mirror.co.uk

15-check dossier · scoreboard above, section details below

embed badge

Markdown

[![Domain posture](https://www.domainposture.com/d/mirror.co.uk/badge.svg)](https://www.domainposture.com/d/mirror.co.uk)

HTML

<a href="https://www.domainposture.com/d/mirror.co.uk"><img src="https://www.domainposture.com/d/mirror.co.uk/badge.svg" alt="Domain posture" /></a>

Scanning…

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

resolving mx…

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

resolving dmarc…

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

tracing redirects…

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

inspecting web surface…

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.

mirror.co.uk

15-check dossier · scoreboard above, section details below

Get a pack →

embed badge

Markdown

[![Domain posture](https://www.domainposture.com/d/mirror.co.uk/badge.svg)](https://www.domainposture.com/d/mirror.co.uk)

HTML

<a href="https://www.domainposture.com/d/mirror.co.uk"><img src="https://www.domainposture.com/d/mirror.co.uk/badge.svg" alt="Domain posture" /></a>

Mostly compliant · 7 items need attention

Aggregate grade across 15 checks. Auditors typically flag any High-severity finding.

Pass: 8
Warn: 7
Fail: 0

What an auditor would flag first

medium
SPF
~all softfail — receivers may still accept
SOC 2 CC6.7ISO 27001 A.8.20
medium
Security headers
4 security header(s) missing
SOC 2 CC6.6ISO 27001 A.8.23
low
DMARC
p=quarantine — receivers send to spam
SOC 2 CC6.7ISO 27001 A.5.14

Need this as an artifact your auditor can verify?

Your mirror.co.uk scan flagged 2 medium and 5 low findings. A signed pack covers the apex plus up to 100 CT-discovered subdomains, Ed25519-signed and ISO-timestamped, delivered in 10–30 minutes.

Get a pack →See methodology See a sample$29

Scanning…

15-check summary

DNS recordsA/AAAA records present
MX5 MX record(s) present
SPF~all softfail — receivers may still accept
DMARCp=quarantine — receivers send to spam
DKIMno DKIM selectors found — likely not configured
TLS certificatecert expires in 62 days
Redirect chainHTTPS served correctly
Security headers4 security header(s) missing
CORSno CORS headers — cross-origin requests blocked by default
Web surfaceHTTPS surface reachable (robots ✓, sitemap ✗, title ✓)
MTA-STSnot applicable: no _mta-sts TXT record
TLS-RPTnot applicable: no TLSRPT record
DNSSECDNSSEC not configured — no DS or DNSKEY records found
WHOISdomain expires in 83 days — renew soon
Certificate Transparencycheck failed: crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

dns

info

Open standalone →

A/AAAA records present

Why it matters: Without authoritative A or AAAA records on the apex, the domain is unreachable. Missing baseline DNS shows up in vendor reviews as evidence of unmanaged infrastructure (SOC 2 CC6.6).

A: ttl=60 34.248.1.109
ttl=60 54.77.63.160
AAAA: —
NS: ttl=300 ns-1492.awsdns-58.org.
ttl=300 ns-1761.awsdns-28.co.uk.
ttl=300 ns-264.awsdns-33.com.
ttl=300 ns-517.awsdns-00.net.
SOA: ttl=900 ns-1761.awsdns-28.co.uk. awsdns-hostmaster.amazon.com. 1 7200 900 1209600 86400
CAA: —
TXT: ttl=300 "0frtryvzvpj7cwdwq83sfcvgks93m5f1"
ttl=300 "facebook-domain-verification=2y0kx4gxmhstsy2l6uh6xho7n78w5z"
ttl=300 "fastly-domain-delegation-98tws5C6KM6We2H2-460228-<2022-01-21>"
ttl=300 "fastly-domain-delegation-fdelt571212-02-07-23"
ttl=300 "google-site-verification=8-ag8FkBar54cLc4AgyPyy3seAM6AOTN4a-TZZeWo7s"
ttl=300 "google-site-verification=EaCj92s7EGNDTFXQxd-icMraB_wo9c0oobaWPit-qtI"
ttl=300 "google-site-verification=J06km9ZTIMKtO4USZoc7XYaC8nKsA4PAwd6IWPkwkMA"
ttl=300 "google-site-verification=S-7RbhPeAOELT4Ma7Gw0XKZtyc3WT5DLsV-A3u61i6c"
ttl=300 "google-site-verification=dsH-w6Gz7mlpgUgAEqpZFEW5-qSrau9nmF99eRCINhQ"
ttl=300 "google-site-verification=vWGrqbtGYScB23QxMJTXTqupfaVBsOeIJ3BC1H8ssAA"
ttl=300 "google-site-verification=zyeEzjsflkjLihKW-KfYsIlo7X6KkhfU_xQf2CuqDV4"
ttl=300 "klaviyo-site-verification=YyZFPn"
ttl=300 "tollbit-domain-verification=3f923f62171ba6925d76d69f700ada475e7a34e49afe791e0299a14df0be959c"
ttl=300 "v=spf1 include:_spf.google.com include:amazonses.com ~all"

fetched 2026-06-17T08:49:21.384Z

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

5 MX record(s) present

Why it matters: MX records direct inbound mail. Misconfiguration silently breaks email delivery and lets attackers stand up parallel MX hosts for spoofing campaigns (ISO 27001 A.8.21).

pri=1 aspmx.l.google.com.
pri=5 alt1.aspmx.l.google.com.
pri=5 alt2.aspmx.l.google.com.
pri=10 alt3.aspmx.l.google.com.
pri=10 alt4.aspmx.l.google.com.

fetched 2026-06-17T08:49:21.375Z

mx

info

Open standalone →

resolving mx…

spf

medium

Open standalone →

~all softfail — receivers may still accept

Why it matters: SPF tells receiving servers which hosts may send mail for the domain. Without it, any sender can forge the envelope-from — the primary mechanism behind business-email-compromise (SOC 2 CC6.7).

Recommendations

Move to -all (hardfail) once your mail flow is confirmed — softfail gives no real protection

v=spf1 include:_spf.google.com include:amazonses.com ~all

v=spf1
include:_spf.google.com
include:amazonses.com
~all

fetched 2026-06-17T08:49:21.378Z

spf

info

Open standalone →

resolving spf…

dmarc

low

Open standalone →

p=quarantine — receivers send to spam

Why it matters: DMARC binds SPF and DKIM into an enforceable policy (quarantine or reject) and surfaces spoofing attempts via aggregate reports. `p=none` or absent means spoofing succeeds silently (SOC 2 CC6.7).

Recommendations

Upgrade to p=reject once your SPF and DKIM pass rates are consistently high

v=DMARC1; p=quarantine; sp=quarantine; rua=mailto:[email protected]; adkim=r; aspf=s

v=: DMARC1
p=: quarantine
sp=: quarantine
rua=: mailto:[email protected]
adkim=: r
aspf=: s

fetched 2026-06-17T08:49:21.377Z

dmarc

info

Open standalone →

resolving dmarc…

dkim

low

Open standalone →

no DKIM selectors found — likely not configured

Why it matters: DKIM signs outbound mail so receivers can detect tampering. Missing selectors or rotated-away keys break DMARC alignment and let receivers downgrade trust (ISO 27001 A.8.24).

Recommendations

Enable DKIM signing in your mail provider and publish the provided TXT record
Common selectors: google._domainkey, selector1._domainkey (Microsoft), mail._domainkey

no DKIM record on probed selectors (default, google, k1, selector1, selector2, mxvault)

dkim

info

Open standalone →

probing dkim selectors…

tls

low

Open standalone →

cert expires in 62 days

Why it matters: A valid current TLS certificate is the baseline for data in transit. Expiry, weak chain, or hostname mismatch break HTTPS and fail PCI 4.2.1 / SOC 2 CC6.1.

Recommendations

Schedule certificate renewal — consider enabling auto-renewal

subject cn:: mirror.co.uk
issuer:: Amazon RSA 2048 M02 / Amazon
valid:: Jul 20 00:00:00 2025 GMT → Aug 18 23:59:59 2026 GMT
authorized:: yes
sha256:: 97:94:62:A7:92:C8:F7:73:D0:99:0F:FD:2B:5B:76:82:9F:66:92:3D:0A:84:D1:1D:60:DA:21:C0:FD:4C:98:FC
sans: mirror.co.uk
chroniclelive.co.uk
croydonadvertiser.co.uk
hertfordshiremercury.co.uk
edinburghlive.co.uk
coventrytelegraph.net
bristolpost.co.uk
leicestermercury.co.uk
getwestlondon.co.uk
tm-aws.com
mylondon.news
irishmirror.ie
gazettelive.co.uk
dailypost.co.uk
dailystar.co.uk
belfastlive.co.uk
norfolklive.co.uk
aberdeenlive.news
getbucks.co.uk
rsvplive.ie
northantslive.news
lincolnshirelive.co.uk
chesterchronicle.co.uk
kentlive.news
birminghammail.co.uk
examinerlive.co.uk
football.london
derbytelegraph.co.uk
glasgowlive.co.uk
express.co.uk
scunthorpetelegraph.co.uk
cambridgeshirelive.co.uk
themirror.com
loughboroughecho.net
buzz.ie
tm-dev-aws.com
southportvisiter.co.uk
walesonline.co.uk
corkbeo.ie
burtonmail.co.uk
hinckleytimes.net
accringtonobserver.co.uk
tm-awx.com
macclesfield-live.co.uk
wiltshirelive.co.uk
birminghamlive.co.uk
hulldailymail.co.uk
getreading.co.uk
buckinghamshirelive.com
ok.co.uk
gloucestershirelive.co.uk
footballscotland.co.uk
crewechronicle.co.uk
insider.co.uk
cornwalllive.com
scotlandnow.dailyrecord.co.uk
suffolklive.com
irishstar.com
leeds-live.co.uk
bathchronicle.co.uk
galwaybeo.ie
stokesentinel.co.uk
bedfordshirelive.co.uk
hampshirelive.news
scottishdailyexpress.co.uk
oxfordshirelive.co.uk
lancs.live
essexlive.news
cheshire-live.co.uk
nottinghampost.com
macclesfield-express.co.uk
getsurrey.co.uk
sussexlive.co.uk
grimsbytelegraph.co.uk
plymouthherald.co.uk
the-express.com
dublinlive.ie
manchestereveningnews.co.uk
devonlive.com
rossendalefreepress.co.uk
dorset.live
staffordshire-live.co.uk
birminghampost.co.uk
liverpoolecho.co.uk
dailyrecord.co.uk
wharf.co.uk
tm-dev-awx.com
bristol.live
business-live.co.uk
gethampshire.co.uk
cambridge-news.co.uk
liverpool.com
somersetlive.co.uk
examiner.co.uk

fetched 2026-06-17T08:49:21.778Z

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

HTTPS served correctly

Why it matters: Bare HTTP requests must redirect to HTTPS without dropping the user mid-chain. Plain-text fallback or open redirects fail PCI 4.2.1 and feed phishing chains (SOC 2 CC6.6).

final status: 200 · 2 hops

[301] https://mirror.co.uk/
[200] https://www.mirror.co.uk/

fetched 2026-06-17T08:49:22.248Z

redirects

info

Open standalone →

tracing redirects…

headers

medium

Open standalone →

4 security header(s) missing

Why it matters: Security headers — HSTS, CSP, X-Frame-Options, Referrer-Policy — defend against XSS, clickjacking, and downgrade attacks. Absent headers map directly to OWASP ASVS V14 findings (ISO 27001 A.8.23).

Recommendations

Add response header — Strict-Transport-Security: max-age=15552000; includeSubDomains
Add response header — X-Content-Type-Options: nosniff
Add response header — Referrer-Policy: strict-origin-when-cross-origin
Add permissions-policy response header

final url: https://www.mirror.co.uk/

security headers

strict-transport-security: —
content-security-policy: frame-ancestors 'self' https://*.cdn.ampproject.org/ https://bing-amp.com/ https://*.tm-aws.com/ https://*.tm-awx.com/;
x-frame-options: SAMEORIGIN
x-content-type-options: —
referrer-policy: —
permissions-policy: —

other headers

accept-ranges: bytes
access-control-allow-origin: *
age: 16
cache-control: public, max-age=60, must-revalidate
connection: keep-alive
content-encoding: gzip
content-length: 82984
content-type: text/html; charset=utf-8
date: Wed, 17 Jun 2026 08:49:13 GMT
href: https://0.0.0.0:3000/?service=responsive
link: </nav-web-static/main-6ecc25bd1dcaecba287c3d47422087aafa2ee181/_next/static/media/0484562807a97172-s.p.woff2>; rel=preload; as="font"; crossorigin=""; type="font/woff2", </nav-web-static/main-6ecc25bd1dcaecba287c3d47422087aafa2ee181/_next/static/media/167495dd227fe64a-s.p.woff2>; rel=preload; as="font"; crossorigin=""; type="font/woff2", </nav-web-static/main-6ecc25bd1dcaecba287c3d47422087aafa2ee181/_next/static/media/2227f4a42dd9a668-s.p.woff2>; rel=preload; as="font"; crossorigin=""; type="font/woff2", </nav-web-static/main-6ecc25bd1dcaecba287c3d47422087aafa2ee181/_next/static/media/32b04a225cda6443-s.p.woff2>; rel=preload; as="font"; crossorigin=""; type="font/woff2", </nav-web-static/main-6ecc25bd1dcaecba287c3d47422087aafa2ee181/_next/static/media/4c285fdca692ea22-s.p.woff2>; rel=preload; as="font"; crossorigin=""; type="font/woff2", </nav-web-static/main-6ecc25bd1dcaecba287c3d47422087aafa2ee181/_next/static/media/50ae58c90b3efe37-s.p.woff2>; rel=preload; as="font"; crossorigin=""; type="font/woff2", </nav-web-static/main-6ecc25bd1dcaecba287c3d47422087aafa2ee181/_next/static/media/623e87c35e26dfd6-s.p.woff2>; rel=preload; as="font"; crossorigin=""; type="font/woff2", </nav-web-static/main-6ecc25bd1dcaecba287c3d47422087aafa2ee181/_next/static/media/7db6c35d839a711c-s.p.woff2>; rel=preload; as="font"; crossorigin=""; type="font/woff2", </nav-web-static/main-6ecc25bd1dcaecba287c3d47422087aafa2ee181/_next/static/media/8888a3826f4a3af4-s.p.woff2>; rel=preload; as="font"; crossorigin=""; type="font/woff2", </nav-web-static/main-6ecc25bd1dcaecba287c3d47422087aafa2ee181/_next/static/media/95a278dd5d43a653-s.p.woff2>; rel=preload; as="font"; crossorigin=""; type="font/woff2", </nav-web-static/main-6ecc25bd1dcaecba287c3d47422087aafa2ee181/_next/static/media/a1ead154ff661e2f-s.p.woff2>; rel=preload; as="font"; crossorigin=""; type="font/woff2", </nav-web-static/main-6ecc25bd1dcaecba287c3d47422087aafa2ee181/_next/static/media/a2eee93172d5489d-s.p.woff2>; rel=preload; as="font"; crossorigin=""; type="font/woff2", </nav-web-static/main-6ecc25bd1dcaecba287c3d47422087aafa2ee181/_next/static/media/b957ea75a84b6ea7-s.p.woff2>; rel=preload; as="font"; crossorigin=""; type="font/woff2", </nav-web-static/main-6ecc25bd1dcaecba287c3d47422087aafa2ee181/_next/static/media/ce9644d4d129da3f-s.p.woff2>; rel=preload; as="font"; crossorigin=""; type="font/woff2", </nav-web-static/main-6ecc25bd1dcaecba287c3d47422087aafa2ee181/_next/static/media/e807dee2426166ad-s.p.woff2>; rel=preload; as="font"; crossorigin=""; type="font/woff2", </nav-web-static/main-6ecc25bd1dcaecba287c3d47422087aafa2ee181/_next/static/media/eafabf029ad39a43-s.p.woff2>; rel=preload; as="font"; crossorigin=""; type="font/woff2", </nav-web-static/main-6ecc25bd1dcaecba287c3d47422087aafa2ee181/_next/static/css/1fa34ed8951f31f6.css>; rel=preload; as="style", </nav-web-static/main-6ecc25bd1dcaecba287c3d47422087aafa2ee181/_next/static/css/efefc9ad625120f2.css>; rel=preload; as="style", </nav-web-static/main-6ecc25bd1dcaecba287c3d47422087aafa2ee181/_next/static/css/7a3bdc301c62e096.css>; rel=preload; as="style", </nav-web-static/main-6ecc25bd1dcaecba287c3d47422087aafa2ee181/_next/static/css/e9209e68673b57a1.css>; rel=preload; as="style", </nav-web-static/main-6ecc25bd1dcaecba287c3d47422087aafa2ee181/_next/static/css/c15c96cc10faa1d1.css>; rel=preload; as="style", </nav-web-static/main-6ecc25bd1dcaecba287c3d47422087aafa2ee181/_next/static/css/54fa859418259875.css>; rel=preload; as="style", </nav-web-static/main-6ecc25bd1dcaecba287c3d47422087aafa2ee181/_next/static/css/6284e2dd832aa678.css>; rel=preload; as="style", </nav-web-static/main-6ecc25bd1dcaecba287c3d47422087aafa2ee181/_next/static/css/65fa91c7ccd08b0f.css>; rel=preload; as="style", </nav-web-static/main-6ecc25bd1dcaecba287c3d47422087aafa2ee181/_next/static/css/fd29579f56b01fd3.css>; rel=preload; as="style", </nav-web-static/main-6ecc25bd1dcaecba287c3d47422087aafa2ee181/_next/static/css/c900ba6c976f7f45.css>; rel=preload; as="style", </nav-web-static/main-6ecc25bd1dcaecba287c3d47422087aafa2ee181/_next/static/css/bb556be071ce9452.css>; rel=preload; as="style", </nav-web-static/main-6ecc25bd1dcaecba287c3d47422087aafa2ee181/_next/static/css/d3813b3853042067.css>; rel=preload; as="style", </nav-web-static/main-6ecc25bd1dcaecba287c3d47422087aafa2ee181/_next/static/css/b44c1f67eb7b25de.css>; rel=preload; as="style"

fetched 2026-06-17T08:49:22.261Z

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

no CORS headers — cross-origin requests blocked by default

Why it matters: Overly permissive CORS (wildcard with credentials, or reflected origin) lets any origin read authenticated responses from this domain. OWASP A05 misconfiguration territory (NIST AC-4).

origin: https://domainposture.com
method: GET
preflight status: 301

access-control-* headers

access-control-allow-origin: —
access-control-allow-methods: —
access-control-allow-headers: —
access-control-allow-credentials: —
access-control-max-age: —
access-control-expose-headers: —

no access-control-* headers returned — site does not advertise CORS to this origin

fetched 2026-06-17T08:49:21.931Z

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

HTTPS surface reachable (robots ✓, sitemap ✗, title ✓)

Why it matters: Public files — robots.txt, sitemap.xml, head meta — are what attackers see first during reconnaissance. Misadvertised paths, stale sitemaps, and verbose generators leak more than intended (ISO 27001 A.8.9).

robots.txt

present

Sitemap: https://www.mirror.co.uk/map_news.xml
Sitemap: https://www.mirror.co.uk/sitemaps/sitemap_index.xml
User-agent: *
Disallow: /topics/*
Disallow: /topics
Disallow: /*token=*
Crawl-delay: 10.0

Disallow: /search/
Disallow: /comm-part-test/
Disallow: /*service=ajax
Disallow: /centenary-fund/
Disallow: /3am/weird-celeb-news/xxx-1341448
Disallow: /3am/weird-celeb-news/tamara-ecclestone-watched-boyfriends-sex-1341448
Disallow: /comm-part-test/oh-like-beside-seaside-uk-1722203
Disallow: /resources/js/s_code.js
Disallow: /template/
Disallow: /tv/tv-news/jean-alexander-dies-coronation-streets-3764827
Disallow: /3am/celebrity-news/anne-kirkbride-dead-bill-roache-5013775
Disallow: /lifestyle/cartoons/andy-capp/andy-capp
Disallow: /lifestyle/cartoons/the-gag-vault/gag-vault
Disallow: /lifestyle/cartoons/perishers/perishers
Disallow: /lifestyle/cartoons/horace/horace
Disallow: /lifestyle/cartoons/garth/garth
Disallow: /lifestyle/cartoons/mandy/mandy
Disallow: /lifestyle/cartoons/kerber-black/
Disallow: /regression-test-home/
Disallow: /5293/
Disallow: /exclusive-offers/

#Agent Specific Disallowed Sections

User-agent: daumoa
Disallow: /

User-agent: Sosospider
Disallow: /

User-agent: rogerbot
Disallow: /

User-agent: semetrical
Disallow: /

User-agent: Googlebot-News
Disallow: /thedavedesk/

User-agent: AhrefsBot 
Disallow: /

User-agent: GPTBot
Disallow: /

User-agent: OAI-SearchBot
Disallow: /

User-agent: Applebot-Extended
Disallow: /

User-agent: PerplexityBot
Disallow: /

User-agent: Perplexity-ai
Disallow: /

User-agent: CCBot
Disallow: /

User-agent: YouBot
Disallow: /

User-agent: ClaudeBot
Disallow: /

User-agent: anthropic-ai
Disallow: /

User-agent: Claude-Web
Disallow: /

User-agent: grapeshot
Crawl-delay: 0

User-agent: bingbot
Crawl-delay: 1

User-agent: AmazonAdBot
Crawl-delay: 0

User-agent: ozone
Crawl-delay: 0

User-agent: Meta-ExternalAgent
Disallow: /

sitemap.xml

absent

head

title: The Mirror: The Heart of Britain
description: Get the latest news, sport, celebrity gossip, TV, politics and lifestyle from The Mirror. Big stories with a big heart, always with you in mind.

social

og:title: The Mirror: The Heart of Britain
og:description: Get the latest news, sport, celebrity gossip, TV, politics and lifestyle from The Mirror. Big stories with a big heart, always with you in mind.
og:url: https://www.mirror.co.uk
og:site_name: Daily Mirror
og:locale: en_GB
og:image: https://www.mirror.co.uk/nav-web-static/main-6ecc25bd1dcaecba287c3d47422087aafa2ee181/public/assets/mirror/logos/logo-mirror-social-sharing.png
og:type: website
twitter:card: summary_large_image
twitter:title: The Mirror: The Heart of Britain
twitter:description: Get the latest news, sport, celebrity gossip, TV, politics and lifestyle from The Mirror. Big stories with a big heart, always with you in mind.
twitter:image: https://www.mirror.co.uk/nav-web-static/main-6ecc25bd1dcaecba287c3d47422087aafa2ee181/public/assets/mirror/logos/logo-mirror-social-sharing.png

fetched 2026-06-17T08:49:22.632Z

web-surface

info

Open standalone →

inspecting web surface…

dnssec

low

Open standalone →

DNSSEC not configured — no DS or DNSKEY records found

Why it matters: DNSSEC cryptographically signs DNS responses, blocking cache-poisoning attacks. US federal civilian agencies are required to enable it under OMB M-22-09 (NIST SC-20).

Recommendations

Enable DNSSEC in your DNS provider's control panel and add the resulting DS record at your registrar

enabled: no
DS records: —
DNSKEY records: —

fetched 2026-06-17T08:49:21.383Z

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

not applicable: no _mta-sts TXT record

Why it matters: MTA-STS forces inbound SMTP to use TLS and refuse downgraded connections. Without it, an in-path attacker can strip TLS and read mail in plaintext (SOC 2 CC6.7).

no _mta-sts TXT record

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

not applicable: no TLSRPT record

Why it matters: TLS-RPT publishes a reporting address for SMTP-TLS failures. Without it, downgrade attacks on inbound mail go unnoticed (SOC 2 CC7.2).

no TLSRPT record

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

low

Open standalone →

domain expires in 82 days — renew soon

Why it matters: Registrar and expiry tell auditors the domain is owned, current, and not about to lapse. An expired or about-to-expire domain fails business-continuity evidence (SOC 2 A1.2).

Recommendations

Enable auto-renewal at your registrar to avoid accidental expiry

registrar: CSC Corporate Domains, Inc [Tag = CSC-CORP-DOMAINS]
created: before Aug-1996
expires: 08-Sep-2026
statuses: Registered until expiry date.

fetched 2026-06-17T08:49:22.037Z

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

check failed: crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

Why it matters: Every certificate issued for this domain is published in Certificate Transparency logs — including subdomains you may have forgotten. Unknown subdomains in CT are pre-disclosed attack surface (ISO 27001 A.8.16).

crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.