drizzle.team

15-check dossier · scoreboard above, section details below

Get a pack →

Scanning…

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

resolving mx…

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

resolving dmarc…

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

tracing redirects…

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

inspecting web surface…

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.

drizzle.team

15-check dossier · scoreboard above, section details below

Get a pack →

1 high-severity finding · 7 items need attention in total

Aggregate grade across 15 checks. Auditors typically flag any High-severity finding.

Pass: 8
Warn: 6
Fail: 1

What an auditor would flag first

high
DMARC
no DMARC record — spoofing risk
SOC 2 CC6.7ISO 27001 A.13.2.1
medium
SPF
~all softfail — receivers may still accept
SOC 2 CC6.7ISO 27001 A.13.2.1
medium
Security headers
4 security header(s) missing
SOC 2 CC6.6ISO 27001 A.14.1.2

Need this as an artifact your auditor can verify?

Your drizzle.team scan flagged 1 high and 2 medium and 4 low findings. A signed pack covers the apex plus up to 100 CT-discovered subdomains, Ed25519-signed and ISO-timestamped, delivered in 10–30 minutes.

Get a pack →See methodology See a sample$29

Scanning…

15-check summary

DNS recordsA/AAAA records present
MX5 MX record(s) present
SPF~all softfail — receivers may still accept
DMARCno DMARC record — spoofing risk
DKIMno DKIM selectors found — likely not configured
TLS certificatecert expires in 43 days
Redirect chainHTTPS served correctly
Security headers4 security header(s) missing
CORSCORS allows all origins (wildcard)
Web surfaceHTTPS surface reachable (robots ✓, sitemap ✓, title ✓)
MTA-STSnot applicable: no _mta-sts TXT record
TLS-RPTnot applicable: no TLSRPT record
DNSSECDNSSEC not configured — no DS or DNSKEY records found
WHOIScheck failed: TLD for "drizzle.team" not supported
Certificate Transparencycheck failed: crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

dns

info

Open standalone →

A/AAAA records present

Why it matters: Without authoritative A or AAAA records on the apex, the domain is unreachable. Missing baseline DNS shows up in vendor reviews as evidence of unmanaged infrastructure (SOC 2 CC6.6).

A: ttl=300 104.21.27.102
ttl=300 172.67.142.64
AAAA: ttl=300 2606:4700:3034::ac43:8e40
ttl=300 2606:4700:3031::6815:1b66
NS: ttl=86400 cloe.ns.cloudflare.com.
ttl=86400 west.ns.cloudflare.com.
SOA: ttl=1800 cloe.ns.cloudflare.com. dns.cloudflare.com. 2405637994 10000 2400 604800 1800
CAA: —
TXT: ttl=3600 "google-site-verification=Gwr7sbqKFL8jR7zBiE2cYz2eTWjEZ2o0eLnl6Hvg7xo"
ttl=3600 "google-site-verification=cFKHUVsIQacYx5kXMuY9ew2aoZjWUGaSMZHYgD0jDAs"
ttl=3600 "v=spf1 include:_spf.mx.cloudflare.net include:_spf.google.com ~all"

fetched 2026-06-04T02:36:43.285Z

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

5 MX record(s) present

Why it matters: MX records direct inbound mail. Misconfiguration silently breaks email delivery and lets attackers stand up parallel MX hosts for spoofing campaigns (ISO 27001 A.8.21).

pri=1 aspmx.l.google.com.
pri=5 alt1.aspmx.l.google.com.
pri=5 alt2.aspmx.l.google.com.
pri=10 alt3.aspmx.l.google.com.
pri=10 alt4.aspmx.l.google.com.

fetched 2026-06-04T02:36:43.150Z

mx

info

Open standalone →

resolving mx…

spf

medium

Open standalone →

~all softfail — receivers may still accept

Why it matters: SPF tells receiving servers which hosts may send mail for the domain. Without it, any sender can forge the envelope-from — the primary mechanism behind business-email-compromise (SOC 2 CC6.7).

Recommendations

Move to -all (hardfail) once your mail flow is confirmed — softfail gives no real protection

v=spf1 include:_spf.mx.cloudflare.net include:_spf.google.com ~all

v=spf1
include:_spf.mx.cloudflare.net
include:_spf.google.com
~all

fetched 2026-06-04T02:36:43.151Z

spf

info

Open standalone →

resolving spf…

dmarc

high

Open standalone →

no DMARC record — spoofing risk

Why it matters: DMARC binds SPF and DKIM into an enforceable policy (quarantine or reject) and surfaces spoofing attempts via aggregate reports. `p=none` or absent means spoofing succeeds silently (SOC 2 CC6.7).

Recommendations

Publish a DMARC TXT record at _dmarc.<domain>: v=DMARC1; p=none; rua=mailto:dmarc@<domain>
Start with p=none to collect reports, then move to p=quarantine and finally p=reject

no DMARC record

dmarc

info

Open standalone →

resolving dmarc…

dkim

low

Open standalone →

no DKIM selectors found — likely not configured

Why it matters: DKIM signs outbound mail so receivers can detect tampering. Missing selectors or rotated-away keys break DMARC alignment and let receivers downgrade trust (ISO 27001 A.8.24).

Recommendations

Enable DKIM signing in your mail provider and publish the provided TXT record
Common selectors: google._domainkey, selector1._domainkey (Microsoft), mail._domainkey

no DKIM record on probed selectors (default, google, k1, selector1, selector2, mxvault)

dkim

info

Open standalone →

probing dkim selectors…

tls

low

Open standalone →

cert expires in 43 days

Why it matters: A valid current TLS certificate is the baseline for data in transit. Expiry, weak chain, or hostname mismatch break HTTPS and fail PCI 4.2.1 / SOC 2 CC6.1.

Recommendations

Schedule certificate renewal — consider enabling auto-renewal

subject cn:: drizzle.team
issuer:: WE1 / Google Trust Services
valid:: Apr 18 15:12:55 2026 GMT → Jul 17 16:12:54 2026 GMT
authorized:: yes
sha256:: A3:B0:83:D4:F8:60:B6:B1:6D:00:C2:53:8C:35:53:77:3F:2F:8C:D7:92:32:55:96:2D:C7:D4:FA:A9:92:6F:C8
sans: drizzle.team

fetched 2026-06-04T02:36:43.195Z

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

HTTPS served correctly

Why it matters: Bare HTTP requests must redirect to HTTPS without dropping the user mid-chain. Plain-text fallback or open redirects fail PCI 4.2.1 and feed phishing chains (SOC 2 CC6.6).

final status: 200 · 1 hop

[200] https://drizzle.team/

fetched 2026-06-04T02:36:43.257Z

redirects

info

Open standalone →

tracing redirects…

headers

medium

Open standalone →

4 security header(s) missing

Why it matters: Security headers — HSTS, CSP, X-Frame-Options, Referrer-Policy — defend against XSS, clickjacking, and downgrade attacks. Absent headers map directly to OWASP ASVS V14 findings (ISO 27001 A.8.23).

Recommendations

Add response header — Strict-Transport-Security: max-age=15552000; includeSubDomains
Add response header — Content-Security-Policy: default-src 'self' (tune per app)
Add response header — X-Frame-Options: DENY (or SAMEORIGIN if framing is intended)
Add permissions-policy response header

final url: https://drizzle.team/

security headers

strict-transport-security: —
content-security-policy: —
x-frame-options: —
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
permissions-policy: —

other headers

access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
cache-control: public, max-age=0, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: a0638d31fcd3d6a5-IAD
connection: keep-alive
content-encoding: br
content-type: text/html; charset=utf-8
date: Thu, 04 Jun 2026 02:36:43 GMT
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=UzoMWFOgI0rpBuVfRtzBuLZB1kBFPzIDvQVDY9Kue8%2FbhoIxzTWSZJtYOnQPWp7c18qKwcAalBLz8jfWJ77AZs77%2BrF8Js8lVcR%2Fh42kFVnjjv4p2x80l3nSWgnje%2FY%3D"}]}
server: cloudflare
transfer-encoding: chunked
vary: accept-encoding

fetched 2026-06-04T02:36:43.251Z

headers

info

Open standalone →

fetching headers…

cors

low

Open standalone →

CORS allows all origins (wildcard)

Why it matters: Overly permissive CORS (wildcard with credentials, or reflected origin) lets any origin read authenticated responses from this domain. OWASP A05 misconfiguration territory (NIST AC-4).

Recommendations

Restrict Access-Control-Allow-Origin to specific trusted origins if this API is not fully public

origin: https://domainposture.com
method: GET
preflight status: 405

access-control-* headers

access-control-allow-origin: *
access-control-allow-methods: —
access-control-allow-headers: —
access-control-allow-credentials: —
access-control-max-age: —
access-control-expose-headers: —

fetched 2026-06-04T02:36:43.246Z

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

HTTPS surface reachable (robots ✓, sitemap ✓, title ✓)

Why it matters: Public files — robots.txt, sitemap.xml, head meta — are what attackers see first during reconnaissance. Misadvertised paths, stale sitemaps, and verbose generators leak more than intended (ISO 27001 A.8.9).

robots.txt

present

<!DOCTYPE html>
<html lang="en">
	<head>
		<meta charset="UTF-8">
		<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1">
		<link rel="icon" type="image/svg+xml" href="/favicon.svg">
		<meta name="generator" content="Astro v2.10.15">
		<meta name="description" content="Hey! We're Drizzle Team.">
		<script defer data-api="https://23ba6c8a-70f3-4ba6-a654-7777260b7c39-analytic-worker.lunaxodd.workers.dev/events" data-site-id="drizzle.team" src="https://pub-ee29bf8321df42aa9d18950bcad06caf.r2.dev/tracker.js">
		</script>
		<script defer data-site-id="drizzle.team" src="https://assets.onedollarstats.com/tracker.js"> 
		</script>
		<title>Drizzle Team</title>
	<link rel="stylesheet" href="/_astro/index.c1d214f5.css" /><script type="module" src="/_astro/hoisted.ef30dbe1.js"></script></head>
	<body>
		<div>
			<header class="_header_ywggq_1">
				<div class="_content_ywggq_8">
					<div class="_topside_ywggq_55">
						<div class="_leftside_ywggq_63">
							<div class="_avatars_ywggq_69">
								<a rel="nofollow" class="_first-avatar_ywggq_82" href="https://twitter.com/andrii_sherman" aria-label="andrii_sherman" target="_blank">
  <img class="_avatar_1u2ds_1" src="data:image/jpeg;base64,/9j/4AAQSkZJRgABAQAAAQABAAD/2wBDAAMCAgMCAgMDAwMEAwMEBQgFBQQEBQoHBwYIDAoMDAsKCwsNDhIQDQ4RDgsLEBYQERMUFRUVDA8XGBYUGBIUFRT/2wBDAQMEBAUEBQkFBQkUDQsNFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBT/wgARCABQAFADAREAAhEBAxEB/8QAHQAAAgIDAQEBAAAAAAAAAAAABwgDBgQFCQECAP/EABQBAQAAAAAAAAAAAAAAAAAAAAD/2gAMAwEAAhADEAAAADQZRMSHhAYhgGkKmGMlAYJaXANI0RgGlKmF8qAvI4QiQlJ0nD6aUqYYQWAQGNFRE+G0HWNOVQL5EUMF5XxHRgx9TTFVC8SmMUETEXU6FhzNKVUMJMQFbOYJdB6izGlKqGEAwmY94OBWQFDKDeH2DEQU9CwW4AxoCUmOgotQDjMID8fJAeGEMUf/xAA3EAABAwMDAgQFAgILAAAAAAABAgMEAAURBgchCBITMUFhFCIyUYFicUKxCRUXM0NFUlNygpH/2gAIAQEAAT8AjQ0tJwBSGeKbb+WggHPI4oIBFOtU61Uhrg1OZ+U1eGR2LBFIRTaK6ut6Zu0GgGRZlhq9XRZaZe/2UD6lj38gK0tet3pbX9fwDqR55wlz4ouuKQsfftJwaj9ZG4GlmUCeluW4jhYfQUOn962l69dN6vkxLXqWC7ZLg8tLSZKCFxyScc+qaJS82FoIWhQyFA5BFPo+qpqOFVeUcKFIbrcjciBtvFiybgrsYdz2kg9qlApHaT/DwScmo0m3dYm+1pgCM65pWwIMp8Ot4DnPCPfuIT7EAirpoa02q2pjtoS2ylICQkYA9gK6tdvLWUPvRWAgt5IUkY5py2vwnnAMEo5/FdD+4T+stoW7ZLIW7ZFCIhfqW/NOafHnU1PnV4R9VIaFdSVpiytt5kt+K/Mei/3TMb63O4juT5HjgE/tXQPNFmjbg3l5uQjEllnMRnxnMgOEISmt499V6T2mgy3mFquk+4NwoxeYSlwlfqoDjiupa5BqM3bPjblLuqjlxyXES005wDhJAFXY/D3QeKAkODtOfIV/R2a5ZYlao0u+G0F4onMOkgKUfoKMU/61MHCqu4PzUirla414gvw5bfix30FtaclJKSCDgjkfiunza6w7Jva5hRVuG2SprUuOwvlSApPaGwfMjuBwa62LsiM/o1DcSS/FjyHJT7CIqlNccAdwGOa3eudv/sqYvqWh3Too8LxwC6j9OfuPI1qmMiXHS+cBwklKPvXQTtE7fNUS9bTmkG128rjRQsZLj/BKh/xFP+Rqb9Jq7eSqTSKeRG+OZRIX8OJRSwH0Y70r5KCMjHB8s+prdy2zLBt4IC7Y7e5DK0hU9y8vodkIAwSpsJ7QT7cc8Ct2rwxp7ZfTGjFzHJ18Mp2bJWvjwkHOE1qCQ01Lg+OHTHCVhZYOFZxwAf3roy0KvSu0sOW7FlQzPHjJakuqPB/iCDwju86f9anHAVV4PyKpukCp9vZuMZTL47kEhQ+4IOQR7gitz9Y3l3Qcp2y2pi/ulKmm3WHU5SUkgk54/wDK1nb9QzdXSm7wy8Ls8orWlwYwPb2FdO26Vm2j1VNRqi1onWqcENuuFkOLjlJJCwk+Y+4HNaD3k0TuS2pvTN/hz3W05VEBLbyB7tqAVj8U+rzqb5Kq7n5TQcSkEkhKQMkmt3utLQ22IfhW58aqvaMj4WA4PBbP63uQP2Tk1ud1c7hbqOPRXLobFZ3f8vteWgU54C1/Ur35xXTNe0TdjNLCChp5tiGhhxpCgQVoHhucj9aTW5G3799167enIaIngtqAyOVD7VuZYrfb7s7OlrEeIjuyPVZ/0pHqaNxkNXUT4rrkOQHe5pxhZSpvzxhQ5BFbTdcuptJNMW7VzB1PbUYQJYIRMQP38nPzg+9aJ3a0tulazM07dWpgAy5HPyPNey0HkVeFfKquubeh3TFgY0RbHyxMuzBenOt/UiPnAR/3IVn2TQUgktqR3rWAlB7sdp7gc+/AI/NMpA8ZSgoE/RW0vUhqvZJD8WyyY9xtj6+9yDNQpTWfIlBBCkkir51uaiuzEjw7BBZlOJ7A86+46ED2Tx/OtT6uumrpLku7SPHX/hpA7UI8+EpHH8z70E/Oyj7gmvh1uLDaU/OryB4zmrDqO6aMvce6WmY9b7jGUFNutnBHsR6g+oPBraXc8bq7cQLy4WxcBlia23wEvJ8+PQEYUB9lV1i3t6+7+amPK48IMwmlDy+RlBUPwtZorJ+ZP1AYH7ngUVMoiR2m2exxAPiOdxPec8cenFHnI5zXwynGHHU48FCgkqJAyft581FEdy4MplFz4VCkqeDWO9ScjITnjOM4zxTjikTGwn5Q2glJHBHP3odjjrnc4GgEcZBOTk8cU+vvQFd5Vxx7e1dFt/dZvWpbOVqLL0ZEsI9ApCu0n8hYr//EABQRAQAAAAAAAAAAAAAAAAAAAGD/2gAIAQIBAT8ASf/EABQRAQAAAAAAAAAAAAAAAAAAAGD/2gAIAQMBAT8ASf/Z" alt="">
</a>
								<a rel="nofollow" class="_second-avatar_ywggq_86" href="https://twitter.com/bloberenober" aria-label="bloberenober" target="_blank">
  <img class="_avatar_1u2ds_1" src="data:image/jpeg;base64,/9j/4AAQSkZJRgABAQAAAQABAAD/2wBDAAMCAgMCAgMDAwMEAwMEBQgFBQQEB

sitemap.xml

present — 0 url(s)

head

title: Drizzle Team
description: Hey! We

social

no OpenGraph or Twitter meta tags found

fetched 2026-06-04T02:36:43.277Z

web-surface

info

Open standalone →

inspecting web surface…

dnssec

low

Open standalone →

DNSSEC not configured — no DS or DNSKEY records found

Why it matters: DNSSEC cryptographically signs DNS responses, blocking cache-poisoning attacks. US federal civilian agencies are required to enable it under OMB M-22-09 (NIST SC-20).

Recommendations

Enable DNSSEC in your DNS provider's control panel and add the resulting DS record at your registrar

enabled: no
DS records: —
DNSKEY records: —

fetched 2026-06-04T02:36:43.158Z

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

not applicable: no _mta-sts TXT record

Why it matters: MTA-STS forces inbound SMTP to use TLS and refuse downgraded connections. Without it, an in-path attacker can strip TLS and read mail in plaintext (SOC 2 CC6.7).

no _mta-sts TXT record

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

not applicable: no TLSRPT record

Why it matters: TLS-RPT publishes a reporting address for SMTP-TLS failures. Without it, downgrade attacks on inbound mail go unnoticed (SOC 2 CC7.2).

no TLSRPT record

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

check failed: TLD for "drizzle.team" not supported

Why it matters: Registrar and expiry tell auditors the domain is owned, current, and not about to lapse. An expired or about-to-expire domain fails business-continuity evidence (SOC 2 A1.2).

TLD for "drizzle.team" not supported

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

check failed: crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

Why it matters: Every certificate issued for this domain is published in Certificate Transparency logs — including subdomains you may have forgotten. Unknown subdomains in CT are pre-disclosed attack surface (ISO 27001 A.8.16).

crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.