reuters.com

15-check dossier · scoreboard above, section details below

Get a pack →

Scanning…

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

resolving mx…

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

resolving dmarc…

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

tracing redirects…

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

inspecting web surface…

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.

reuters.com

15-check dossier · scoreboard above, section details below

Get a pack →

Mostly compliant · 3 items need attention

Aggregate grade across 15 checks. Auditors typically flag any High-severity finding.

Pass: 12
Warn: 3
Fail: 0

What an auditor would flag first

medium
Security headers
5 security header(s) missing
SOC 2 CC6.6ISO 27001 A.14.1.2
low
DKIM
1/6 DKIM selectors valid
SOC 2 CC6.7
low
DNSSEC
DNSSEC not configured — no DS or DNSKEY records found
SOC 2 CC6.6ISO 27001 A.13.1.1

Need this as an artifact your auditor can verify?

Your reuters.com scan flagged 1 medium and 2 low findings. A signed pack covers the apex plus up to 100 CT-discovered subdomains, Ed25519-signed and ISO-timestamped, delivered in 10–30 minutes.

Get a pack →See methodology See a sample$29

Scanning…

15-check summary

DNS recordsA/AAAA records present
MX2 MX record(s) present
SPF-all hardfail — strict policy
DMARCp=reject — strict policy
DKIM1/6 DKIM selectors valid
TLS certificatecert valid for 190 days
Redirect chainHTTPS served correctly
Security headers5 security header(s) missing
CORSno CORS headers — cross-origin requests blocked by default
Web surfaceHTTPS surface reachable (robots ✓, sitemap ✗, title ✓)
MTA-STSnot applicable: no _mta-sts TXT record
TLS-RPTnot applicable: no TLSRPT record
DNSSECDNSSEC not configured — no DS or DNSKEY records found
WHOISdomain registered until 2027-06-02
Certificate Transparencycheck failed: crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

dns

info

Open standalone →

A/AAAA records present

Why it matters: Without authoritative A or AAAA records on the apex, the domain is unreachable. Missing baseline DNS shows up in vendor reviews as evidence of unmanaged infrastructure (SOC 2 CC6.6).

A: ttl=300 155.46.172.255
AAAA: —
NS: ttl=3600 ns-aws-1.thomsonreuters.com.
ttl=3600 ns-aws-2.thomsonreuters.net.
ttl=3600 ns-aws-3.thomsonreuters.org.
ttl=3600 ns-aws-4.thomsonreuters.co.uk.
SOA: ttl=3600 ns-aws-1.thomsonreuters.com. domain.name.thomsonreuters.com. 2024093016 3600 900 1209600 300
CAA: —
TXT: ttl=300 "MS=ms24417066"
ttl=300 "apple-domain-verification=cKpm3aVB5VEf9fQ0oxIIumulcv3CvTjrOGvqF8nUDO8"
ttl=300 "apple-domain-verification=voAz1fDhqIN4vRxG52m4VSOgLipH0OMyfJIprobVB1U"
ttl=300 "facebook-domain-verification=ra7bjxso3pnjy2p63mdc0002chquca"
ttl=300 "google-site-verification=7UwjlMmBYuyFWx01Pu6NEVEWRPD9W25PnwffZejseEg"
ttl=300 "google-site-verification=FZwUpO_E2LIEPLqcxfWRpQipxi2faQ4Qt4wyYJpJr1g"
ttl=300 "google-site-verification=LMfrSuyToK_ofO0MSu-lf5QJhLYITHNDX09ofoF7_FY"
ttl=300 "google-site-verification=O1A9GoZ5a23atyZjR2IBMnmdG-jz3mrsQ900uMn0sbY"
ttl=300 "openai-domain-verification=dv-3vP8oxOY9pDhfiwzHjba8jmZ"
ttl=300 "v=spf1 include:%{ir}.%{v}.%{d}.spf.has.pphosted.com -all"
ttl=300 "yahoo-verification-key=5bF6siWgzdkfub3ZLp8cnSL2ps44ipYuy28vgoM7qDA="

fetched 2026-06-04T02:35:59.872Z

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

2 MX record(s) present

Why it matters: MX records direct inbound mail. Misconfiguration silently breaks email delivery and lets attackers stand up parallel MX hosts for spoofing campaigns (ISO 27001 A.8.21).

pri=10 mxa-00160c04.gslb.pphosted.com.
pri=10 mxb-00160c04.gslb.pphosted.com.

fetched 2026-06-04T02:35:59.872Z

mx

info

Open standalone →

resolving mx…

spf

info

Open standalone →

-all hardfail — strict policy

Why it matters: SPF tells receiving servers which hosts may send mail for the domain. Without it, any sender can forge the envelope-from — the primary mechanism behind business-email-compromise (SOC 2 CC6.7).

v=spf1 include:%{ir}.%{v}.%{d}.spf.has.pphosted.com -all

v=spf1
include:%{ir}.%{v}.%{d}.spf.has.pphosted.com
-all

fetched 2026-06-04T02:35:59.873Z

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

p=reject — strict policy

Why it matters: DMARC binds SPF and DKIM into an enforceable policy (quarantine or reject) and surfaces spoofing attempts via aggregate reports. `p=none` or absent means spoofing succeeds silently (SOC 2 CC6.7).

v=DMARC1; p=reject; rua=mailto:dmarc_rua@emaildefense.proofpoint.com; ruf=mailto:dmarc_ruf@emaildefense.proofpoint.com

v=: DMARC1
p=: reject
rua=: mailto:dmarc_rua@emaildefense.proofpoint.com
ruf=: mailto:dmarc_ruf@emaildefense.proofpoint.com

fetched 2026-06-04T02:35:59.874Z

dmarc

info

Open standalone →

resolving dmarc…

dkim

low

Open standalone →

1/6 DKIM selectors valid

Why it matters: DKIM signs outbound mail so receivers can detect tampering. Missing selectors or rotated-away keys break DMARC alignment and let receivers downgrade trust (ISO 27001 A.8.24).

Recommendations

Check the missing selectors in your DNS provider and re-add any removed records

default:: —
google:: —
k1:: —
selector1:: v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCwjnBe+Q6zdxEJmN3yzNPD+/2YrnV8vodhqIeHr1basHFnBBwMBV9S4uGz3oH12CGQzuz92AOhdMJ+RtPO+aDJEKpOtn3N7Thkq/iNy37/8bl7i4u1zHiih3mAltrMnJ4Z1YHl6+4Gja2Vs1YZYpdCAcAC0iqQg59wf0qnT7HcKwIDAQAB; n=1024,1450207371,1466018571
selector2:: —
mxvault:: —

fetched 2026-06-04T02:35:59.876Z

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

cert valid for 190 days

Why it matters: A valid current TLS certificate is the baseline for data in transit. Expiry, weak chain, or hostname mismatch break HTTPS and fail PCI 4.2.1 / SOC 2 CC6.1.

subject cn:: thomsonreuters.com
issuer:: Sectigo Public Server Authentication CA OV R40 / Sectigo Limited
valid:: May 27 00:00:00 2026 GMT → Dec 11 23:59:59 2026 GMT
authorized:: yes
sha256:: F0:FB:52:91:6F:F5:EF:9C:C8:BB:82:79:E6:18:9B:B5:93:CC:95:C7:C6:B4:DE:5C:DA:B3:C3:0E:A0:68:5C:C7
sans: thomsonreuters.com
*.thomson.com
*.tr.com
arbsearch.com
archbolde-update.co.uk
blog.corepublishingsolutions.com
breakingviews.com
carswell.com
caselines.com
cfslaw.com
checkpoint.cl
checkpoint.com.pe
checkpointau.com.au
checkpointespana.es
checkpointmexico.com
checkpointnz.co.nz
checkpointworld.com
consumerbankruptcynews.com
consumerbankruptcynews.net
corepublishingsolutions.com
courtexpress.com
cvmail.net
cvmailasia.com
cvmailuk.com
cyberrisk-insurer.com
es-insurer.com
fastsalestax.com
findandprint.com
findprint.com
gettaxnetpro.com
gsionline.com
highq.com
hk-lawyer.org
iblj.com
impotexpert.ca
incomesdata.co.uk
informacionlegal.com.ar
informacionlegal.com.uy
informacionlegalonline.com.uy
jctadmin.com
laley.com.ar
laleynextonline.com.ar
lawtel.com
legalbusinessonline.com
legalexecutiveinstitute.com
litigationmonitor.com
livenotecentral.com
login.wbm-digital.com
monitorsuite.com
myaccount.wbm-digital.com
myroyalty.com
netlinksolution.com
netlinksolutionqa.com
newwestlaw.com
oconnors.com
odenpt.com
odentrack.com
onesourcelogin.com.au
onesourcelogin.eu
onesourcetax.com
pagerohbs.com
parametric-insurer.com
personnet.com
program-manager.com
pubemplaw.com
pubemplaw.net
quickview.com
reuters.co.uk
reuters.com
reuters.com.cn
reuters.de
reuters.es
reuters.fr
reuters.it
reutersconnect.com
revistadostribunais.com.br
roundhall.ie
rtonline.com.br
safeguard.co.nz
seccurrents.com
securrents.com
serengetilaw.com
sureprep.com
sustainable-insurer.com
sweetandmaxwell.co.uk
taxnetproplus.com
theinsurer.com
theinsurertv.com
thomson.com
thomsonreuters.ca
thomsonreuters.cn
thomsonreuters.co.jp
thomsonreuters.co.kr
thomsonreuters.co.nz
thomsonreuters.com.au
thomsonreuters.com.br
thomsonreuters.com.hk
thomsonreuters.com.my
thomsonreuters.com.pe
thomsonreuters.com.sg
thomsonreuters.es
thomsonreuters.in
thomsonreutersmexico.com
tr.com
triform.com
trymateria.ai
ufile.ca
ultratax.com
wbm-digital.com
westcheck.com
westdoc.com
westfindandprint.com
westfindprint.com
westlaw.co.nz
westlaw.com
westlaw.com.au
westlaw.com.tw
westlawasia.com
westlawbusinesscurrents.com
westlawchile.cl
westlawclassic.com
westlawcourtexpress.com
westlawhub.com
westlawinternational.com
westlawjapan.com
westlawnextcanada.com
westlawprecision.com.au
westlawpro.com
westlawrewards.com
westlawsolo.com
westlawtoday.com
westlawuk.com
westmonitor.com
wl-w.com
www.archbolde-update.co.uk
www.corepublishingsolutions.com
www.cvmailasia.com
www.cyberrisk-insurer.com
www.es-insurer.com
www.findandprint.com
www.findprint.com
www.gettaxnetpro.com
www.iblj.com
www.incomesdata.co.uk
www.laley.com.ar
www.lawtel.com
www.legalexecutiveinstitute.com
www.oconnors.com
www.pagerohbs.com
www.parametric-insurer.com
www.program-manager.com
www.reuters.com.cn
www.reuters.de
www.reuters.it
www.serengetilaw.com
www.sureprep.com
www.sustainable-insurer.com
www.taxnetproplus.com
www.theinsurertv.com
www.thomsonreuters.es
www.triform.com
www.trymateria.ai
www.wbm-digital.com
www.westfindandprint.com
www.westfindprint.com
www.westlaw.co.nz
www.westlaw.com.au
www.westlawinternational.com
www.westlawnextcanada.com

fetched 2026-06-04T02:35:59.954Z

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

HTTPS served correctly

Why it matters: Bare HTTP requests must redirect to HTTPS without dropping the user mid-chain. Plain-text fallback or open redirects fail PCI 4.2.1 and feed phishing chains (SOC 2 CC6.6).

final status: 401 · 2 hops

[301] https://reuters.com/
[401] https://www.reuters.com/

fetched 2026-06-04T02:36:00.087Z

redirects

info

Open standalone →

tracing redirects…

headers

medium

Open standalone →

5 security header(s) missing

Why it matters: Security headers — HSTS, CSP, X-Frame-Options, Referrer-Policy — defend against XSS, clickjacking, and downgrade attacks. Absent headers map directly to OWASP ASVS V14 findings (ISO 27001 A.8.23).

Recommendations

Add response header — Strict-Transport-Security: max-age=15552000; includeSubDomains
Add response header — X-Frame-Options: DENY (or SAMEORIGIN if framing is intended)
Add response header — X-Content-Type-Options: nosniff
Add response header — Referrer-Policy: strict-origin-when-cross-origin
Add permissions-policy response header

final url: https://www.reuters.com/

security headers

strict-transport-security: —
content-security-policy: frame-ancestors 'self'; report-uri https://reuters.report-uri.com/r/t/csp/enforce; report-to report-uri
x-frame-options: —
x-content-type-options: —
referrer-policy: —
permissions-policy: —

other headers

accept-ch: Sec-CH-UA,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Arch,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model,Sec-CH-Device-Memory
access-control-allow-credentials: true
access-control-allow-origin: *
access-control-expose-headers: x-dd-b, x-set-cookie
cache-control: max-age=0, private, no-cache, no-store, must-revalidate
charset: utf-8
connection: keep-alive
content-length: 774
content-type: text/html;charset=utf-8
date: Thu, 04 Jun 2026 02:36:00 GMT
pragma: no-cache
report-to: {"endpoints":[{"url":"https://reuters.report-uri.com/a/t/g"}],"group":"report-uri","include_subdomains":true,"max_age":31536000}
server: CloudFront
set-cookie: datadome=MW1PQq3FxtwlCfYxNirNDKGVGiLStHJc2F1iwh3axyYrn5FCORSdvi09uc46onnCdU5c4rVuGGFvlieSsOAbTTMgse_7cXfHH_YrG3O91gCoHr1ZU2lHPcVRgwkNc1BY; Max-Age=31536000; Domain=.reuters.com; Path=/; Secure; SameSite=Lax
via: 1.1 575969a4c4ab90c0e13ab9e2ffce2b7e.cloudfront.net (CloudFront)
x-amz-cf-id: QNmNY9RnCjONtXmZcC5KdprGlOMBLUgXoTV2Idfo75GHlWQZOJcZyw==
x-amz-cf-pop: IAD55-P10
x-cache: LambdaGeneratedResponse from cloudfront

fetched 2026-06-04T02:36:00.088Z

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

no CORS headers — cross-origin requests blocked by default

Why it matters: Overly permissive CORS (wildcard with credentials, or reflected origin) lets any origin read authenticated responses from this domain. OWASP A05 misconfiguration territory (NIST AC-4).

origin: https://domainposture.com
method: GET
preflight status: 301

access-control-* headers

access-control-allow-origin: —
access-control-allow-methods: —
access-control-allow-headers: —
access-control-allow-credentials: —
access-control-max-age: —
access-control-expose-headers: —

no access-control-* headers returned — site does not advertise CORS to this origin

fetched 2026-06-04T02:36:00.010Z

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

HTTPS surface reachable (robots ✓, sitemap ✗, title ✓)

Why it matters: Public files — robots.txt, sitemap.xml, head meta — are what attackers see first during reconnaissance. Misadvertised paths, stale sitemaps, and verbose generators leak more than intended (ISO 27001 A.8.9).

robots.txt

present

User-agent: AASA-Bot
User-agent: ADmantX
User-agent: AdsBot-Google
User-agent: AdsBot-Google-Mobile
User-agent: AmazonAdBot
User-agent: Amzn-User
User-agent: Applebot
User-agent: AppleNewsBot
User-agent: Bingbot
User-agent: BingPreview
User-agent: BrightEdge
User-agent: BrightEdgeOnCrawl
User-agent: CensysInspect
User-agent: ChatGPT-User
User-agent: Cision
User-agent: Clickagy
User-agent: Concert
User-agent: ContextualBot
User-agent: CriteoBot
User-agent: DatadogSynthetics
User-agent: datadome-pageprotect-scanner
User-agent: Discordbot
User-agent: doubleverify
User-agent: DuckDuckBot
User-agent: ElevenlabsBot
User-agent: Embedly 
User-agent: facebookexternalhit
User-agent: Googlebot
User-agent: Googlebot Smartphone
User-agent: Googlebot-News
User-agent: Google-Display-Ads-Bot
User-agent: Google-InspectionTool
User-agent: GoogleOther
User-agent: Google-Read-Aloud
User-agent: Google-Safety
User-agent: Google-Site-Verification
User-agent: GTmetrix
User-agent: GumGumBot
User-agent: ias_crawler
User-agent: Iframely
User-agent: leiki
User-agent: LinkedInBot
User-agent: LinkTiger
User-agent: Mantisbot
User-agent: Mediapartners-Google
User-agent: meta-externalads
User-agent: meta-webindexer
User-agent: MicrosoftPreview
User-agent: MJ12bot 
User-agent: Moreover
User-agent: msnbot 
User-agent: NFBNewslineRobot
User-agent: OAI-SearchBot
User-agent: Oncrawl
User-agent: Opebot-v
User-agent: Opoint
User-agent: Optimizer
User-agent: outbrain 
User-agent: Pinterestbot
User-agent: Prerender
User-agent: Proofpoint 
User-agent: proximic
User-agent: PubMatic Crawler Bot
User-agent: Quantcastbot
User-agent: Qwantbot
User-agent: Reuters SEO Screaming Frog Spider 007
User-agent: Reuters-NAUWI
User-agent: Scom-Crawler-For-Reuters
User-agent: SinceraSyntheticUser
User-agent: Slurp
User-agent: SmartologyBot
User-agent: snews
User-agent: SocialFlow
User-agent: StatusCake
User-agent: Storebot-Google
User-agent: Stripebot
User-agent: TTD-Content
User-agent: Twitterbot
User-agent: URLDefense
User-agent: Verity
User-agent: vuln_scan_by_trustedsite_com_halo_security
User-agent: WISEbot
User-agent: Xenu Link Sleuth
User-agent: Yahoo Link Preview
User-agent: Yahoo! JAPAN
User-agent: YahooMailProxy
Disallow: /finance/stocks/option
Disallow: /finance/stocks/financialHighlights
Disallow: /search
Disallow: /site-search/
Disallow: /beta
Disallow: /designtech
Disallow: /featured-optimize
Disallow: /energy-test
Disallow: /article/beta
Disallow: /sponsored/previewcampaign
Disallow: /sponsored/previewarticle
Disallow: /test/
Disallow: /news/archive/commentary
Disallow: /brandfeatures/venture-capital
Disallow: /assets/siteindex
Disallow: /article/api/
Disallow: /practical-law-the-journal/search/
Disallow: /pf/api/
Disallow: /fr/
Disallow: /it/
Disallow: /es/
Disallow: /pt/
Disallow: /de/
Disallow: /latam/
Disallow: /account/subscribe/payment/

# Block all other bots
User-agent: *
Disallow: /

SITEMAP: https://www.reuters.com/arc/outboundfeeds/sitemap-index/?outputType=xml
SITEMAP: https://www.reuters.com/arc/outboundfeeds/news-sitemap-index/?outputType=xml
SITEMAP: https://www.reuters.com/plus/sitemap-index.xml
SITEMAP: https://www.reuters.com/arc/outboundfeeds/sitemap-plj-index/?outputType=xml
SITEMAP: https://www.reuters.com/graphics/sitemap.xml
SITEMAP: https://www.reuters.com/arc/outboundfeeds/sitemap-index/pictures/?outputType=xml
SITEMAP: https://www.reuters.com/static/video-sitemap/us/sitemap_video_index.xml
SITEMAP: https://www.reuters.com/arc/outboundfeeds/topic-sitemap/?outputType=xml
SITEMAP: https://www.reuters.com/arc/outboundfeeds/author-sitemap/?outputType=xml
SITEMAP: https://www.reuters.com/arc/outboundfeeds/pressrelease-sitemap/?outputType=xml

sitemap.xml

absent

head

title: reuters.com
description: —

social

no OpenGraph or Twitter meta tags found

fetched 2026-06-04T02:36:00.271Z

web-surface

info

Open standalone →

inspecting web surface…

dnssec

low

Open standalone →

DNSSEC not configured — no DS or DNSKEY records found

Why it matters: DNSSEC cryptographically signs DNS responses, blocking cache-poisoning attacks. US federal civilian agencies are required to enable it under OMB M-22-09 (NIST SC-20).

Recommendations

Enable DNSSEC in your DNS provider's control panel and add the resulting DS record at your registrar

enabled: no
DS records: —
DNSKEY records: —

fetched 2026-06-04T02:35:59.877Z

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

not applicable: no _mta-sts TXT record

Why it matters: MTA-STS forces inbound SMTP to use TLS and refuse downgraded connections. Without it, an in-path attacker can strip TLS and read mail in plaintext (SOC 2 CC6.7).

no _mta-sts TXT record

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

not applicable: no TLSRPT record

Why it matters: TLS-RPT publishes a reporting address for SMTP-TLS failures. Without it, downgrade attacks on inbound mail go unnoticed (SOC 2 CC7.2).

no TLSRPT record

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

domain registered until 2027-06-02

Why it matters: Registrar and expiry tell auditors the domain is owned, current, and not about to lapse. An expired or about-to-expire domain fails business-continuity evidence (SOC 2 A1.2).

registrar: MarkMonitor Inc.
created: 1993-06-03T04:00:00Z
expires: 2027-06-02T04:00:00Z
statuses: clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited, clientTransferProhibited https://icann.org/epp#clientTransferProhibited, clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited, serverDeleteProhibited https://icann.org/epp#serverDeleteProhibited, serverTransferProhibited https://icann.org/epp#serverTransferProhibited, serverUpdateProhibited https://icann.org/epp#serverUpdateProhibited

fetched 2026-06-04T02:36:00.254Z

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

check failed: crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

Why it matters: Every certificate issued for this domain is published in Certificate Transparency logs — including subdomains you may have forgotten. Unknown subdomains in CT are pre-disclosed attack surface (ISO 27001 A.8.16).

crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.