html
Disallow: /personal/eform/lpi-premium-plt.html
Disallow: /personal/eform/lpi-premium-hlf.html
Disallow: /personal/eform/lpi-premium-hlf-joint.html
Disallow: /personal/eform/lpi-premium-plf.html
Disallow: /content/campaigns/
Disallow: /content/api/
Disallow: /digital/conditionaleligibility
Disallow: /html-sitemap-youtube.html
Disallow: /html-sitemap-youtube-data.html

#Property Search application
Disallow: /digital/home-buying/property/31-Moray-Street-Richmond-NSW-2753-2018140670
Disallow: /digital/home-buying/property/77-First-Avenue-St-Peters-SA-5069-2018885187

#Blog
Disallow: /blog.feed

#PDFs
Disallow: /about-us/download-printed-forms/AML-Questionnaire.pdf
Disallow: /personal/apply-online/download-printed-forms/loan-protection-addendum-281115-ADV14068.pdf
Disallow: /personal/apply-online/download-printed-forms/loan-protection-addendum-281115-ADV14070.pdf
Disallow: /personal/apply-online/download-printed-forms/loan-protection-addendum-281115-ADV14067.pdf
Disallow: /personal/apply-online/download-printed-forms/loan-protection-addendum-281115-ADV14069.pdf
Disallow: /commbank/assets/about/careers/B481-Assessment-Centre-Flyer.pdf
Disallow: /home-buying/home-loans/docs/ADV14724-variation-notice.pdf
Disallow: /content/dam/commbank-assets/business/banking/2018-03/ctc-business-finance.pdf
Disallow: /business/pds/004-396-authority-for-business-accounts.pdf
Disallow: /business/pds/002-448.pdf
Disallow: /business/docs/eftpos-pricing-summary.pdf
Disallow: /content/dam/commbank-assets/investing/geared-investments/private/change-of-personal-name-form.pdf
Disallow: /business/pds/ADB2653.pdf
Disallow: /content/dam/commbank/corporate/pds/T661-Agency-and-Trustee-Services.PDF
Disal

sitemap.xml

present — 510 url(s)

head

title: CommBank - bank accounts, credit cards, home loans and insurance
description: CommBank offers personal banking, business solutions, institutional banking, company information, and more

social

no OpenGraph or Twitter meta tags found

fetched 2026-06-04T04:39:14.989Z

web-surface

info

Open standalone →

inspecting web surface…

dnssec

low

Open standalone →

DNSSEC not configured — no DS or DNSKEY records found

Why it matters: DNSSEC cryptographically signs DNS responses, blocking cache-poisoning attacks. US federal civilian agencies are required to enable it under OMB M-22-09 (NIST SC-20).

Recommendations

Enable DNSSEC in your DNS provider's control panel and add the resulting DS record at your registrar

enabled: no
DS records: —
DNSKEY records: —

fetched 2026-06-04T04:39:14.820Z

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

not applicable: no _mta-sts TXT record

Why it matters: MTA-STS forces inbound SMTP to use TLS and refuse downgraded connections. Without it, an in-path attacker can strip TLS and read mail in plaintext (SOC 2 CC6.7).

no _mta-sts TXT record

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

not applicable: no TLSRPT record

Why it matters: TLS-RPT publishes a reporting address for SMTP-TLS failures. Without it, downgrade attacks on inbound mail go unnoticed (SOC 2 CC7.2).

no TLSRPT record

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

low

Open standalone →

WHOIS expiry date unavailable — cannot assess renewal risk

Why it matters: Registrar and expiry tell auditors the domain is owned, current, and not about to lapse. An expired or about-to-expire domain fails business-continuity evidence (SOC 2 A1.2).

registrar: Corporation Service Company (Aust) Pty Ltd
created: —
expires: —
statuses: serverDeleteProhibited https://identitydigital.au/whois-status-codes#serverDeleteProhibited, serverRenewProhibited https://identitydigital.au/whois-status-codes#serverRenewProhibited, serverTransferProhibited https://identitydigital.au/whois-status-codes#serverTransferProhibited, serverUpdateProhibited https://identitydigital.au/whois-status-codes#serverUpdateProhibited

fetched 2026-06-04T04:39:15.368Z

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

check failed: crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

Why it matters: Every certificate issued for this domain is published in Certificate Transparency logs — including subdomains you may have forgotten. Unknown subdomains in CT are pre-disclosed attack surface (ISO 27001 A.8.16).

crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.