geekflare.com

15-check dossier · scoreboard above, section details below

Get a pack →

Scanning…

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

resolving mx…

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

resolving dmarc…

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

tracing redirects…

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

inspecting web surface…

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.

geekflare.com

15-check dossier · scoreboard above, section details below

Get a pack →

Mostly compliant · 5 items need attention

Aggregate grade across 15 checks. Auditors typically flag any High-severity finding.

Pass: 10
Warn: 5
Fail: 0

What an auditor would flag first

medium
SPF
~all softfail — receivers may still accept
SOC 2 CC6.7ISO 27001 A.13.2.1
medium
DMARC
p=none — monitoring only, no enforcement
SOC 2 CC6.7ISO 27001 A.13.2.1
low
DKIM
1/6 DKIM selectors valid
SOC 2 CC6.7

Need this as an artifact your auditor can verify?

Your geekflare.com scan flagged 2 medium and 3 low findings. A signed pack covers the apex plus up to 100 CT-discovered subdomains, Ed25519-signed and ISO-timestamped, delivered in 10–30 minutes.

Get a pack →See methodology See a sample$29

Scanning…

15-check summary

DNS recordsA/AAAA records present
MX5 MX record(s) present
SPF~all softfail — receivers may still accept
DMARCp=none — monitoring only, no enforcement
DKIM1/6 DKIM selectors valid
TLS certificatecert expires in 56 days
Redirect chainHTTPS served correctly
Security headers4 security header(s) missing
CORSno CORS headers — cross-origin requests blocked by default
Web surfaceHTTPS surface reachable (robots ✓, sitemap ✗, title ✓)
MTA-STSnot applicable: no _mta-sts TXT record
TLS-RPTnot applicable: no TLSRPT record
DNSSECDNSSEC enabled — DS records present and chain validated (AD flag)
WHOISdomain registered until 2028-01-07
Certificate Transparencycheck failed: crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

dns

info

Open standalone →

A/AAAA records present

Why it matters: Without authoritative A or AAAA records on the apex, the domain is unreachable. Missing baseline DNS shows up in vendor reviews as evidence of unmanaged infrastructure (SOC 2 CC6.6).

A: ttl=300 172.66.40.168
ttl=300 172.66.43.88
AAAA: ttl=300 2606:4700:3108::ac42:28a8
ttl=300 2606:4700:3108::ac42:2b58
NS: ttl=86400 ck.geekflare.com.
ttl=86400 nk.geekflare.com.
SOA: ttl=1800 ck.geekflare.com. dns.cloudflare.com. 2405973686 10000 2400 604800 1800
CAA: ttl=300 \# 17 00 05 69 73 73 75 65 61 6d 61 7a 6f 6e 2e 63 6f 6d
ttl=300 \# 20 00 05 69 73 73 75 65 61 6d 61 7a 6f 6e 61 77 73 2e 63 6f 6d
ttl=300 \# 22 00 05 69 73 73 75 65 61 6d 61 7a 6f 6e 74 72 75 73 74 2e 63 6f 6d
ttl=300 \# 19 00 05 69 73 73 75 65 61 77 73 74 72 75 73 74 2e 63 6f 6d
ttl=300 \# 19 00 05 69 73 73 75 65 63 6f 6d 6f 64 6f 63 61 2e 63 6f 6d
ttl=300 \# 45 00 05 69 73 73 75 65 64 69 67 69 63 65 72 74 2e 63 6f 6d 3b 20 63 61 6e 73 69 67 6e 68 74 74 70 65 78 63 68 61 6e 67 65 73 3d 79 65 73
ttl=300 \# 22 00 05 69 73 73 75 65 6c 65 74 73 65 6e 63 72 79 70 74 2e 6f 72 67
ttl=300 \# 41 00 05 69 73 73 75 65 70 6b 69 2e 67 6f 6f 67 3b 20 63 61 6e 73 69 67 6e 68 74 74 70 65 78 63 68 61 6e 67 65 73 3d 79 65 73
ttl=300 \# 14 00 05 69 73 73 75 65 73 73 6c 2e 63 6f 6d
ttl=300 \# 23 00 09 69 73 73 75 65 77 69 6c 64 63 6f 6d 6f 64 6f 63 61 2e 63 6f 6d
ttl=300 \# 49 00 09 69 73 73 75 65 77 69 6c 64 64 69 67 69 63 65 72 74 2e 63 6f 6d 3b 20 63 61 6e 73 69 67 6e 68 74 74 70 65 78 63 68 61 6e 67 65 73 3d 79 65 73
ttl=300 \# 26 00 09 69 73 73 75 65 77 69 6c 64 6c 65 74 73 65 6e 63 72 79 70 74 2e 6f 72 67
ttl=300 \# 45 00 09 69 73 73 75 65 77 69 6c 64 70 6b 69 2e 67 6f 6f 67 3b 20 63 61 6e 73 69 67 6e 68 74 74 70 65 78 63 68 61 6e 67 65 73 3d 79 65 73
ttl=300 \# 18 00 09 69 73 73 75 65 77 69 6c 64 73 73 6c 2e 63 6f 6d
TXT: ttl=300 "urabin-verify-abc"
ttl=300 "firebase=geek-flare---tools"
ttl=300 "firebase=geekflare-production"
ttl=300 "firebase=geekflare-ai-auth-prod"
ttl=300 "admitad-verification: 91fa860493"
ttl=300 "yandex-verification: 42f25bad396e79f5"
ttl=300 "brevo-code:642dd9bdd25d0e63013fbd24729e722c"
ttl=300 "Sendinblue-code:642dd9bdd25d0e63013fbd24729e722c"
ttl=300 "openai-domain-verification=dv-mkiV9KMU5V7LdupiEzNKimsH"
ttl=300 "v=spf1 include:_spf.google.com include:_spf.firebasemail.com ~all"
ttl=300 "google-site-verification=7QXbgb492Y5NVyWzSAgAScfUV3XIAGTKKZfdpCvcaGM"
ttl=300 "google-site-verification=KiMDhEe-34WGA-tTFcQr2Q0Yj-FTdcJTvEfvBIvSQZ8"
ttl=300 "google-site-verification=MRSwa454qay1S6pwwixzoiZl08kfJfkhiQIslhok3-A"
ttl=300 "ahrefs-site-verification_8eefbd2fe43a8728b6fd14a393e2aff77b671e41615d2c1c6fc365ec33a4d6d0"

fetched 2026-06-04T01:32:49.752Z

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

5 MX record(s) present

Why it matters: MX records direct inbound mail. Misconfiguration silently breaks email delivery and lets attackers stand up parallel MX hosts for spoofing campaigns (ISO 27001 A.8.21).

pri=1 aspmx.l.google.com.
pri=5 alt1.aspmx.l.google.com.
pri=5 alt2.aspmx.l.google.com.
pri=10 alt3.aspmx.l.google.com.
pri=10 alt4.aspmx.l.google.com.

fetched 2026-06-04T01:32:49.746Z

mx

info

Open standalone →

resolving mx…

spf

medium

Open standalone →

~all softfail — receivers may still accept

Why it matters: SPF tells receiving servers which hosts may send mail for the domain. Without it, any sender can forge the envelope-from — the primary mechanism behind business-email-compromise (SOC 2 CC6.7).

Recommendations

Move to -all (hardfail) once your mail flow is confirmed — softfail gives no real protection

v=spf1 include:_spf.google.com include:_spf.firebasemail.com ~all

v=spf1
include:_spf.google.com
include:_spf.firebasemail.com
~all

fetched 2026-06-04T01:32:49.745Z

spf

info

Open standalone →

resolving spf…

dmarc

medium

Open standalone →

p=none — monitoring only, no enforcement

Why it matters: DMARC binds SPF and DKIM into an enforceable policy (quarantine or reject) and surfaces spoofing attempts via aggregate reports. `p=none` or absent means spoofing succeeds silently (SOC 2 CC6.7).

Recommendations

Review rua= aggregate reports to confirm legitimate mail passes SPF/DKIM
Move to p=quarantine and then p=reject once mail flow is validated

v=DMARC1;p=none;sp=none;pct=100;ruf=mailto:support@geekflare.com;rua=mailto:rua@dmarc.brevo.com;ri=86400;aspf=r;adkim=r;fo=1

v=: DMARC1
p=: none
sp=: none
pct=: 100
ruf=: mailto:support@geekflare.com
rua=: mailto:rua@dmarc.brevo.com
ri=: 86400
aspf=: r
adkim=: r
fo=: 1

fetched 2026-06-04T01:32:49.747Z

dmarc

info

Open standalone →

resolving dmarc…

dkim

low

Open standalone →

1/6 DKIM selectors valid

Why it matters: DKIM signs outbound mail so receivers can detect tampering. Missing selectors or rotated-away keys break DMARC alignment and let receivers downgrade trust (ISO 27001 A.8.24).

Recommendations

Check the missing selectors in your DNS provider and re-add any removed records

default:: —
google:: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAyaDj9eyVUgt8iHekpcoSTIpjRzbDMM9BbTX2iAXCptiSfEDOIAAD/Am5JWBXzDBzFyoYtTqEw85MZuJhlvCA4N52RBJIyBuSqfFa+EUme7HxMFBV/sXCEmqPfHQafnefvFNI8zH4eidgkcy3gNdGArNmXf1EoooJqq+OITynOJ5CyzAVe6af1T8qC4AtLJTp09Wh4uJfGbVQcZeSVeHPFraQ7hkp/RF7lLJ7f21Ubm7qgVyU6l+WPxmd/JgIIV+pRPym+OSIgPnWfZ3sFhanEET6Cud234FgXmg+To/NXBfceBzusy+fn61FHqeiz2eI8uwgnJLiOl444qieYAM/iwIDAQAB
k1:: —
selector1:: —
selector2:: —
mxvault:: —

fetched 2026-06-04T01:32:49.754Z

dkim

info

Open standalone →

probing dkim selectors…

tls

low

Open standalone →

cert expires in 56 days

Why it matters: A valid current TLS certificate is the baseline for data in transit. Expiry, weak chain, or hostname mismatch break HTTPS and fail PCI 4.2.1 / SOC 2 CC6.1.

Recommendations

Schedule certificate renewal — consider enabling auto-renewal

subject cn:: geekflare.com
issuer:: WE1 / Google Trust Services
valid:: May 1 15:28:27 2026 GMT → Jul 30 16:28:23 2026 GMT
authorized:: yes
sha256:: 91:64:0B:25:1D:AD:17:BD:12:DC:4A:B7:F3:70:FE:3C:BA:4F:B1:11:1A:A9:1E:80:87:60:A6:48:BA:59:D2:A3
sans: geekflare.com
aitools-api.geekflare.com

fetched 2026-06-04T01:32:49.790Z

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

HTTPS served correctly

Why it matters: Bare HTTP requests must redirect to HTTPS without dropping the user mid-chain. Plain-text fallback or open redirects fail PCI 4.2.1 and feed phishing chains (SOC 2 CC6.6).

final status: 200 · 1 hop

[200] https://geekflare.com/

fetched 2026-06-04T01:32:49.835Z

redirects

info

Open standalone →

tracing redirects…

headers

low

Open standalone →

4 security header(s) missing

Why it matters: Security headers — HSTS, CSP, X-Frame-Options, Referrer-Policy — defend against XSS, clickjacking, and downgrade attacks. Absent headers map directly to OWASP ASVS V14 findings (ISO 27001 A.8.23).

Recommendations

Add response header — Content-Security-Policy: default-src 'self' (tune per app)
Add response header — X-Frame-Options: DENY (or SAMEORIGIN if framing is intended)
Add response header — Referrer-Policy: strict-origin-when-cross-origin
Add permissions-policy response header

final url: https://geekflare.com/

security headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: —
x-frame-options: —
x-content-type-options: nosniff
referrer-policy: —
permissions-policy: —

other headers

age: 45206
alt-svc: h3=":443"; ma=86400
cache-control: s-maxage=31536000
cf-apo-via: tcache
cf-cache-status: HIT
cf-ray: a0632f9b38b4f442-IAD
connection: keep-alive
content-encoding: br
content-type: text/html; charset=utf-8
date: Thu, 04 Jun 2026 01:32:49 GMT
server: cloudflare
transfer-encoding: chunked
vary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch, Accept-Encoding
via: 1.1 google
x-nextjs-cache: HIT
x-nextjs-prerender: 1, 1
x-nextjs-stale-time: 300

fetched 2026-06-04T01:32:49.837Z

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

no CORS headers — cross-origin requests blocked by default

Why it matters: Overly permissive CORS (wildcard with credentials, or reflected origin) lets any origin read authenticated responses from this domain. OWASP A05 misconfiguration territory (NIST AC-4).

origin: https://domainposture.com
method: GET
preflight status: 405

access-control-* headers

access-control-allow-origin: —
access-control-allow-methods: —
access-control-allow-headers: —
access-control-allow-credentials: —
access-control-max-age: —
access-control-expose-headers: —

no access-control-* headers returned — site does not advertise CORS to this origin

fetched 2026-06-04T01:32:50.055Z

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

HTTPS surface reachable (robots ✓, sitemap ✓, title ✓)

Why it matters: Public files — robots.txt, sitemap.xml, head meta — are what attackers see first during reconnaissance. Misadvertised paths, stale sitemaps, and verbose generators leak more than intended (ISO 27001 A.8.9).

robots.txt

present

User-agent: *
Disallow: /cgi-bin/
Disallow: /wp-admin/
Disallow: /xmlrpc.php
Disallow: /?s=*
Disallow: /tools/result/
Allow: /wp-admin/admin-ajax.php

Sitemap: https://geekflare.com/sitemap-main.xml
Sitemap: https://geekflare.com/guides/sitemap_index.xml
Sitemap: https://geekflare.com/ai/sitemap.xml
Sitemap: https://geekflare.com/api/sitemap.xml
Sitemap: https://geekflare.com/tools/sitemap.xml
Sitemap: https://geekflare.com/sitemap_index.xml
Sitemap: https://docs.geekflare.com/sitemap.xml
Sitemap: https://geekflare.com/es/sitemap_index.xml
Sitemap: https://geekflare.com/fr/sitemap_index.xml
Sitemap: https://geekflare.com/de/sitemap_index.xml
Sitemap: https://geekflare.com/uk/sitemap_index.xml

sitemap.xml

present — 7 url(s)

head

title: Geekflare - Collaborative AI Workspace & Developer APIs
description: The all-in-one AI platform. Chat with 40+ top models using your own keys to cut costs, or build agents with our Search and Scraping APIs.

social

og:title: Geekflare - Collaborative AI Workspace & Developer APIs
og:description: The all-in-one AI platform. Chat with 40+ top models using your own keys to cut costs, or build agents with our Search and Scraping APIs.
og:url: https://geekflare.com/
og:image: https://cdn.geekflare.com/general/social.png
og:image:width: 1200
og:image:height: 630
og:image:alt: Geekflare
og:type: website
twitter:card: summary_large_image
twitter:site: @geekflarehq
twitter:title: Geekflare - Collaborative AI Workspace & Developer APIs
twitter:description: Chat with 40+ models in one workspace with BYOK, or build LLM apps with our Scraping & Search APIs.
twitter:image: https://cdn.geekflare.com/general/social.png

fetched 2026-06-04T01:32:53.287Z

web-surface

info

Open standalone →

inspecting web surface…

dnssec

info

Open standalone →

DNSSEC enabled — DS records present and chain validated (AD flag)

Why it matters: DNSSEC cryptographically signs DNS responses, blocking cache-poisoning attacks. US federal civilian agencies are required to enable it under OMB M-22-09 (NIST SC-20).

enabled: yes
DS records: 2371 ECDSAP256SHA256 2 cbaa2018f41b29985daede7f127d4f9626ada609665cebab0011903b7c639254, DS ECDSAP256SHA256 2 86400 1780884387 1780275387 27677 com. nW2CwWu3LFeIbAKukZqexT5PJQ/2zVd7F8JK0oPL/QxQgL2ZJvKmGiRJSDpxJ1EzXr+uC0M6F6q4BK/pQKmwPg==
DNSKEY records: 3 key(s)

fetched 2026-06-04T01:32:49.751Z

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

not applicable: no _mta-sts TXT record

Why it matters: MTA-STS forces inbound SMTP to use TLS and refuse downgraded connections. Without it, an in-path attacker can strip TLS and read mail in plaintext (SOC 2 CC6.7).

no _mta-sts TXT record

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

not applicable: no TLSRPT record

Why it matters: TLS-RPT publishes a reporting address for SMTP-TLS failures. Without it, downgrade attacks on inbound mail go unnoticed (SOC 2 CC7.2).

no TLSRPT record

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

domain registered until 2028-01-07

Why it matters: Registrar and expiry tell auditors the domain is owned, current, and not about to lapse. An expired or about-to-expire domain fails business-continuity evidence (SOC 2 A1.2).

registrar: Cloudflare, Inc.
created: 2015-01-07T14:14:12Z
expires: 2028-01-07T14:14:12Z
statuses: clientTransferProhibited https://icann.org/epp#clientTransferProhibited

fetched 2026-06-04T01:32:49.869Z

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

check failed: crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

Why it matters: Every certificate issued for this domain is published in Certificate Transparency logs — including subdomains you may have forgotten. Unknown subdomains in CT are pre-disclosed attack surface (ISO 27001 A.8.16).

crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.