nordvpn.com

15-check dossier · scoreboard above, section details below

Get a pack →

Scanning…

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

resolving mx…

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

resolving dmarc…

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

tracing redirects…

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

inspecting web surface…

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.

nordvpn.com

15-check dossier · scoreboard above, section details below

Get a pack →

A-

Audit-ready · 2 minor advisories

Aggregate grade across 15 checks. Auditors typically flag any High-severity finding.

Pass: 13
Warn: 2
Fail: 0

What an auditor would flag first

low
DKIM
1/6 DKIM selectors valid
SOC 2 CC6.7
low
DNSSEC
DNSSEC not configured — no DS or DNSKEY records found
SOC 2 CC6.6ISO 27001 A.13.1.1

Need this as an artifact your auditor can verify?

Your nordvpn.com scan flagged 2 low findings. A signed pack covers the apex plus up to 100 CT-discovered subdomains, Ed25519-signed and ISO-timestamped, delivered in 10–30 minutes.

Get a pack →See methodology See a sample$29

Scanning…

15-check summary

DNS recordsA/AAAA records present
MX5 MX record(s) present
SPF-all hardfail — strict policy
DMARCp=reject — strict policy
DKIM1/6 DKIM selectors valid
TLS certificatecert valid for 149 days
Redirect chainHTTPS served correctly
Security headersall security headers present
CORSno CORS headers — cross-origin requests blocked by default
Web surfaceHTTPS surface reachable (robots ✓, sitemap ✗, title ✓)
MTA-STSnot applicable: no _mta-sts TXT record
TLS-RPTnot applicable: no TLSRPT record
DNSSECDNSSEC not configured — no DS or DNSKEY records found
WHOISdomain registered until 2026-09-20
Certificate Transparencycheck failed: crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

dns

info

Open standalone →

A/AAAA records present

Why it matters: Without authoritative A or AAAA records on the apex, the domain is unreachable. Missing baseline DNS shows up in vendor reviews as evidence of unmanaged infrastructure (SOC 2 CC6.6).

A: ttl=233 104.19.159.190
ttl=233 104.16.208.203
AAAA: —
NS: ttl=82454 lily.ns.cloudflare.com.
ttl=82454 seth.ns.cloudflare.com.
SOA: ttl=1800 lily.ns.cloudflare.com. dns.cloudflare.com. 2406034806 10000 2400 604800 1800
CAA: —
TXT: ttl=300 "MS=9AAAE7D4B160BBC17B316D2992B6B14C64DF4E13"
ttl=300 "MS=ms41624661"
ttl=300 "MS=ms60989570"
ttl=300 "MS=ms69824556"
ttl=300 "google-site-verification=QIh6YGom6DuhiCuoCX1mtuBcxf3zLzUXrMUzZpWkVyw"
ttl=300 "oneuptime=2fYJpBXRQsmY3Py"
ttl=300 "v=spf1 include:mail.zendesk.com include:_spf.google.com include:icloud.com -all"

fetched 2026-06-04T05:46:27.717Z

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

5 MX record(s) present

Why it matters: MX records direct inbound mail. Misconfiguration silently breaks email delivery and lets attackers stand up parallel MX hosts for spoofing campaigns (ISO 27001 A.8.21).

pri=1 aspmx.l.google.com.
pri=5 alt1.aspmx.l.google.com.
pri=5 alt2.aspmx.l.google.com.
pri=10 alt3.aspmx.l.google.com.
pri=10 alt4.aspmx.l.google.com.

fetched 2026-06-04T05:46:27.718Z

mx

info

Open standalone →

resolving mx…

spf

info

Open standalone →

-all hardfail — strict policy

Why it matters: SPF tells receiving servers which hosts may send mail for the domain. Without it, any sender can forge the envelope-from — the primary mechanism behind business-email-compromise (SOC 2 CC6.7).

v=spf1 include:mail.zendesk.com include:_spf.google.com include:icloud.com -all

v=spf1
include:mail.zendesk.com
include:_spf.google.com
include:icloud.com
-all

fetched 2026-06-04T05:46:27.720Z

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

p=reject — strict policy

Why it matters: DMARC binds SPF and DKIM into an enforceable policy (quarantine or reject) and surfaces spoofing attempts via aggregate reports. `p=none` or absent means spoofing succeeds silently (SOC 2 CC6.7).

v=DMARC1; p=reject; sp=reject; pct=100; fo=1; rua=mailto:dmarc@nordsec.com; ruf=mailto:dmarc@nordsec.com

v=: DMARC1
p=: reject
sp=: reject
pct=: 100
fo=: 1
rua=: mailto:dmarc@nordsec.com
ruf=: mailto:dmarc@nordsec.com

fetched 2026-06-04T05:46:27.719Z

dmarc

info

Open standalone →

resolving dmarc…

dkim

low

Open standalone →

1/6 DKIM selectors valid

Why it matters: DKIM signs outbound mail so receivers can detect tampering. Missing selectors or rotated-away keys break DMARC alignment and let receivers downgrade trust (ISO 27001 A.8.24).

Recommendations

Check the missing selectors in your DNS provider and re-add any removed records

default:: —
google:: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvkogBHxZTMioH4ulfJ8otuf2RLnmEhghaHgkOSkmziUoRNlRr45SSADCTOiEuGfGrX4u/gydunjsz8C0vUeZkP3pg4eehrN8RCez5ANwagSLv4Jle7aJKiy9dnEvyCriiBJxafmrP+plkp8gHpFsfdkmbt+5H0DzOc75PXQ10T2u3RzhLLgNg10wGXab3uYouuqvmvXcAbK6j1xfzNeDAbtAid7PmcPXhnbp8718InpLNKBAB+WxucV4Y0YnMdaxXIHw8eqTULnzynZqSfRPXfF8oGROB5++QP3Y8aGbeuqpQix8ETwyx2ZFQbFvhH8o9PdQmtwnRjfQIbXjFAJ3ewIDAQAB
k1:: —
selector1:: —
selector2:: —
mxvault:: —

fetched 2026-06-04T05:46:27.724Z

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

cert valid for 149 days

Why it matters: A valid current TLS certificate is the baseline for data in transit. Expiry, weak chain, or hostname mismatch break HTTPS and fail PCI 4.2.1 / SOC 2 CC6.1.

subject cn:: *.nordvpn.com
issuer:: Sectigo Public Server Authentication CA DV R36 / Sectigo Limited
valid:: Oct 1 00:00:00 2025 GMT → Oct 31 23:59:59 2026 GMT
authorized:: yes
sha256:: 6A:3C:03:E5:8A:71:EF:58:95:D3:F1:03:D4:D4:F8:DC:50:CC:05:58:2E:DD:50:76:7A:C1:47:11:1A:E4:BB:5C
sans: *.nordvpn.com
nordvpn.com

fetched 2026-06-04T05:46:27.761Z

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

HTTPS served correctly

Why it matters: Bare HTTP requests must redirect to HTTPS without dropping the user mid-chain. Plain-text fallback or open redirects fail PCI 4.2.1 and feed phishing chains (SOC 2 CC6.6).

final status: 403 · 1 hop

[403] https://nordvpn.com/

fetched 2026-06-04T05:46:27.793Z

redirects

info

Open standalone →

tracing redirects…

headers

info

Open standalone →

all security headers present

Why it matters: Security headers — HSTS, CSP, X-Frame-Options, Referrer-Policy — defend against XSS, clickjacking, and downgrade attacks. Absent headers map directly to OWASP ASVS V14 findings (ISO 27001 A.8.23).

final url: https://nordvpn.com/

security headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: default-src 'none'; script-src 'nonce-Ah6T3AMBeRfRzzFlnY0XTt' 'unsafe-eval' https://challenges.cloudflare.com; script-src-attr 'none'; style-src 'unsafe-inline'; img-src 'self' https://challenges.cloudflare.com; connect-src 'self' https://challenges.cloudflare.com; frame-src 'self' https://challenges.cloudflare.com blob:; child-src 'self' https://challenges.cloudflare.com blob:; worker-src blob:; form-action http: https:; base-uri 'self'
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
referrer-policy: same-origin
permissions-policy: accelerometer=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=(),xr-spatial-tracking=*

other headers

accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
alt-svc: h3=":443"; ma=86400
cf-mitigated: challenge
cf-ray: a064a3239e7a0780-IAD
connection: close
content-encoding: br
content-type: text/html; charset=UTF-8
critical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: same-origin
date: Thu, 04 Jun 2026 05:46:27 GMT
origin-agent-cluster: ?1
server: cloudflare
server-timing: chlray;desc="a064a3239e7a0780"
set-cookie: __cf_bm=hWELT._iwuTfMBXbKMaG5jl7T7R.w_T0MQ6NOdEswe0-1780551987.7716515-1.0.1.1-HEOrXNbo5asjcxwKPo22diSh57rR6ypwh0AzJjLM1OOf5UTz13SdfsS016C5.qkTZ2UYwkNDqtr.Cb203Xcef.sTUGSHKckV_sSptRXUTjTdRGydIee8QG1gu0G9rR.GCQv_xdc9bRyXW0K8sd6QLw; HttpOnly; SameSite=None; Secure; Path=/; Domain=nordvpn.com; Expires=Thu, 04 Jun 2026 06:16:27 GMT
transfer-encoding: chunked
vary: accept-encoding

fetched 2026-06-04T05:46:27.781Z

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

no CORS headers — cross-origin requests blocked by default

Why it matters: Overly permissive CORS (wildcard with credentials, or reflected origin) lets any origin read authenticated responses from this domain. OWASP A05 misconfiguration territory (NIST AC-4).

origin: https://domainposture.com
method: GET
preflight status: 403

access-control-* headers

access-control-allow-origin: —
access-control-allow-methods: —
access-control-allow-headers: —
access-control-allow-credentials: —
access-control-max-age: —
access-control-expose-headers: —

no access-control-* headers returned — site does not advertise CORS to this origin

fetched 2026-06-04T05:46:27.778Z

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

HTTPS surface reachable (robots ✓, sitemap ✗, title ✓)

Why it matters: Public files — robots.txt, sitemap.xml, head meta — are what attackers see first during reconnaissance. Misadvertised paths, stale sitemaps, and verbose generators leak more than intended (ISO 27001 A.8.9).

robots.txt

present

User-agent: ia_archiver
Disallow: /

User-agent: archive.org_bot
Disallow: /

User-agent: ia_archiver-web.archive.org
Disallow: /

User-agent: *
Disallow: /*?search
Disallow: /search/
Disallow: /cc/
Disallow: /*?q=

Sitemap: https://nordvpn.com/homepage-sitemap.xml
Sitemap: https://nordvpn.com/general-sitemap.xml
Sitemap: https://nordvpn.com/download-sitemap.xml
Sitemap: https://nordvpn.com/servers-sitemap.xml
Sitemap: https://nordvpn.com/features-sitemap.xml
Sitemap: https://nordvpn.com/unblock-sitemap.xml
Sitemap: https://nordvpn.com/gaming-sitemap.xml
Sitemap: https://nordvpn.com/research-lab-sitemap.xml
Sitemap: https://nordvpn.com/cybersecurity-sitemap.xml
Sitemap: https://nordvpn.com/threat-center-sitemap.xml
Sitemap: https://nordvpn.com/is-it-down-sitemap.xml
Sitemap: https://nordvpn.com/glossary-num-sitemap.xml
Sitemap: https://nordvpn.com/glossary-a-sitemap.xml
Sitemap: https://nordvpn.com/glossary-b-sitemap.xml
Sitemap: https://nordvpn.com/glossary-c-sitemap.xml
Sitemap: https://nordvpn.com/glossary-d-sitemap.xml
Sitemap: https://nordvpn.com/glossary-e-sitemap.xml
Sitemap: https://nordvpn.com/glossary-f-sitemap.xml
Sitemap: https://nordvpn.com/glossary-g-sitemap.xml
Sitemap: https://nordvpn.com/glossary-h-sitemap.xml
Sitemap: https://nordvpn.com/glossary-i-sitemap.xml
Sitemap: https://nordvpn.com/glossary-j-sitemap.xml
Sitemap: https://nordvpn.com/glossary-k-sitemap.xml
Sitemap: https://nordvpn.com/glossary-l-sitemap.xml
Sitemap: https://nordvpn.com/glossary-m-sitemap.xml
Sitemap: https://nordvpn.com/glossary-n-sitemap.xml
Sitemap: https://nordvpn.com/glossary-o-sitemap.xml
Sitemap: https://nordvpn.com/glossary-p-sitemap.xml
Sitemap: https://nordvpn.com/glossary-q-sitemap.xml
Sitemap: https://nordvpn.com/glossary-r-sitemap.xml
Sitemap: https://nordvpn.com/glossary-s-sitemap.xml
Sitemap: https://nordvpn.com/glossary-t-sitemap.xml
Sitemap: https://nordvpn.com/glossary-u-sitemap.xml
Sitemap: https://nordvpn.com/glossary-v-sitemap.xml
Sitemap: https://nordvpn.com/glossary-w-sitemap.xml
Sitemap: https://nordvpn.com/glossary-x-sitemap.xml
Sitemap: https://nordvpn.com/glossary-y-sitemap.xml
Sitemap: https://nordvpn.com/glossary-z-sitemap.xml
Sitemap: https://nordvpn.com/blog-num-sitemap.xml
Sitemap: https://nordvpn.com/blog-vpn-sitemap.xml
Sitemap: https://nordvpn.com/blog-scam-sitemap.xml
Sitemap: https://nordvpn.com/blog-phishing-sitemap.xml
Sitemap: https://nordvpn.com/blog-author-sitemap.xml
Sitemap: https://nordvpn.com/blog-a-sitemap.xml
Sitemap: https://nordvpn.com/blog-b-sitemap.xml
Sitemap: https://nordvpn.com/blog-c-sitemap.xml
Sitemap: https://nordvpn.com/blog-d-sitemap.xml
Sitemap: https://nordvpn.com/blog-e-sitemap.xml
Sitemap: https://nordvpn.com/blog-f-sitemap.xml
Sitemap: https://nordvpn.com/blog-g-sitemap.xml
Sitemap: https://nordvpn.com/blog-h-sitemap.xml
Sitemap: https://nordvpn.com/blog-i-sitemap.xml
Sitemap: https://nordvpn.com/blog-j-sitemap.xml
Sitemap: https://nordvpn.com/blog-k-sitemap.xml
Sitemap: https://nordvpn.com/blog-l-sitemap.xml
Sitemap: https://nordvpn.com/blog-m-sitemap.xml
Sitemap: https://nordvpn.com/blog-n-sitemap.xml
Sitemap: https://nordvpn.com/blog-o-sitemap.xml
Sitemap: https://nordvpn.com/blog-p-sitemap.xml
Sitemap: https://nordvpn.com/blog-r-sitemap.xml
Sitemap: https://nordvpn.com/blog-s-sitemap.xml
Sitemap: https://nordvpn.com/blog-t-sitemap.xml
Sitemap: https://nordvpn.com/blog-u-sitemap.xml
Sitemap: https://nordvpn.com/blog-v-sitemap.xml
Sitemap: https://nordvpn.com/blog-w-sitemap.xml
Sitemap: https://nordvpn.com/blog-x-sitemap.xml
Sitemap: https://nordvpn.com/blog-y-sitemap.xml
Sitemap: https://nordvpn.com/blog-z-sitemap.xml
Sitemap: https://nordvpn.com/ar/general-sitemap.xml
Sitemap: https://nordvpn.com/ar/download-sitemap.xml
Sitemap: https://nordvpn.com/ar/servers-sitemap.xml
Sitemap: https://nordvpn.com/ar/features-sitemap.xml
Sitemap: https://nordvpn.com/ar/unblock-sitemap.xml
Sitemap: https://nordvpn.com/ar/gaming-sitemap.xml
Sitemap: https://nordvpn.com/ar/research-lab-sitemap.xml
Sitemap: https://nordvpn.com/ar/cybersecurity-sitemap.xml
Sitemap: https://nordvpn.c

sitemap.xml

absent

head

title: Just a moment...
description: —

social

no OpenGraph or Twitter meta tags found

fetched 2026-06-04T05:46:27.809Z

web-surface

info

Open standalone →

inspecting web surface…

dnssec

low

Open standalone →

DNSSEC not configured — no DS or DNSKEY records found

Why it matters: DNSSEC cryptographically signs DNS responses, blocking cache-poisoning attacks. US federal civilian agencies are required to enable it under OMB M-22-09 (NIST SC-20).

Recommendations

Enable DNSSEC in your DNS provider's control panel and add the resulting DS record at your registrar

enabled: no
DS records: —
DNSKEY records: —

fetched 2026-06-04T05:46:27.725Z

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

not applicable: no _mta-sts TXT record

Why it matters: MTA-STS forces inbound SMTP to use TLS and refuse downgraded connections. Without it, an in-path attacker can strip TLS and read mail in plaintext (SOC 2 CC6.7).

no _mta-sts TXT record

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

not applicable: no TLSRPT record

Why it matters: TLS-RPT publishes a reporting address for SMTP-TLS failures. Without it, downgrade attacks on inbound mail go unnoticed (SOC 2 CC7.2).

no TLSRPT record

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

domain registered until 2026-09-20

Why it matters: Registrar and expiry tell auditors the domain is owned, current, and not about to lapse. An expired or about-to-expire domain fails business-continuity evidence (SOC 2 A1.2).

registrar: EuroDNS S.A.
created: 2012-09-20T19:56:20Z
expires: 2026-09-20T19:56:20Z
statuses: clientTransferProhibited https://icann.org/epp#clientTransferProhibited

fetched 2026-06-04T05:46:27.997Z

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

check failed: crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

Why it matters: Every certificate issued for this domain is published in Certificate Transparency logs — including subdomains you may have forgotten. Unknown subdomains in CT are pre-disclosed attack surface (ISO 27001 A.8.16).

crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.