europa.eu

15-check dossier · scoreboard above, section details below

Get a pack →

Scanning…

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

resolving mx…

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

resolving dmarc…

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

tracing redirects…

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

inspecting web surface…

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.

europa.eu

15-check dossier · scoreboard above, section details below

Get a pack →

1 high-severity finding · 5 items need attention in total

Aggregate grade across 15 checks. Auditors typically flag any High-severity finding.

Pass: 10
Warn: 4
Fail: 1

What an auditor would flag first

high
DMARC
no DMARC record — spoofing risk
SOC 2 CC6.7ISO 27001 A.13.2.1
low
DKIM
no DKIM selectors found — likely not configured
SOC 2 CC6.7
low
TLS certificate
cert expires in 71 days
SOC 2 CC6.6ISO 27001 A.13.1.1

Need this as an artifact your auditor can verify?

Your europa.eu scan flagged 1 high and 4 low findings. A signed pack covers the apex plus up to 100 CT-discovered subdomains, Ed25519-signed and ISO-timestamped, delivered in 10–30 minutes.

Get a pack →See methodology See a sample$29

Scanning…

15-check summary

DNS recordsA/AAAA records present
MX2 MX record(s) present
SPF-all hardfail — strict policy
DMARCno DMARC record — spoofing risk
DKIMno DKIM selectors found — likely not configured
TLS certificatecert expires in 71 days
Redirect chainHTTPS served correctly
Security headers3 security header(s) missing
CORSno CORS headers — cross-origin requests blocked by default
Web surfaceHTTPS surface reachable (robots ✓, sitemap ✗, title ✓)
MTA-STSnot applicable: no _mta-sts TXT record
TLS-RPTnot applicable: no TLSRPT record
DNSSECDNSSEC enabled — DS records present and chain validated (AD flag)
WHOISWHOIS expiry date unavailable — cannot assess renewal risk
Certificate Transparencycheck failed: crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

dns

info

Open standalone →

A/AAAA records present

Why it matters: Without authoritative A or AAAA records on the apex, the domain is unreachable. Missing baseline DNS shows up in vendor reviews as evidence of unmanaged infrastructure (SOC 2 CC6.6).

A: ttl=103 147.67.34.45
ttl=103 147.67.210.45
AAAA: ttl=300 2a01:7080:14:100::666:45
ttl=300 2a01:7080:24:100::666:45
NS: ttl=2289 ns1.bt.net.
ttl=2289 ans1.cw.net.
ttl=2289 ans2.cw.net.
ttl=2289 ns2eu.bt.net.
ttl=2289 ns1bru.europa.eu.
ttl=2289 ns1lux.europa.eu.
ttl=2289 ns2bru.europa.eu.
ttl=2289 ns2lux.europa.eu.
ttl=2289 ns3bru.europa.eu.
ttl=2289 ns3lux.europa.eu.
ttl=2289 ns4az1.europa.eu.
ttl=2289 ns4az2.europa.eu.
SOA: ttl=3600 ns1lux.europa.eu. snet.ec.europa.eu. 2028237596 3600 600 604800 1800
CAA: —
TXT: ttl=3600 "OSSRH-80601"
ttl=3600 "v=spf1 -all"
ttl=3600 "MS=ms27630582"
ttl=3600 "585pfn277okgsr6eqq5cp66kjc"
ttl=3600 "pnfm8n4m7lmp9d1pajbg9r75kg"
ttl=3600 "s5okgqb037ach4jjok6997blj7"
ttl=3600 "v1he8htvegs2u8pk09img207mh"
ttl=3600 "v1inc38ais4eor8dd2be59ap7v"
ttl=3600 "2y8xxj7q7dt3hxkh7zk1psbz59cz0q12"
ttl=3600 "yjh4bgq2dh9j194hj56s9ykgzf2nkh0g"
ttl=3600 "qjN-z-oil6MiHrTAeEPV9832p9-1ewZQs8CEFV8idpU"
ttl=3600 "35HsndgfVFDTReSgRvCjY3t5wlWjYsLllfUgRIpuDfk="
ttl=3600 "DN6kiCaIRHg011SWPd/y5wK0nF1lAB0vxkimTgK6YHQ="
ttl=3600 "WM+KEtZ8csQ1+YoyvDY+JophT0DYfsjJsYeNgkkxH8o="
ttl=3600 "nebYTcEacNoHj/N4hQzlTm96MnMnc30ILD2tZb2NsjM="
ttl=3600 "globalsign-domain-verification=1DAC9871AC98A3037988017AF30FA87F"
ttl=3600 "globalsign-domain-verification=B762A73F73CF60DC20EC10D5BCC1F69F"
ttl=3600 "globalsign-domain-verification=EE82C636B37B31C32CDDE24375C410A9"
ttl=3600 "google-site-verification=C0d5wiXRs2yokw7eUIL5Gz1825U9-M-HumwMZZYC7co"
"google-site-verification=OjhPSDIP2VIXIUH7hMv7CrLWwkyvnVgBdU-VcMHDoUI"

fetched 2026-06-04T04:45:35.450Z

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

2 MX record(s) present

Why it matters: MX records direct inbound mail. Misconfiguration silently breaks email delivery and lets attackers stand up parallel MX hosts for spoofing campaigns (ISO 27001 A.8.21).

pri=10 mxa-00244802.gslb.pphosted.com.
pri=10 mxb-00244802.gslb.pphosted.com.

fetched 2026-06-04T04:45:35.282Z

mx

info

Open standalone →

resolving mx…

spf

info

Open standalone →

-all hardfail — strict policy

Why it matters: SPF tells receiving servers which hosts may send mail for the domain. Without it, any sender can forge the envelope-from — the primary mechanism behind business-email-compromise (SOC 2 CC6.7).

v=spf1 -all

v=spf1
-all

fetched 2026-06-04T04:45:35.452Z

spf

info

Open standalone →

resolving spf…

dmarc

high

Open standalone →

no DMARC record — spoofing risk

Why it matters: DMARC binds SPF and DKIM into an enforceable policy (quarantine or reject) and surfaces spoofing attempts via aggregate reports. `p=none` or absent means spoofing succeeds silently (SOC 2 CC6.7).

Recommendations

Publish a DMARC TXT record at _dmarc.<domain>: v=DMARC1; p=none; rua=mailto:dmarc@<domain>
Start with p=none to collect reports, then move to p=quarantine and finally p=reject

no DMARC record

dmarc

info

Open standalone →

resolving dmarc…

dkim

low

Open standalone →

no DKIM selectors found — likely not configured

Why it matters: DKIM signs outbound mail so receivers can detect tampering. Missing selectors or rotated-away keys break DMARC alignment and let receivers downgrade trust (ISO 27001 A.8.24).

Recommendations

Enable DKIM signing in your mail provider and publish the provided TXT record
Common selectors: google._domainkey, selector1._domainkey (Microsoft), mail._domainkey

no DKIM record on probed selectors (default, google, k1, selector1, selector2, mxvault)

dkim

info

Open standalone →

probing dkim selectors…

tls

low

Open standalone →

cert expires in 71 days

Why it matters: A valid current TLS certificate is the baseline for data in transit. Expiry, weak chain, or hostname mismatch break HTTPS and fail PCI 4.2.1 / SOC 2 CC6.1.

Recommendations

Schedule certificate renewal — consider enabling auto-renewal

subject cn:: europa.eu
issuer:: GlobalSign Atlas R3 OV TLS CA 2025 Q3 / GlobalSign nv-sa
valid:: Aug 7 13:20:53 2025 GMT → Aug 14 13:20:53 2026 GMT
authorized:: yes
sha256:: 80:3E:D6:EC:7F:4F:1C:86:3B:9A:7B:1E:8C:51:F4:F7:1F:11:9E:07:1A:A2:B9:61:8F:B6:E2:9D:EE:23:00:59
sans: europa.eu
www.europa.eu

fetched 2026-06-04T04:45:35.430Z

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

HTTPS served correctly

Why it matters: Bare HTTP requests must redirect to HTTPS without dropping the user mid-chain. Plain-text fallback or open redirects fail PCI 4.2.1 and feed phishing chains (SOC 2 CC6.6).

final status: 200 · 2 hops

[301] https://europa.eu/
[200] https://european-union.europa.eu/select-language?destination=/node/1

fetched 2026-06-04T04:45:35.539Z

redirects

info

Open standalone →

tracing redirects…

headers

low

Open standalone →

3 security header(s) missing

Why it matters: Security headers — HSTS, CSP, X-Frame-Options, Referrer-Policy — defend against XSS, clickjacking, and downgrade attacks. Absent headers map directly to OWASP ASVS V14 findings (ISO 27001 A.8.23).

Recommendations

Add response header — Content-Security-Policy: default-src 'self' (tune per app)
Add response header — Referrer-Policy: strict-origin-when-cross-origin
Add permissions-policy response header

final url: https://european-union.europa.eu/select-language?destination=/node/1

security headers

strict-transport-security: max-age=31536000; includeSubDomains; preload;
content-security-policy: —
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
referrer-policy: —
permissions-policy: —

other headers

accept-ranges: bytes
age: 13
cache-control: public, max-age=300, s-maxage=300
connection: keep-alive
content-encoding: gzip
content-language: en
content-length: 3553
content-type: text/html; charset=UTF-8
date: Thu, 04 Jun 2026 04:45:22 GMT
expires: Sun, 19 Nov 1978 05:00:00 GMT
vary: Accept-Encoding
via: 1.1 d3cd567650e598ded7d5dd9266aa396c.cloudfront.net (CloudFront)
x-age: 43878
x-amz-cf-id: 7lwmAxEXaZdLiiIGYiOigCaoIFTPEz4jpo_tDOf7aYzVXls8_ryzhw==
x-amz-cf-pop: IAD89-P2
x-cache: Hit from cloudfront
x-fpfis: 29877489 27142356

fetched 2026-06-04T04:45:35.519Z

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

no CORS headers — cross-origin requests blocked by default

Why it matters: Overly permissive CORS (wildcard with credentials, or reflected origin) lets any origin read authenticated responses from this domain. OWASP A05 misconfiguration territory (NIST AC-4).

origin: https://domainposture.com
method: GET
preflight status: 301

access-control-* headers

access-control-allow-origin: —
access-control-allow-methods: —
access-control-allow-headers: —
access-control-allow-credentials: —
access-control-max-age: —
access-control-expose-headers: —

no access-control-* headers returned — site does not advertise CORS to this origin

fetched 2026-06-04T04:45:35.508Z

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

HTTPS surface reachable (robots ✓, sitemap ✗, title ✓)

Why it matters: Public files — robots.txt, sitemap.xml, head meta — are what attackers see first during reconnaissance. Misadvertised paths, stale sitemaps, and verbose generators leak more than intended (ISO 27001 A.8.9).

robots.txt

present

#EUROPA.EU ROBOTS.TXT

#BINGBOT
#IM0022076229 / IM0022372707
User-agent: bingbot
Disallow: /taxation_customs/dds2/ecics/

#ALL AGENTS
User-agent: *		# match any robot name
Disallow: /cgi-bin/	# don't allow robots into cgi-bin
Disallow: /eur-lex/	# don't index old Eurlex - 13/09/2006 Request from OPOCE (Mr O. Grossmann)
Disallow: /archives/	# don't index the archives

#IM0012723685 - 03/04/2014
Disallow: /youth/dissemination/		
Disallow: /youth/archive/
Disallow: /youth/includes/
Disallow: /youth/misc/
Disallow: /youth/modules/
Disallow: /youth/profiles/
Disallow: /youth/themes/
Disallow: /youth/cron.php
Disallow: /youth/install.php
Disallow: /youth/LICENSE.txt
Disallow: /youth/xmlrpc.php
Disallow: /youth/admin/
Disallow: /youth/comment/reply/
Disallow: /youth/filter/tips/
Disallow: /youth/node/add/
Disallow: /youth/search/
Disallow: /youth/user/register/
Disallow: /youth/user/password/
Disallow: /youth/user/login/
Disallow: /youth/user/logout/

#IM0017899419 - 20/06/2019
Crawl-delay: 10
Disallow: /capacity4dev/includes/
Disallow: /capacity4dev/misc/
Disallow: /capacity4dev/modules/
Disallow: /capacity4dev/profiles/
Disallow: /capacity4dev/scripts/
Disallow: /capacity4dev/themes/
Disallow: /capacity4dev/CHANGELOG.txt
Disallow: /capacity4dev/cron.php
Disallow: /capacity4dev/INSTALL.mysql.txt
Disallow: /capacity4dev/INSTALL.pgsql.txt
Disallow: /capacity4dev/INSTALL.sqlite.txt
Disallow: /capacity4dev/install.php
Disallow: /capacity4dev/INSTALL.txt
Disallow: /capacity4dev/LICENSE.txt
Disallow: /capacity4dev/MAINTAINERS.txt
Disallow: /capacity4dev/update.php
Disallow: /capacity4dev/UPGRADE.txt
Disallow: /capacity4dev/xmlrpc.php
Disallow: /capacity4dev/admin/
Disallow: /capacity4dev/comment/reply/
Disallow: /capacity4dev/filter/tips/
Disallow: /capacity4dev/node/add/
Disallow: /capacity4dev/search/
Disallow: /capacity4dev/user/register/
Disallow: /capacity4dev/user/password/
Disallow: /capacity4dev/user/login/
Disallow: /capacity4dev/user/logout/
Disallow: /capacity4dev/results-reporting-eud-or-hq-unit
Disallow: /capacity4dev/eu-rfi
Disallow: /capacity4dev/results_reporting_2013-14
Disallow: /capacity4dev/results_reporting_2014-15
Disallow: /capacity4dev/?q=admin/
Disallow: /capacity4dev/?q=comment/reply/
Disallow: /capacity4dev/?q=filter/tips/
Disallow: /capacity4dev/?q=node/add/
Disallow: /capacity4dev/?q=search/
Disallow: /capacity4dev/?q=user/password/
Disallow: /capacity4dev/?q=user/register/
Disallow: /capacity4dev/?q=user/login/
Disallow: /capacity4dev/?q=user/logout/
Disallow: /capacity4dev/*/includes/
Disallow: /capacity4dev/*/misc/
Disallow: /capacity4dev/*/modules/
Disallow: /capacity4dev/*/profiles/
Disallow: /capacity4dev/*/scripts/
Disallow: /capacity4dev/*/themes/
Disallow: /capacity4dev/*/CHANGELOG.txt
Disallow: /capacity4dev/*/cron.php
Disallow: /capacity4dev/*/INSTALL.mysql.txt
Disallow: /capacity4dev/*/INSTALL.pgsql.txt
Disallow: /capacity4dev/*/INSTALL.sqlite.txt
Disallow: /capacity4dev/*/install.php
Disallow: /capacity4dev/*/INSTALL.txt
Disallow: /capacity4dev/*/LICENSE.txt
Disallow: /capacity4dev/*/MAINTAINERS.txt
Disallow: /capacity4dev/*/update.php
Disallow: /capacity4dev/*/UPGRADE.txt
Disallow: /capacity4dev/*/xmlrpc.php
Disallow: /capacity4dev/*/admin/
Disallow: /capacity4dev/*/comment/reply/
Disallow: /capacity4dev/*/filter/tips/
Disallow: /capacity4dev/*/node/add/
Disallow: /capacity4dev/*/search/
Disallow: /capacity4dev/*/user/register/
Disallow: /capacity4dev/*/user/password/
Disallow: /capacity4dev/*/user/login/
Disallow: /capacity4dev/*/user/logout/
Disallow: /capacity4dev/*/?q=admin/
Disallow: /capacity4dev/*/?q=comment/reply/
Disallow: /capacity4dev/*/?q=filter/tips/
Disallow: /capacity4dev/*/?q=node/add/
Disallow: /capacity4dev/*/?q=search/
Disallow: /capacity4dev/*/?q=user/password/
Disallow: /capacity4dev/*/?q=user/register/
Disallow: /capacity4dev/*/?q=user/login/
Disallow: /capacity4dev/*/?q=user/logout/
Disallow: /capacity4dev/flag/
Disallow: /capacity4dev/?q=flag/
Disallow: /capacity4dev/*/flag/
Disallow: /capacity4dev/capacity4dev/flag/
Disallow: /capacity4dev/*/?q=flag/
Disallow: /capa

sitemap.xml

absent

head

title: Language selection | European Union
description: Discover how the EU functions, its principles, priorities; find out about its history and member states; learn about its legal basis and your EU rights.

social

og:determiner: auto
og:site_name: European Union
og:type: website
og:url: https://european-union.europa.eu/index_en
og:title: Your gateway to the EU, News, Highlights | European Union
og:description: Discover how the EU functions, its principles, priorities; find out about its history and member states; learn about its legal basis and your EU rights.
og:image: https://european-union.europa.eu/sites/default/files/styles/ewcms_metatag_image/public/2025-02/normal-reproduction-high-resolution.jpg?h=7c494902&itok=y4KszoLJ
twitter:card: summary_large_image
twitter:description: Discover how the EU functions, its principles, priorities; find out about its history and member states; learn about its legal basis and your EU rights.
twitter:title: Your gateway to the EU, News, Highlights | European Union
twitter:image: https://european-union.europa.eu/sites/default/files/styles/ewcms_metatag_image/public/2025-02/normal-reproduction-high-resolution.jpg?h=7c494902&itok=y4KszoLJ

fetched 2026-06-04T04:45:36.578Z

web-surface

info

Open standalone →

inspecting web surface…

dnssec

info

Open standalone →

DNSSEC enabled — DS records present and chain validated (AD flag)

Why it matters: DNSSEC cryptographically signs DNS responses, blocking cache-poisoning attacks. US federal civilian agencies are required to enable it under OMB M-22-09 (NIST SC-20).

enabled: yes
DS records: 6250 RSASHA256 2 0186eeff28a83d2c950963ceef2f2070dc0885ac8ad7106b03a9741c25dc6b82, 14845 RSASHA256 2 9ef3c28f5b3a3d33756d61715b1bdbdbb07e0555598d30256d1f2b7195324846, DS RSASHA256 2 86400 1780899646 1780292611 47565 eu. csGqRdLkbrZlJac47AQ3/pI23qWBV0/6agrA539gAAcVln2UxLd95cZUptKobj4b0Ki8DpurVJc8M1Hvb1i4wXaL26d6LvwphpMIi7RDMCKzfvAWAQ+DRIotxcDw2E/w6RNlZ+1eIN4JwiIPN+pxfp1168wKeg06C2av1GB8MSc=
DNSKEY records: 5 key(s)

fetched 2026-06-04T04:45:35.252Z

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

not applicable: no _mta-sts TXT record

Why it matters: MTA-STS forces inbound SMTP to use TLS and refuse downgraded connections. Without it, an in-path attacker can strip TLS and read mail in plaintext (SOC 2 CC6.7).

no _mta-sts TXT record

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

not applicable: no TLSRPT record

Why it matters: TLS-RPT publishes a reporting address for SMTP-TLS failures. Without it, downgrade attacks on inbound mail go unnoticed (SOC 2 CC7.2).

no TLSRPT record

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

low

Open standalone →

WHOIS expiry date unavailable — cannot assess renewal risk

Why it matters: Registrar and expiry tell auditors the domain is owned, current, and not about to lapse. An expired or about-to-expire domain fails business-continuity evidence (SOC 2 A1.2).

registrar: ClearMedia NV
created: —
expires: —
statuses: —

fetched 2026-06-04T04:45:35.407Z

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

check failed: crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

Why it matters: Every certificate issued for this domain is published in Certificate Transparency logs — including subdomains you may have forgotten. Unknown subdomains in CT are pre-disclosed attack surface (ISO 27001 A.8.16).

crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.