ns1.com

15-check dossier · scoreboard above, section details below

embed badge

Markdown

[![Domain posture](https://www.domainposture.com/d/ns1.com/badge.svg)](https://www.domainposture.com/d/ns1.com)

HTML

<a href="https://www.domainposture.com/d/ns1.com"><img src="https://www.domainposture.com/d/ns1.com/badge.svg" alt="Domain posture" /></a>

Scanning…

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

resolving mx…

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

resolving dmarc…

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

tracing redirects…

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

inspecting web surface…

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.

ns1.com

15-check dossier · scoreboard above, section details below

Get a pack →

embed badge

Markdown

[![Domain posture](https://www.domainposture.com/d/ns1.com/badge.svg)](https://www.domainposture.com/d/ns1.com)

HTML

<a href="https://www.domainposture.com/d/ns1.com"><img src="https://www.domainposture.com/d/ns1.com/badge.svg" alt="Domain posture" /></a>

Mostly compliant · 6 items need attention

Aggregate grade across 15 checks. Auditors typically flag any High-severity finding.

Pass: 9
Warn: 6
Fail: 0

What an auditor would flag first

medium
SPF
~all softfail — receivers may still accept
SOC 2 CC6.7ISO 27001 A.8.20
medium
Redirect chain
redirects to different domain: ibm.com
SOC 2 CC6.6
low
DMARC
p=quarantine — receivers send to spam
SOC 2 CC6.7ISO 27001 A.5.14

Need this as an artifact your auditor can verify?

Your ns1.com scan flagged 2 medium and 4 low findings. A signed pack covers the apex plus up to 100 CT-discovered subdomains, Ed25519-signed and ISO-timestamped, delivered in 10–30 minutes.

Get a pack →See methodology See a sample$29

Scanning…

15-check summary

DNS recordsA/AAAA records present
MX1 MX record(s) present
SPF~all softfail — receivers may still accept
DMARCp=quarantine — receivers send to spam
DKIM1/6 DKIM selectors valid
TLS certificatecert expires in 51 days
Redirect chainredirects to different domain: ibm.com
Security headers3 security header(s) missing
CORSno CORS headers — cross-origin requests blocked by default
Web surfaceHTTPS surface reachable (robots ✓, sitemap ✓, title ✓)
MTA-STSnot applicable: no _mta-sts TXT record
TLS-RPTnot applicable: no TLSRPT record
DNSSECDNSSEC enabled — DS records present and chain validated (AD flag)
WHOISdomain registered until 2027-06-19
Certificate Transparencycheck failed: crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

dns

info

Open standalone →

A/AAAA records present

Why it matters: Without authoritative A or AAAA records on the apex, the domain is unreachable. Missing baseline DNS shows up in vendor reviews as evidence of unmanaged infrastructure (SOC 2 CC6.6).

A: ttl=5 104.20.10.68
ttl=5 172.66.129.130
AAAA: ttl=300 2606:4700:10::6814:a44
ttl=300 2606:4700:10::ac42:8182
NS: ttl=3600 dns1.p10.nsone.net.
ttl=3600 dns2.p10.nsone.net.
ttl=3600 dns3.p10.nsone.net.
ttl=3600 dns4.p10.nsone.net.
SOA: ttl=3600 dns1.p01.nsone.net. hostmaster.nsone.net. 1764882848 43200 7200 1209600 3600
CAA: —
TXT: ttl=3600 "_jf4r1v7458xxatyl61n78mlam182j7n"
ttl=3600 "kncdppytbyyrv5c41mhg3bzsgt4t5fh4"
ttl=3600 "v=spf1 include:amazonses.com ~all"
ttl=3600 "google-site-verification=0oTWtDbnwtAqLXaQ2KWHupzKE-cchF9MTrEOfnY0Lh8"
ttl=3600 "google-site-verification=aNIlCNqHA51wZNAzd_-fO3WxY-IBDUnxlKSb-6_H7t4"
ttl=3600 "google-site-verification=lUBGtBSbscYqMmU7gTKp2DvthnY9t2lenUOrM0S8AbE"
ttl=3600 "google-site-verification=pfV-jFgI8D68IIe35m1377ShQlAuB5sgk-vOIVQnb_0"
ttl=3600 "_globalsign-domain-verification=4azHJ7gL04Dr8r2VR0txu7OrWg7uZpU6v7LOHVP1b3"
ttl=3600 "cisco-ci-domain-verification=6373af30f110b43f4977902bcf00a93bc9cee28ae08919b3ec7bca5d149f90e5"
ttl=3600 "atlassian-domain-verification=VRy9TzRKcSaph23wbUga1QyUlYweYAllWfTXzINC10E4/DUumrrLACeSTCVfKvES"
ttl=3600 "atlassian-domain-verification=a32Aj0uoXQRh6QseDFFrlufYlkbeSdok7az3sY0DQNVXpW1Iqj8zlsuXFZgHMojH"

fetched 2026-06-17T08:32:47.991Z

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

1 MX record(s) present

Why it matters: MX records direct inbound mail. Misconfiguration silently breaks email delivery and lets attackers stand up parallel MX hosts for spoofing campaigns (ISO 27001 A.8.21).

pri=5 inbound-smtp.us-east-1.amazonaws.com.

fetched 2026-06-17T08:32:47.589Z

mx

info

Open standalone →

resolving mx…

spf

medium

Open standalone →

~all softfail — receivers may still accept

Why it matters: SPF tells receiving servers which hosts may send mail for the domain. Without it, any sender can forge the envelope-from — the primary mechanism behind business-email-compromise (SOC 2 CC6.7).

Recommendations

Move to -all (hardfail) once your mail flow is confirmed — softfail gives no real protection

v=spf1 include:amazonses.com ~all

v=spf1
include:amazonses.com
~all

fetched 2026-06-17T08:32:47.668Z

spf

info

Open standalone →

resolving spf…

dmarc

low

Open standalone →

p=quarantine — receivers send to spam

Why it matters: DMARC binds SPF and DKIM into an enforceable policy (quarantine or reject) and surfaces spoofing attempts via aggregate reports. `p=none` or absent means spoofing succeeds silently (SOC 2 CC6.7).

Recommendations

Upgrade to p=reject once your SPF and DKIM pass rates are consistently high

v=DMARC1; p=quarantine; pct=50; rua=mailto:[email protected]

v=: DMARC1
p=: quarantine
pct=: 50
rua=: mailto:[email protected]

fetched 2026-06-17T08:32:47.591Z

dmarc

info

Open standalone →

resolving dmarc…

dkim

low

Open standalone →

1/6 DKIM selectors valid

Why it matters: DKIM signs outbound mail so receivers can detect tampering. Missing selectors or rotated-away keys break DMARC alignment and let receivers downgrade trust (ISO 27001 A.8.24).

Recommendations

Check the missing selectors in your DNS provider and re-add any removed records

default:: —
google:: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAlXNSJc0SOJsa6vwzTf7x/oMLjdpM6l7bvIK6GV+qt6VnlGleqbo/ejh9CIEb58F85UYXkKe3FkNbmJswIluprCAbQN0AIU6iGBBivZGKiLpYJiv7L9e4EJLS4f1rmNcUsruA1ZnSWTIh46124ySxf+NS6SPFZKr7Tkx9Y8PT9TDPHShMtuX/rDp88iiAK7S00MVu1grxrYWUpGWU93vE1FIFxlvtIEz/a4lCGrezsVmAIBj/AbDI5ny4ESI5QEWCJJbkDSRSzfeqg3tpJ7r1fpJU5TR3UMQs9xhl+C78OtAFt66YZAjVypBFJhVfCKy38LR+VRb8tfvqC18a1lLE7QIDAQAB
k1:: —
selector1:: —
selector2:: —
mxvault:: —

fetched 2026-06-17T08:32:48.130Z

dkim

info

Open standalone →

probing dkim selectors…

tls

low

Open standalone →

cert expires in 51 days

Why it matters: A valid current TLS certificate is the baseline for data in transit. Expiry, weak chain, or hostname mismatch break HTTPS and fail PCI 4.2.1 / SOC 2 CC6.1.

Recommendations

Schedule certificate renewal — consider enabling auto-renewal

subject cn:: nsone.net
issuer:: DigiCert Global G2 TLS RSA SHA256 2020 CA1 / DigiCert Inc
valid:: Jul 7 00:00:00 2025 GMT → Aug 7 23:59:59 2026 GMT
authorized:: yes
sha256:: 19:0E:CA:82:EA:82:48:91:B5:C7:F8:AB:AE:8F:EE:DF:60:11:F2:69:7B:75:58:AD:78:31:92:8A:9D:C7:83:75
sans: nsone.net
my.nsone.net
api.nsone.net
www.nsone.net
ns1.com
www.ns1.com
my.ns1.com
api.ns1.com

fetched 2026-06-17T08:32:48.483Z

tls

info

Open standalone →

fetching tls cert…

redirects

medium

Open standalone →

redirects to different domain: ibm.com

Why it matters: Bare HTTP requests must redirect to HTTPS without dropping the user mid-chain. Plain-text fallback or open redirects fail PCI 4.2.1 and feed phishing chains (SOC 2 CC6.6).

Recommendations

Verify this cross-domain redirect is intentional (e.g. domain migration or CDN)
Ensure the destination domain is owned and expected — unintended redirects can leak traffic

final status: 200 · 2 hops

[301] https://ns1.com/
[200] https://www.ibm.com/products/ns1-connect

fetched 2026-06-17T08:32:49.148Z

redirects

info

Open standalone →

tracing redirects…

headers

low

Open standalone →

3 security header(s) missing

Why it matters: Security headers — HSTS, CSP, X-Frame-Options, Referrer-Policy — defend against XSS, clickjacking, and downgrade attacks. Absent headers map directly to OWASP ASVS V14 findings (ISO 27001 A.8.23).

Recommendations

Add response header — X-Frame-Options: DENY (or SAMEORIGIN if framing is intended)
Add response header — Referrer-Policy: strict-origin-when-cross-origin
Add permissions-policy response header

final url: https://www.ibm.com/products/ns1-connect

security headers

strict-transport-security: max-age=31536000
content-security-policy: upgrade-insecure-requests; frame-ancestors 'self' https://explore.apptio.com https://explore.ibm.com
x-frame-options: —
x-content-type-options: nosniff
referrer-policy: —
permissions-policy: —

other headers

accept-ranges: bytes
cache-control: max-age=900
connection: keep-alive
content-encoding: gzip
content-length: 39262
content-type: text/html;charset=utf-8
date: Wed, 17 Jun 2026 08:32:49 GMT
etag: W/"39c7c-6546eb37e2ac3-gzip"
expires: Wed, 17 Jun 2026 08:47:49 GMT
last-modified: Wed, 17 Jun 2026 08:18:14 GMT
set-cookie: bm_sz=0B27FF83ECE86DCC904DEEE9FBE17E3F~YAAQrjtAFwxmRcqeAQAA+iu21ACYniXVJKCvg/NS+zWtYCSbl3i3MOYiZpgK77OlD94/zNXaAARkPBUE22BOALDJlmTv1BDYu60ndfmNHaq4GXiQOWG/iZKI5JGL0YagCaNUy0FJsAS8EaeznqBu1bgOMIH3Ob8nE3uUieSnmrnQbPcVDDlYGb1j+eMnBNj/XEktQv5RpchpRvVIS8/aQgtcxYyGpAZxsfwY2GoIoheHXDcCsCRM7oEmGt40Au0W8g1w2A/fya0SHObkBKQNkR5iDhdntR95DDzcTJC2EHPb4r/fTfK0pIoWEEjHP6X1jcV8NNmYdGfMo4YtuMsrsDHX043fzK2fWLcH~3486259~4277573; Domain=.ibm.com; Path=/; Expires=Wed, 17 Jun 2026 12:32:48 GMT; Max-Age=14399
vary: Accept-Encoding
x-akamai-transformed: 0 - 0 -

fetched 2026-06-17T08:32:49.149Z

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

no CORS headers — cross-origin requests blocked by default

Why it matters: Overly permissive CORS (wildcard with credentials, or reflected origin) lets any origin read authenticated responses from this domain. OWASP A05 misconfiguration territory (NIST AC-4).

origin: https://domainposture.com
method: GET
preflight status: 301

access-control-* headers

access-control-allow-origin: —
access-control-allow-methods: —
access-control-allow-headers: —
access-control-allow-credentials: —
access-control-max-age: —
access-control-expose-headers: —

no access-control-* headers returned — site does not advertise CORS to this origin

fetched 2026-06-17T08:32:48.861Z

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

HTTPS surface reachable (robots ✓, sitemap ✓, title ✓)

Why it matters: Public files — robots.txt, sitemap.xml, head meta — are what attackers see first during reconnaissance. Misadvertised paths, stale sitemaps, and verbose generators leak more than intended (ISO 27001 A.8.9).

robots.txt

present

 
<!DOCTYPE HTML>

<html lang="en">
<head>
    
      
    
    
    
    
    
    
      
    
    
    
    
    <meta charset="UTF-8"/>
    <meta name="languageCode" content="en"/>
    <meta name="countryCode" content="us"/>
    <meta name="searchTitle" content="IBM NS1 Connect"/>
    <meta name="focusArea" content="Automation NS1 reps"/>
    <meta name='primaryTaxonomyEn' content="Networking"/>
    <meta name="siteSection" content="products"/>
    <meta name="primaryTopic" content="Networking"/>
    <meta name="productName" content="IBM NS1 Connect"/>
    <meta name="pageType" content="Product - Overview"/>
    <title>IBM NS1 Connect</title>
      <meta name="content-page-ref" content="eROxip4tByGTXXkYPHZou6wfr_WKC63MQsJcDGlwB7YTh9KlL17eo0lYo4GhI3IhwO5yIsTEVhFMoHiNbyI0D31EvT5QsEfIeW33RQkBuFA"/>
<script defer="defer" type="text/javascript" src="https://rum.hlx.page/.rum/@adobe/helix-rum-js@%5E2/dist/micro.js" data-routing="program=131558,environment=1281329,tier=publish"></script>
<link rel="icon" sizes="16x16" href="/content/dam/adobe-cms/default-images/icon-16x16.png"/>
      <link rel="icon" sizes="32x32" href="/content/dam/adobe-cms/default-images/icon-32x32.png"/>
      <link rel="icon" sizes="150x150" href="/content/dam/adobe-cms/default-images/icon-150x150.png"/>
      <link rel="icon" sizes="192x192" href="/content/dam/adobe-cms/default-images/icon-192x192.png"/>
      <link rel="icon" sizes="512x512" href="/content/dam/adobe-cms/default-images/icon-512x512.png"/>
      <link rel="apple-touch-icon" sizes="57x57" href="/content/dam/adobe-cms/default-images/apple-touch-icon-57x57.png"/>
      <link rel="apple-touch-icon" sizes="76x76" href="/content/dam/adobe-cms/default-images/apple-touch-icon-76x76.png"/>
      <link rel="apple-touch-icon" sizes="120x120" href="/content/dam/adobe-cms/default-images/apple-touch-icon-120x120.png"/>
      <link rel="apple-touch-icon" sizes="152x152" href="/content/dam/adobe-cms/default-images/apple-touch-icon-152x152.png"/>
      <link rel="apple-touch-icon" sizes="180x180" href="/content/dam/adobe-cms/default-images/apple-touch-icon-180x180.png"/>

    <meta name="keywords" content="IBM NS1 Connect,Domain Name System,Networking"/>
    <meta name="description" content="IBM NS1 Connect provides managed authoritative DNS with anycast routing and automated failover to reduce latency, improve resilience and keep apps available."/>
    <meta name="template" content="full-width-layout-anchor-links"/>
    
    <meta name="viewport" content="width=device-width, initial-scale=1"/>
    <meta name="robots" content="index, follow, max-image-preview:large"/>
    
          <meta name="ut-codes" content="10A00 > 15IGO > 17FGT > 20AOF > 30A99"/>
          <meta name="ut-codes-id" content="10A00 - IBM Software > 15IGO - Automation Platform > 17FGT - Infrastructure Automation > 20AOF - Network Management > 30A99 - NS1"/>
    
    
      
      
      
      
      
    <link rel="canonical" href="https://www.ibm.com/products/ns1-connect"/>

      

    
    <link rel="preload" href="/etc.clientlibs/adobe-cms/clientlibs/clientlib-masthead-container.lc-77093780f8de7b2544462ac5bafdd6a5-lc.min.js" as="script">



    

    
    
    <script defer src="/etc.clientlibs/adobe-cms/clientlibs/clientlib-smartling-context.lc-d30c41c1c7a4511befbe3e285d76955a-lc.min.js"></script>



      

      
      <script type="text/javascript">
          !function(e, a, n, t) {
              var i = e.head;
              if (i) {
                  if (a) return;
                  var o = e.createElement("style");
                  o.id = "alloy-prehiding", o.innerText = n, i.appendChild(o),
                      setTimeout(function() {
                          o.parentNode && o.parentNode.removeChild(o)
                      }, t)
              }
          }
          (document, document.location.href.indexOf("adobe_authoring_enabled") !== -1, "body { opacity: 0 !important }", 900);
      </script>
      
      
<!--      <script type="

sitemap.xml

present — 0 url(s)

head

title: IBM NS1 Connect
description: IBM NS1 Connect provides managed authoritative DNS with anycast routing and automated failover to reduce latency, improve resilience and keep apps available.

social

og:url: https://www.ibm.com/products/ns1-connect
og:type: website
og:title: IBM NS1 Connect
og:description: IBM NS1 Connect provides managed authoritative DNS with anycast routing and automated failover to reduce latency, improve resilience and keep apps available.
og:image: https://www.ibm.com/content/dam/worldwide-content/creative-assets/s-migr/ul/g/2a/60/sc-news-3v3.png/_jcr_content/renditions/cq5dam.web.1280.1280.jpeg

fetched 2026-06-17T08:32:50.257Z

web-surface

info

Open standalone →

inspecting web surface…

dnssec

info

Open standalone →

DNSSEC enabled — DS records present and chain validated (AD flag)

Why it matters: DNSSEC cryptographically signs DNS responses, blocking cache-poisoning attacks. US federal civilian agencies are required to enable it under OMB M-22-09 (NIST SC-20).

enabled: yes
DS records: 48553 ECDSAP256SHA256 2 e2410952ef90197abc49cf186fe3ca16f6046d67072e71df3895acb7c7680fa0, DS ECDSAP256SHA256 2 86400 1782181789 1781572789 27677 com. RdGrWH0tRTYW3eklGKfKc7X8nhh5kEoG4T5MAhqClTpVXfkni8nW0FNGNYWxDJzCAVEBbeIltGR/iDRXcKuyjw==
DNSKEY records: 3 key(s)

fetched 2026-06-17T08:32:47.914Z

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

not applicable: no _mta-sts TXT record

Why it matters: MTA-STS forces inbound SMTP to use TLS and refuse downgraded connections. Without it, an in-path attacker can strip TLS and read mail in plaintext (SOC 2 CC6.7).

no _mta-sts TXT record

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

not applicable: no TLSRPT record

Why it matters: TLS-RPT publishes a reporting address for SMTP-TLS failures. Without it, downgrade attacks on inbound mail go unnoticed (SOC 2 CC7.2).

no TLSRPT record

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

domain registered until 2027-06-19

Why it matters: Registrar and expiry tell auditors the domain is owned, current, and not about to lapse. An expired or about-to-expire domain fails business-continuity evidence (SOC 2 A1.2).

registrar: CSC Corporate Domains, Inc.
created: 1996-06-20T04:00:00Z
expires: 2027-06-19T04:00:00Z
statuses: clientTransferProhibited https://icann.org/epp#clientTransferProhibited

fetched 2026-06-17T08:32:50.390Z

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

check failed: crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

Why it matters: Every certificate issued for this domain is published in Certificate Transparency logs — including subdomains you may have forgotten. Unknown subdomains in CT are pre-disclosed attack surface (ISO 27001 A.8.16).

crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.