fidelity.com

15-check dossier · scoreboard above, section details below

embed badge

Markdown

[![Domain posture](https://www.domainposture.com/d/fidelity.com/badge.svg)](https://www.domainposture.com/d/fidelity.com)

HTML

<a href="https://www.domainposture.com/d/fidelity.com"><img src="https://www.domainposture.com/d/fidelity.com/badge.svg" alt="Domain posture" /></a>

Scanning…

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

resolving mx…

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

resolving dmarc…

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

tracing redirects…

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

inspecting web surface…

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.

fidelity.com

15-check dossier · scoreboard above, section details below

Get a pack →

embed badge

Markdown

[![Domain posture](https://www.domainposture.com/d/fidelity.com/badge.svg)](https://www.domainposture.com/d/fidelity.com)

HTML

<a href="https://www.domainposture.com/d/fidelity.com"><img src="https://www.domainposture.com/d/fidelity.com/badge.svg" alt="Domain posture" /></a>

A-

Audit-ready · 4 minor advisories

Aggregate grade across 15 checks. Auditors typically flag any High-severity finding.

Pass: 11
Warn: 4
Fail: 0

What an auditor would flag first

low
DKIM
2/6 DKIM selectors valid
SOC 2 CC6.7
low
Security headers
2 security header(s) missing
SOC 2 CC6.6ISO 27001 A.8.23
low
DNSSEC
DNSSEC not configured — no DS or DNSKEY records found
SOC 2 CC6.6ISO 27001 A.8.20

Need this as an artifact your auditor can verify?

Your fidelity.com scan flagged 4 low findings. A signed pack covers the apex plus up to 100 CT-discovered subdomains, Ed25519-signed and ISO-timestamped, delivered in 10–30 minutes.

Get a pack →See methodology See a sample$29

Scanning…

15-check summary

DNS recordsA/AAAA records present
MX1 MX record(s) present
SPF-all hardfail — strict policy
DMARCp=reject — strict policy
DKIM2/6 DKIM selectors valid
TLS certificatecert valid for 174 days
Redirect chainHTTPS served correctly
Security headers2 security header(s) missing
CORSno CORS headers — cross-origin requests blocked by default
Web surfaceHTTPS surface reachable (robots ✓, sitemap ✓, title ✓)
MTA-STSnot applicable: no _mta-sts TXT record
TLS-RPTnot applicable: no TLSRPT record
DNSSECDNSSEC not configured — no DS or DNSKEY records found
WHOISdomain expires in 73 days — renew soon
Certificate Transparencycheck failed: crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

dns

info

Open standalone →

A/AAAA records present

Why it matters: Without authoritative A or AAAA records on the apex, the domain is unreachable. Missing baseline DNS shows up in vendor reviews as evidence of unmanaged infrastructure (SOC 2 CC6.6).

A: ttl=20 23.212.0.104
ttl=20 23.212.0.110
AAAA: —
NS: ttl=3600 a2-65.akam.net.
ttl=3600 a8-64.akam.net.
ttl=3600 udns1.cscdns.net.
ttl=3600 udns2.cscdns.uk.
ttl=3600 a1-188.akam.net.
SOA: ttl=3600 a8-64.akam.net. fwis.fmr.com. 13629 300 900 4838400 3600
CAA: —
TXT: ttl=3600 "pardot_61712_*=d2ab3220a3c15a3c9764bc705dd401117f95a855d698f2b2d3a758507012466f"
ttl=3600 "google-site-verification=yt1lNuPjFTaCNX5FNks6zB1uCyeubgaujwzfkqzQzWk"
ttl=3600 "v=spf1 include:_fidelitynets.fmr.com include:_fidelitypartners-a.fidelity.com -all"
ttl=3600 "92a1QMpfM00Aigl/mLy07NM2nbqjWaXFRV/J9NyOrcpH3zsAOozhEiVdZ39pvYh0lgo/SdbmTl92ilugO18c1w=="
ttl=3600 "docusign=11de847a-3694-436c-b539-b2156b246a5b"
ttl=3600 "MS=ms52443120"
ttl=3600 "apple-domain-verification=g5E1fUMZqpLJLnET"
ttl=3600 "google-site-verification=wb5-HZE0toJ_WuU5-HV4pMwYEDbYjd5j7FpHxxnFU6g"
ttl=3600 "docusign=e81e1a6e-c7da-4f4d-a418-ccdcbb686da3"
ttl=3600 "yEAVaTpdrBW/skkemRPPn5/azrnZBA+v/XZ6bHGFoG/IEwUjlVhss5TC0M0ufUja9pNlyRxNclnxtV7Iio50xA=="
ttl=3600 "docker-verification=789887f6-0088-4722-b242-2fc6e0682f91"
ttl=3600 "pendo-domain-verification=OYxF_DuMhxV9S5NQFU77acVvFDM"
ttl=3600 "postman-domain-verification=3b0e71350416978902416243223b5761c215c5287a7556ecfe7413179890aa64"
ttl=3600 "U47lFyueWciuYOX19/uxiR+LLAQE5m2s7gsctaqOZw65StuGyFY+5ZesXSNf3nPcgRNCq1MXG0GclI9e+AidsA=="
ttl=3600 "figma-domain-verification=47768e9f59f45b6089143c70fcd9c46b5e1fb7378bf1c993d2d9eb723292c073-1716914961"

fetched 2026-06-17T08:27:25.976Z

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

1 MX record(s) present

Why it matters: MX records direct inbound mail. Misconfiguration silently breaks email delivery and lets attackers stand up parallel MX hosts for spoofing campaigns (ISO 27001 A.8.21).

pri=0 fidelity-com.mail.protection.outlook.com.

fetched 2026-06-17T08:27:25.972Z

mx

info

Open standalone →

resolving mx…

spf

info

Open standalone →

-all hardfail — strict policy

Why it matters: SPF tells receiving servers which hosts may send mail for the domain. Without it, any sender can forge the envelope-from — the primary mechanism behind business-email-compromise (SOC 2 CC6.7).

v=spf1 include:_fidelitynets.fmr.com include:_fidelitypartners-a.fidelity.com -all

v=spf1
include:_fidelitynets.fmr.com
include:_fidelitypartners-a.fidelity.com
-all

fetched 2026-06-17T08:27:25.973Z

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

p=reject — strict policy

Why it matters: DMARC binds SPF and DKIM into an enforceable policy (quarantine or reject) and surfaces spoofing attempts via aggregate reports. `p=none` or absent means spoofing succeeds silently (SOC 2 CC6.7).

v=DMARC1; p=reject; fo=1; rua=mailto:[email protected]; ruf=mailto:[email protected]; rf=afrf; pct=100

v=: DMARC1
p=: reject
fo=: 1
rua=: mailto:[email protected]
ruf=: mailto:[email protected]
rf=: afrf
pct=: 100

fetched 2026-06-17T08:27:25.972Z

dmarc

info

Open standalone →

resolving dmarc…

dkim

low

Open standalone →

2/6 DKIM selectors valid

Why it matters: DKIM signs outbound mail so receivers can detect tampering. Missing selectors or rotated-away keys break DMARC alignment and let receivers downgrade trust (ISO 27001 A.8.24).

Recommendations

Check the missing selectors in your DNS provider and re-add any removed records

default:: —
google:: —
k1:: —
selector1:: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAy1Ic+X7JT5Lkw6OYUnZPSW3IvzmslbOkTV3o7VQy0zA39DyYENKSz8ZEyytc4a2v0uHxevB5P6t8U/SGvS0sL+DDmo+xSN5Iex1tlguouymLcT3TPNXlrOeefrEnkh2OGxZrZYXH3mv80bf1qe9InzYpRciDUcVcJevbnISOkmsmpCcK2krJKvXMFPJWx4RTwT1oDpGqFoJKSyEOdF+pX5QyLd/dUaH7gujAkBJi7/LHtH4rVIEfm1/nTUDkmIZgEfHypunJpvd913UcE6SZL9g6iltNHkyfKqc5s5FmV1CbTbmqOGjwPDbX+yY3iC0DQv218PpnzQ+r0i8Ao9xBfQIDAQAB;
selector2:: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAspCwiEc10/wqLzFKYibikUMf3CJ2Xm6PMjn15k4UwWpDUIlGHrTAgrM5yeEag4kcaoFaG6xikIGxA3dX6QuYccWzr7hrjlG8kinyfuyPAd2XW+5X2VES23n1vuQ2Uq4flaU3NUjwLfmOWMcspSDXKg2I+D47wjI3MijYDZ+A+DWSQZztISs+gS0ymlzK0CMeeE9mwXqqoISzUvnGIIAXPICnzof9qrLQOkYCK/hkLUDCNTV0VJ6sJG5jEeqPFjrpaHCkWiNRoE3WMPAJkkrWslG4jmb4ftJ9K2QZo9Y77J6pStNbc6X0D1em5LW0BKnhppw+WLi7A0Kstexqi3L1rQIDAQAB;
mxvault:: —

fetched 2026-06-17T08:27:25.980Z

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

cert valid for 174 days

Why it matters: A valid current TLS certificate is the baseline for data in transit. Expiry, weak chain, or hostname mismatch break HTTPS and fail PCI 4.2.1 / SOC 2 CC6.1.

subject cn:: apex.fidelity.com
issuer:: DigiCert Global G2 TLS RSA SHA256 2020 CA1 / DigiCert Inc
valid:: Nov 15 00:00:00 2025 GMT → Dec 8 23:59:59 2026 GMT
authorized:: yes
sha256:: 2B:92:A2:60:18:0E:9A:85:40:DB:5B:E5:4F:50:11:E3:7C:23:7C:88:A5:5E:4B:E5:AE:20:93:86:44:1B:3D:D3
sans: apex.fidelity.com
apexdns.fidelity.com
fidelity.com
www.fidelity.com
activetraderpro.com
www.activetraderpro.com

fetched 2026-06-17T08:27:26.381Z

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

HTTPS served correctly

Why it matters: Bare HTTP requests must redirect to HTTPS without dropping the user mid-chain. Plain-text fallback or open redirects fail PCI 4.2.1 and feed phishing chains (SOC 2 CC6.6).

final status: 200 · 2 hops

[301] https://fidelity.com/
[200] https://www.fidelity.com/

fetched 2026-06-17T08:27:27.080Z

redirects

info

Open standalone →

tracing redirects…

headers

low

Open standalone →

2 security header(s) missing

Why it matters: Security headers — HSTS, CSP, X-Frame-Options, Referrer-Policy — defend against XSS, clickjacking, and downgrade attacks. Absent headers map directly to OWASP ASVS V14 findings (ISO 27001 A.8.23).

Recommendations

Add response header — Content-Security-Policy: default-src 'self' (tune per app)
Add permissions-policy response header

final url: https://www.fidelity.com/

security headers

strict-transport-security: max-age=31536000; includeSubDomains
content-security-policy: —
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
referrer-policy: no-referrer-when-downgrade
permissions-policy: —

other headers

cache-control: max-age=0, no-cache, no-store
connection: keep-alive
content-encoding: gzip
content-length: 2386
content-type: text/html; charset=utf-8
date: Wed, 17 Jun 2026 08:27:27 GMT
expires: Wed, 17 Jun 2026 08:27:27 GMT
fscalleeid: https-wwwcloud.fidelity.com-10000
fselapsedtime: 32101
fsreqid: REQ6a325a6e039cb7f196e695db88e9aa33
last-modified: Thu, 23 May 2024 20:30:39 GMT
p3p: CP="UNI DEM GOV FIN STA COM NAV PRE INT ONL CUR ADM DEV PSA PSD CUSi IVDi IVAi TELi CONi TAI OUR OTRi"
pragma: no-cache
server: Apache
set-cookie: bm_sz=7D9055C6D05218771D2178F5B8DE6815~YAAQJa3OF/muHIieAQAA40Gx1ADDPrLttJ+GN22bayn3c6G/oXNQXZh6quQXEcuSmB3X0U8HT2PYlkhAcps1sNMu7zFxIrRqlUAG6JMSwghM/yWjUmkkZFhbpbKWsyhUYewwItZO3Moa1ya52G0eI2hofBWpDV46Y16ZO5ONm27/RlVa96Td/OPVYQrv9oWhqmqlmQwSBCq6gYLCd5ba4ZPDu+V6vhkf8OWjgbnsY0AV4Du+J2Vo03gHOQ2zvEOY7I7Xso4wCJXzY/Y71Gnt58FhYDbPfvuYG0EFZfUzcmpzgMrTrdGvU0m40jNaKJrQ9xM7s78zOFW3X3Ug0gt8pEXLxm67tQwG1xOLqdFTvVc=~3225922~4470580; Domain=.fidelity.com; Path=/; Expires=Wed, 17 Jun 2026 12:27:26 GMT; Max-Age=14399; SameSite=None; Secure
vary: Accept-Encoding
x-akamai-transformed: 0 - 0 -

fetched 2026-06-17T08:27:27.101Z

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

no CORS headers — cross-origin requests blocked by default

Why it matters: Overly permissive CORS (wildcard with credentials, or reflected origin) lets any origin read authenticated responses from this domain. OWASP A05 misconfiguration territory (NIST AC-4).

origin: https://domainposture.com
method: GET
preflight status: 301

access-control-* headers

access-control-allow-origin: —
access-control-allow-methods: —
access-control-allow-headers: —
access-control-allow-credentials: —
access-control-max-age: —
access-control-expose-headers: —

no access-control-* headers returned — site does not advertise CORS to this origin

fetched 2026-06-17T08:27:25.992Z

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

HTTPS surface reachable (robots ✓, sitemap ✓, title ✓)

Why it matters: Public files — robots.txt, sitemap.xml, head meta — are what attackers see first during reconnaissance. Misadvertised paths, stale sitemaps, and verbose generators leak more than intended (ISO 27001 A.8.9).

robots.txt

present

# robots.txt file for Fidelity
# mail [email protected]
User-agent: IDentity
Disallow:


User-agent: AdsBot-Google
Allow:


User-agent: * 
Disallow: /accounts/accountopening
Disallow: /accounts/activation
Disallow: /accounts/activetrader/images
Disallow: /accounts/mailings/content
Disallow: /accounts/mailings/images
Disallow: /accounts/myportfolio
Disallow: /accounts/myprofile
Disallow: /accounts/pdf/inheritors_retirement_plan_acctount_app.pdf
Disallow: /accounts/pdf/np_application.pdf
Disallow: /accounts/pdf/rolliraapp.pdf 
Disallow: /accounts/pdf/trust_application.pdf
Disallow: /accounts/services/content/accept.html   
Disallow: /accounts/services/content/beneficiaryhelp.html 
Disallow: /accounts/services/content/checkcrdupdt.shtml   
Disallow: /accounts/services/content/custconfirm.shtml   
Disallow: /accounts/services/content/customer_chat.shtml
Disallow: /accounts/services/content/deactiveconfirm.shtml 
Disallow: /accounts/services/content/IMContactUsOffHours.shtml
Disallow: /accounts/services/content/IMContactUsUnavailable.shtml 
Disallow: /accounts/services/content/IMFILIOffHours.html  
Disallow: /accounts/services/content/IMFILIUnavail.html   
Disallow: /accounts/services/content/IMRetailOffHours.html 
Disallow: /accounts/services/content/IMRetailUnavail.html  
Disallow: /accounts/services/content/IMVisitorChat.shtml  
Disallow: /accounts/services/content/invobjpopup.html   
Disallow: /accounts/services/content/invobjpopupoptions.html  
Disallow: /accounts/services/content/keoghbrokappdl.html
Disallow: /accounts/services/content/keoghbrokconsent.html
Disallow: /accounts/services/content/mbnabuffer.html
Disallow: /accounts/services/content/nobeneficiaries.shtml  
Disallow: /accounts/services/content/norelationship.shtml 
Disallow: /accounts/services/content/probatepopup.html
Disallow: /accounts/services/content/relinquish.html   
Disallow: /accounts/services/content/replyconfirm.shtml    
Disallow: /accounts/services/content/restricted529.shtml     
Disallow: /accounts/services/content/restrictedneither.shtml 
Disallow: /accounts/services/content/restrictedpas.shtml   
Disallow: /accounts/services/content/rolloverirasuggestion.shtml   
Disallow: /accounts/services/content/sigguarpopup.html
Disallow: /accounts/services/content/visitorconfirmnoacct.shtml 
Disallow: /accounts/services/content/visitorconfirmyesacct.shtml
Disallow: /accounts/services/images
Disallow: /accounts/services/open
Disallow: /common
Disallow: /configs
Disallow: /css
Disallow: /customeronly
Disallow: /error
Disallow: /fiibg
Disallow: /global/contact/
Disallow: /global/content/images
Disallow: /global/messages
Disallow: /global/search
Disallow: /global/whatsnew/images
Disallow: /global/whatsnew/whatsnew_toc.html
Disallow: /goto
Disallow: /help
Disallow: /images
Disallow: /include
Disallow: /include/toc/
Disallow: /java
Disallow: /js
Disallow: /lpp/component/tcm:526-276416-169031.comp
Disallow: /misc/ekits/pdf/hsa_app.pdf 
Disallow: /misc/ekits/pdf/mutual_fund.pdf
Disallow: /myfidelity/atn/images
Disallow: /myfidelity/daily
Disallow: /myfidelity/InsideFidelity/NewsCenter/mediadocs/media_kit_toc.shtml
Disallow: /nav
Disallow: /news/calendars
Disallow: /news/publications/images
Disallow: /planning/charitable  
Disallow: /planning/college/calculator_toc.html
Disallow: /planning/college/college_toc.shtml
Disallow: /planning/college/content/thank_you.html
Disallow: /planning/college/images
Disallow: /planning/images
Disallow: /planning/investment/images
Disallow: /planning/investment/investment_toc.html
Disallow: /planning/retirement/images
Disallow: /planning/tax/images
Disallow: /products/annuities/content/apdownload.html
Disallow: /products/annuities/content/callme.html
Disallow: /products/annuities/content/callmeconfirm.html   
Disallow: /products/annuities/content/free_pop.html
Disallow: /products/annuities/content/funds_pop.html          
Disallow: /products/annuities/content/getconsent.html
Disallow: /products/annuities/content/how_pop.html            
Disallow: /products/annuities/content/nyprosconsent.html  
Disallow: /products/annuities

sitemap.xml

present — 2 url(s)

head

title: Fidelity International Usage Agreement
description

social

no OpenGraph or Twitter meta tags found

fetched 2026-06-17T08:27:27.072Z

web-surface

info

Open standalone →

inspecting web surface…

dnssec

low

Open standalone →

DNSSEC not configured — no DS or DNSKEY records found

Why it matters: DNSSEC cryptographically signs DNS responses, blocking cache-poisoning attacks. US federal civilian agencies are required to enable it under OMB M-22-09 (NIST SC-20).

Recommendations

Enable DNSSEC in your DNS provider's control panel and add the resulting DS record at your registrar

enabled: no
DS records: —
DNSKEY records: —

fetched 2026-06-17T08:27:25.994Z

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

not applicable: no _mta-sts TXT record

Why it matters: MTA-STS forces inbound SMTP to use TLS and refuse downgraded connections. Without it, an in-path attacker can strip TLS and read mail in plaintext (SOC 2 CC6.7).

no _mta-sts TXT record

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

not applicable: no TLSRPT record

Why it matters: TLS-RPT publishes a reporting address for SMTP-TLS failures. Without it, downgrade attacks on inbound mail go unnoticed (SOC 2 CC7.2).

no TLSRPT record

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

low

Open standalone →

domain expires in 73 days — renew soon

Why it matters: Registrar and expiry tell auditors the domain is owned, current, and not about to lapse. An expired or about-to-expire domain fails business-continuity evidence (SOC 2 A1.2).

Recommendations

Enable auto-renewal at your registrar to avoid accidental expiry

registrar: CSC Corporate Domains, Inc.
created: 1996-08-31T04:00:00Z
expires: 2026-08-30T04:00:00Z
statuses: clientTransferProhibited https://icann.org/epp#clientTransferProhibited, serverDeleteProhibited https://icann.org/epp#serverDeleteProhibited, serverTransferProhibited https://icann.org/epp#serverTransferProhibited, serverUpdateProhibited https://icann.org/epp#serverUpdateProhibited

fetched 2026-06-17T08:27:26.994Z

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

check failed: crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

Why it matters: Every certificate issued for this domain is published in Certificate Transparency logs — including subdomains you may have forgotten. Unknown subdomains in CT are pre-disclosed attack surface (ISO 27001 A.8.16).

crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.