statuspage.io

15-check dossier · scoreboard above, section details below

Get a pack →

Scanning…

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

resolving mx…

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

resolving dmarc…

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

tracing redirects…

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

inspecting web surface…

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.

statuspage.io

15-check dossier · scoreboard above, section details below

Get a pack →

Mostly compliant · 5 items need attention

Aggregate grade across 15 checks. Auditors typically flag any High-severity finding.

Pass: 10
Warn: 5
Fail: 0

What an auditor would flag first

medium
Redirect chain
redirects to different domain: atlassian.com
SOC 2 CC6.6
low
DMARC
p=quarantine — receivers send to spam
SOC 2 CC6.7ISO 27001 A.13.2.1
low
DKIM
no DKIM selectors found — likely not configured
SOC 2 CC6.7

Need this as an artifact your auditor can verify?

Your statuspage.io scan flagged 1 medium and 4 low findings. A signed pack covers the apex plus up to 100 CT-discovered subdomains, Ed25519-signed and ISO-timestamped, delivered in 10–30 minutes.

Get a pack →See methodology See a sample$29

Scanning…

15-check summary

DNS recordsA/AAAA records present
MX2 MX record(s) present
SPF-all hardfail — strict policy
DMARCp=quarantine — receivers send to spam
DKIMno DKIM selectors found — likely not configured
TLS certificatecert valid for 195 days
Redirect chainredirects to different domain: atlassian.com
Security headers2 security header(s) missing
CORSCORS allows all origins (wildcard)
Web surfaceHTTPS surface reachable (robots ✓, sitemap ✓, title ✓)
MTA-STSnot applicable: no _mta-sts TXT record
TLS-RPTnot applicable: no TLSRPT record
DNSSECDNSSEC not configured — no DS or DNSKEY records found
WHOISdomain registered until 2026-10-04
Certificate Transparencycheck failed: crt.sh: Error: crt.sh http 502; certspotter: Error: certspotter http 429

dns

info

Open standalone →

A/AAAA records present

Why it matters: Without authoritative A or AAAA records on the apex, the domain is unreachable. Missing baseline DNS shows up in vendor reviews as evidence of unmanaged infrastructure (SOC 2 CC6.6).

A: ttl=60 104.192.142.22
ttl=60 104.192.142.23
ttl=60 104.192.142.21
AAAA: —
NS: ttl=168254 ns-1407.awsdns-47.org.
ttl=168254 ns-1560.awsdns-03.co.uk.
ttl=168254 ns-209.awsdns-26.com.
ttl=168254 ns-951.awsdns-54.net.
SOA: ttl=900 ns-951.awsdns-54.net. awsdns-hostmaster.amazon.com. 1 7200 900 1209600 86400
CAA: ttl=60 \# 17 00 05 69 73 73 75 65 61 6d 61 7a 6f 6e 2e 63 6f 6d
ttl=60 \# 19 00 05 69 73 73 75 65 64 69 67 69 63 65 72 74 2e 63 6f 6d
ttl=60 \# 21 00 05 69 73 73 75 65 67 6c 6f 62 61 6c 73 69 67 6e 2e 63 6f 6d
ttl=60 \# 22 00 05 69 73 73 75 65 6c 65 74 73 65 6e 63 72 79 70 74 2e 6f 72 67
ttl=60 \# 21 00 09 69 73 73 75 65 77 69 6c 64 61 6d 61 7a 6f 6e 2e 63 6f 6d
ttl=60 \# 23 00 09 69 73 73 75 65 77 69 6c 64 64 69 67 69 63 65 72 74 2e 63 6f 6d
ttl=60 \# 25 00 09 69 73 73 75 65 77 69 6c 64 67 6c 6f 62 61 6c 73 69 67 6e 2e 63 6f 6d
ttl=60 \# 26 00 09 69 73 73 75 65 77 69 6c 64 6c 65 74 73 65 6e 63 72 79 70 74 2e 6f 72 67
TXT: ttl=60 "SFMC-k6tc5_kcwDD4vNhCY65ImqbNbCetuyAdSOWreKAA"
ttl=60 "_globalsign-domain-verification=0ISjM10U68zo6oyjs9NxDrI3npflSrk0BVSbP0ZXEb"
ttl=60 "a4XOb8RNSDe4sZQ7kd79ew+HuKAI1NmENNqzOpkjtIk="
ttl=60 "facebook-domain-verification=u6rksxst6qpaqqry3gqk0ngt1ud9af"
ttl=60 "google-site-verification=-9xBoSPmbUW5V35ytfb8Z0NxbE9HqrbynZeQq-HF6qY"
ttl=60 "google-site-verification=ArCKLH66OxQ0xcY7YgF7giNnfD6NCwoiC2CUldVZ0yo"
ttl=60 "google-site-verification=FltdgN-eX4GYMRahSH5gT3NVLTKUUyyksC8h5QpAAtQ"
ttl=60 "google-site-verification=NFE2UTz9SrcdCrM1NYGLbayXrSKRh3aGy5YecCgKAQg"
ttl=60 "google-site-verification=PuQYL9W43MA9bIdw4ocg68G5lbpGbsHAxspUvR7yzvA"
ttl=60 "google-site-verification=ZIhye_cvik9SZOuvAd_3MUpUL8ndiqKIwiE8kwNqArQ"
ttl=60 "v=spf1 include:stspg-customer.com include:customeriomail.com include:_spf.google.com ip4:205.201.128.0/20 ip4:198.2.128.0/18 -all"

fetched 2026-06-04T04:44:44.216Z

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

2 MX record(s) present

Why it matters: MX records direct inbound mail. Misconfiguration silently breaks email delivery and lets attackers stand up parallel MX hosts for spoofing campaigns (ISO 27001 A.8.21).

pri=10 mxa-001d9801.gslb.pphosted.com.
pri=10 mxb-001d9801.gslb.pphosted.com.

fetched 2026-06-04T04:44:44.216Z

mx

info

Open standalone →

resolving mx…

spf

info

Open standalone →

-all hardfail — strict policy

Why it matters: SPF tells receiving servers which hosts may send mail for the domain. Without it, any sender can forge the envelope-from — the primary mechanism behind business-email-compromise (SOC 2 CC6.7).

v=spf1 include:stspg-customer.com include:customeriomail.com include:_spf.google.com ip4:205.201.128.0/20 ip4:198.2.128.0/18 -all

v=spf1
include:stspg-customer.com
include:customeriomail.com
include:_spf.google.com
ip4:205.201.128.0/20
ip4:198.2.128.0/18
-all

fetched 2026-06-04T04:44:44.297Z

spf

info

Open standalone →

resolving spf…

dmarc

low

Open standalone →

p=quarantine — receivers send to spam

Why it matters: DMARC binds SPF and DKIM into an enforceable policy (quarantine or reject) and surfaces spoofing attempts via aggregate reports. `p=none` or absent means spoofing succeeds silently (SOC 2 CC6.7).

Recommendations

Upgrade to p=reject once your SPF and DKIM pass rates are consistently high

v=DMARC1; p=quarantine; sp=quarantine; fo=1; pct=100; rua=mailto:dmarc_rua@emaildefense.proofpoint.com,mailto:dmarc-rua@abuse.atlassian.com; ruf=mailto:dmarc_ruf@emaildefense.proofpoint.com,mailto:dmarc-ruf@abuse.atlassian.com

v=: DMARC1
p=: quarantine
sp=: quarantine
fo=: 1
pct=: 100
rua=: mailto:dmarc_rua@emaildefense.proofpoint.com,mailto:dmarc-rua@abuse.atlassian.com
ruf=: mailto:dmarc_ruf@emaildefense.proofpoint.com,mailto:dmarc-ruf@abuse.atlassian.com

fetched 2026-06-04T04:44:44.217Z

dmarc

info

Open standalone →

resolving dmarc…

dkim

low

Open standalone →

no DKIM selectors found — likely not configured

Why it matters: DKIM signs outbound mail so receivers can detect tampering. Missing selectors or rotated-away keys break DMARC alignment and let receivers downgrade trust (ISO 27001 A.8.24).

Recommendations

Enable DKIM signing in your mail provider and publish the provided TXT record
Common selectors: google._domainkey, selector1._domainkey (Microsoft), mail._domainkey

no DKIM record on probed selectors (default, google, k1, selector1, selector2, mxvault)

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

cert valid for 195 days

Why it matters: A valid current TLS certificate is the baseline for data in transit. Expiry, weak chain, or hostname mismatch break HTTPS and fail PCI 4.2.1 / SOC 2 CC6.1.

subject cn:: *.statuspage.io
issuer:: Amazon ECDSA 256 M04 / Amazon
valid:: Jun 2 00:00:00 2026 GMT → Dec 16 23:59:59 2026 GMT
authorized:: yes
sha256:: A7:75:38:AB:B3:C2:81:0F:15:7E:90:CE:27:59:D9:84:69:AB:D8:C8:CF:ED:DF:28:E0:A8:7E:68:02:23:E9:AB
sans: *.statuspage.io
statuspage.io

fetched 2026-06-04T04:44:44.084Z

tls

info

Open standalone →

fetching tls cert…

redirects

medium

Open standalone →

redirects to different domain: atlassian.com

Why it matters: Bare HTTP requests must redirect to HTTPS without dropping the user mid-chain. Plain-text fallback or open redirects fail PCI 4.2.1 and feed phishing chains (SOC 2 CC6.6).

Recommendations

Verify this cross-domain redirect is intentional (e.g. domain migration or CDN)
Ensure the destination domain is owned and expected — unintended redirects can leak traffic

final status: 200 · 2 hops

[301] https://statuspage.io/
[200] https://www.atlassian.com/software/statuspage

fetched 2026-06-04T04:44:44.288Z

redirects

info

Open standalone →

tracing redirects…

headers

info

Open standalone →

2 security header(s) missing

Why it matters: Security headers — HSTS, CSP, X-Frame-Options, Referrer-Policy — defend against XSS, clickjacking, and downgrade attacks. Absent headers map directly to OWASP ASVS V14 findings (ISO 27001 A.8.23).

Recommendations

Add response header — Referrer-Policy: strict-origin-when-cross-origin
Add permissions-policy response header

final url: https://www.atlassian.com/software/statuspage

security headers

strict-transport-security: max-age=63072000; preload
content-security-policy: frame-ancestors 'none';
x-frame-options: deny
x-content-type-options: nosniff
referrer-policy: —
permissions-policy: —

other headers

age: 248
alt-svc: h3=":443"; ma=86400
atl-request-id: 466b8522-aed7-49b5-8c35-6bd4c5aedb36
atl-traceid: 466b8522aed749b58c356bd4c5aedb36
cache-control: max-age=0, s-maxage=8400, stale-while-revalidate=43200, stale-if-error=43200, no-cache="Set-Cookie"
connection: keep-alive
content-encoding: br
content-type: text/html;charset=UTF-8
date: Thu, 04 Jun 2026 04:40:36 GMT
last-modified: Wed, 03 Jun 2026 22:12:31 GMT
nel: {"failure_fraction": 0.01, "include_subdomains": true, "max_age": 600, "report_to": "endpoint-1"}
report-to: {"endpoints": [{"url": "https://dz8aopenkvv6s.cloudfront.net"}], "group": "endpoint-1", "include_subdomains": true, "max_age": 600}
server: AtlassianEdge
server-timing: cdn-cache-hit,cdn-pop;desc="IAD61-P1",cdn-rid;desc="RnDioWv5Jw2zNgkQ8XHbs8POX_tHQUqsI9Lc2xHQ79_gXplbBgg4NA==",cdn-hit-layer;desc="EDGE",cdn-downstream-fbl;dur=36
transfer-encoding: chunked
vary: Accept-Encoding
via: 1.1 64c95802ff188dd41dd32c313bef089c.cloudfront.net (CloudFront)
x-amz-cf-id: RnDioWv5Jw2zNgkQ8XHbs8POX_tHQUqsI9Lc2xHQ79_gXplbBgg4NA==
x-amz-cf-pop: IAD61-P1
x-cache: Hit from cloudfront
x-envoy-attempt-count: 1
x-magnolia-registration: Registered
x-xss-protection: 1; mode=block

fetched 2026-06-04T04:44:44.313Z

headers

info

Open standalone →

fetching headers…

cors

low

Open standalone →

CORS allows all origins (wildcard)

Why it matters: Overly permissive CORS (wildcard with credentials, or reflected origin) lets any origin read authenticated responses from this domain. OWASP A05 misconfiguration territory (NIST AC-4).

Recommendations

Restrict Access-Control-Allow-Origin to specific trusted origins if this API is not fully public

origin: https://domainposture.com
method: GET
preflight status: 301

access-control-* headers

access-control-allow-origin: *
access-control-allow-methods: —
access-control-allow-headers: —
access-control-allow-credentials: —
access-control-max-age: —
access-control-expose-headers: —

fetched 2026-06-04T04:44:44.223Z

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

HTTPS surface reachable (robots ✓, sitemap ✓, title ✓)

Why it matters: Public files — robots.txt, sitemap.xml, head meta — are what attackers see first during reconnaissance. Misadvertised paths, stale sitemaps, and verbose generators leak more than intended (ISO 27001 A.8.9).

robots.txt

present

<!DOCTYPE html>




<html id="magnolia" lang="en"> <head> <meta charset="utf-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge, chrome=1"> <meta name="viewport" content="width=device-width, initial-scale=1"> <meta property="fb:pages" content="115407078489594" /> <meta name="description" content="Statuspage provides real-time incident communication and status updates. Keep customers informed, build trust, and enhance transparency. Start now!"> <meta name="author" content="Atlassian"> <link rel="canonical" href="https://www.atlassian.com/software/statuspage"/> <title> Improve Transparency with Statuspage | Atlassian </title> <link rel="preload" href="https://assets.ctfassets.net/rz1oowkt5gyp/41EruTPEOU9hcBwH94UVuZ/73ac40404d750278b451bf2adf186b1b/Charlie_Text-Regular.woff2" as="font" type="font/woff2" crossorigin> <link rel="preload" href="https://assets.ctfassets.net/rz1oowkt5gyp/2d4nxzJwX8hfIqUN71D4OD/5e2c0c2a3677d935e91dd46635d5149d/Charlie_Text-Semibold.woff2" as="font" type="font/woff2" crossorigin> <link rel="preload" href="https://assets.ctfassets.net/rz1oowkt5gyp/6fvn66mVrRz4Yw3gQoPaJJ/458e6a69f0036d1e566e028fcbc26a50/Charlie_Text-Bold.woff2" as="font" type="font/woff2" crossorigin> <link rel="preload" href="https://assets.ctfassets.net/rz1oowkt5gyp/2AZXOOAKgaXV55fqGI098Y/bb085d34b97c542aedea66d5e4d9bc95/Charlie_Text-Black.woff2" as="font" type="font/woff2" crossorigin> <link rel="preload" href="https://assets.ctfassets.net/rz1oowkt5gyp/3KRSiun937K2pXBPYiUwgB/17f578e7699c12924de360e09c018c7c/Charlie_Display-Semibold.woff2" as="font" type="font/woff2" crossorigin> <link rel="preload" href="https://assets.ctfassets.net/rz1oowkt5gyp/2QtjA2B9aCIa8HvyZcNWqL/886e02c2b15732bc62dc9550078d991c/Charlie_Display-Black.woff2" as="font" type="font/woff2" crossorigin> <link rel="stylesheet" href="https://wac-cdn.atlassian.com/static/master/10906/assets/build/css/wpl-main.css?cdnVersion=3426" id="main-css" /> <link href="https://wac-cdn.atlassian.com" rel="preconnect"> <script type="text/javascript" src="https://wac-cdn.atlassian.com/static/master/10906/assets/build/js/head.js?cdnVersion=3426"></script> <link rel="alternate" href="https://www.atlassian.com/software/statuspage" hreflang="x-default" /> <link rel="alternate" href="https://www.atlassian.com/software/statuspage" hreflang="en" /> <link rel="alternate" href="https://www.atlassian.com/ja/software/statuspage" hreflang="ja" /> <link rel="alternate" href="https://www.atlassian.com/fr/software/statuspage" hreflang="fr" /> <link rel="alternate" href="https://www.atlassian.com/de/software/statuspage" hreflang="de" /> <link rel="alternate" href="https://www.atlassian.com/es/software/statuspage" hreflang="es" /> <link rel="alternate" href="https://www.atlassian.com/br/software/statuspage" hreflang="pt-BR" /> <link rel="alternate" href="https://www.atlassian.com/zh/software/statuspage" hreflang="zh-Hans" /> <link rel="alternate" href="https://www.atlassian.com/ko/software/statuspage" hreflang="ko" /> <link rel="alternate" href="https://www.atlassian.com/ru/software/statuspage" hreflang="ru" /> <link rel="alternate" href="https://www.atlassian.com/pl/software/statuspage" hreflang="pl" /> <link rel="alternate" href="https://www.atlassian.com/it/software/statuspage" hreflang="it" /> <link rel="alternate" href="https://www.atlassian.com/nl/software/statuspage" hreflang="nl" /> <link rel="alternate" href="https://www.atlassian.com/hu/software/statuspage" hreflang="hu" /> <script src="https://www.recaptcha.net/recaptcha/api.js?render=6Le9VxMnAAAAALKRlj8jmKwUYmFTZWcF0y4o9QeD"></script> <link rel="apple-touch-icon" sizes="16x16" href="/favicon-16x16.png" /> <link rel="apple-touch-icon" sizes="32x32" href="/favicon-32x32.png" /> <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png" /> <link rel="icon" type="image/png" href="/favicon-32x32.png" sizes="32x32" /> <meta name="theme-color" content="#205081"> <meta property="og:title" content="Improve Transparency with Statuspage | Atlassian" /> <meta property="og:description" content="Statuspage provides real-time inci

web-surface

info

Open standalone →

inspecting web surface…

dnssec

low

Open standalone →

DNSSEC not configured — no DS or DNSKEY records found

Why it matters: DNSSEC cryptographically signs DNS responses, blocking cache-poisoning attacks. US federal civilian agencies are required to enable it under OMB M-22-09 (NIST SC-20).

Recommendations

Enable DNSSEC in your DNS provider's control panel and add the resulting DS record at your registrar

enabled: no
DS records: —
DNSKEY records: —

fetched 2026-06-04T04:44:44.227Z

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

not applicable: no _mta-sts TXT record

Why it matters: MTA-STS forces inbound SMTP to use TLS and refuse downgraded connections. Without it, an in-path attacker can strip TLS and read mail in plaintext (SOC 2 CC6.7).

no _mta-sts TXT record

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

not applicable: no TLSRPT record

Why it matters: TLS-RPT publishes a reporting address for SMTP-TLS failures. Without it, downgrade attacks on inbound mail go unnoticed (SOC 2 CC7.2).

no TLSRPT record

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

domain registered until 2026-10-04

Why it matters: Registrar and expiry tell auditors the domain is owned, current, and not about to lapse. An expired or about-to-expire domain fails business-continuity evidence (SOC 2 A1.2).

registrar: MarkMonitor Inc.
created: 2012-10-04T20:55:32Z
expires: 2026-10-04T20:55:32Z
statuses: clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited, clientTransferProhibited https://icann.org/epp#clientTransferProhibited, clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited

fetched 2026-06-04T04:44:44.666Z

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

check failed: crt.sh: Error: crt.sh http 502; certspotter: Error: certspotter http 429

Why it matters: Every certificate issued for this domain is published in Certificate Transparency logs — including subdomains you may have forgotten. Unknown subdomains in CT are pre-disclosed attack surface (ISO 27001 A.8.16).

crt.sh: Error: crt.sh http 502; certspotter: Error: certspotter http 429

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.