twilio.com

15-check dossier · scoreboard above, section details below

Get a pack →

Scanning…

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

resolving mx…

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

resolving dmarc…

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

tracing redirects…

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

inspecting web surface…

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.

twilio.com

15-check dossier · scoreboard above, section details below

Get a pack →

Mostly compliant · 4 items need attention

Aggregate grade across 15 checks. Auditors typically flag any High-severity finding.

Pass: 11
Warn: 4
Fail: 0

What an auditor would flag first

medium
SPF
~all softfail — receivers may still accept
SOC 2 CC6.7ISO 27001 A.13.2.1
low
DKIM
no DKIM selectors found — likely not configured
SOC 2 CC6.7
low
Security headers
3 security header(s) missing
SOC 2 CC6.6ISO 27001 A.14.1.2

Need this as an artifact your auditor can verify?

Your twilio.com scan flagged 1 medium and 3 low findings. A signed pack covers the apex plus up to 100 CT-discovered subdomains, Ed25519-signed and ISO-timestamped, delivered in 10–30 minutes.

Get a pack →See methodology See a sample$29

Scanning…

15-check summary

DNS recordsA/AAAA records present
MX1 MX record(s) present
SPF~all softfail — receivers may still accept
DMARCp=reject — strict policy
DKIMno DKIM selectors found — likely not configured
TLS certificatecert valid for 236 days
Redirect chainHTTPS served correctly
Security headers3 security header(s) missing
CORSno CORS headers — cross-origin requests blocked by default
Web surfaceHTTPS surface reachable (robots ✓, sitemap ✓, title ✓)
MTA-STSnot applicable: no _mta-sts TXT record
TLS-RPTnot applicable: no TLSRPT record
DNSSECDNSSEC not configured — no DS or DNSKEY records found
WHOISdomain registered until 2026-10-26
Certificate Transparencycheck failed: crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

dns

info

Open standalone →

A/AAAA records present

Why it matters: Without authoritative A or AAAA records on the apex, the domain is unreachable. Missing baseline DNS shows up in vendor reviews as evidence of unmanaged infrastructure (SOC 2 CC6.6).

A: ttl=60 44.199.52.48
ttl=60 35.168.222.240
ttl=60 52.6.206.82
AAAA: —
NS: ttl=86400 a11-64.akam.net.
ttl=86400 a1-83.akam.net.
ttl=86400 ns0.dnsmadeeasy.com.
ttl=86400 ns2.dnsmadeeasy.com.
ttl=86400 ns1.dnsmadeeasy.com.
ttl=86400 a24-65.akam.net.
SOA: ttl=86400 ns10.digicertdns.com. dns.digicertdns.com. 2009011340 43200 3600 1209600 180
CAA: —
TXT: ttl=1800 "openai-domain-verification=dv-660q3F4hQWHD70dOGQbDqmNZ"
ttl=1800 "google-site-verification=Rfi2Zz33oxseY2WQ0joWtfJM6F5HQsr1Ot6kweOKSlE"
ttl=1800 "MS=ms26172148"
ttl=1800 "vmware-cloud-verification-e92a5542-59e1-45be-b4e6-dc115eafd1ad"
ttl=1800 "00D400000008nJq=1TBVr0000000Jtt"
ttl=1800 "facebook-domain-verification=3uqw7lrpq6cfmnktca43mpxfj0g28d"
ttl=1800 "bugcrowd-verification=3969d81794536747ab8161a0b2fd0643"
ttl=1800 "postman-domain-verification=f0b8d730f5c76f2cf6029aac31e0f8da6306d8eaa115de86bde3ebaa52117090e5e58e45983bb40028bdfc80d5340c56fc0f82088de3b1ea8b2c3d044eae2be3"
ttl=1800 "apple-domain-verification=49jLbFA6xLVS1fkP"
ttl=1800 "adobe-idp-site-verification=fffd1134c05fcc6abf6abba35358da8d4e9de6c430aff005e34a001ce9bba1c9"
ttl=1800 "dropbox-domain-verification=dgonrkgysano"
ttl=1800 "dropbox-domain-verification=hqr3zthw8xty"
ttl=1800 "firebase=video-app-79418"
ttl=1800 "docusign=f8706246-75ff-46d8-a204-e54e1803b2e8"
ttl=1800 "traction-guest=90dfe42d-e4f2-43e0-b512-335ee3d5c889"
ttl=1800 "status-page-domain-verification=4zrkrcj7tvnq"
ttl=1800 "MS=3F23BCCFCBA21AAD5F86C2F70892F3FA663AB0B6"
ttl=1800 "wework-site-verification=Ts9SCSJkkLmOvzCP"
ttl=1800 "loom-site-verification=7b6d0f7c1acd40d49aca8240ec39bfae"
ttl=1800 "elevenlabs=jmfUYfN3P0JZ73UtSA2GQT9CALvzuQqmYzIcGuvhu-c"
ttl=1800 "miro-verification=8aebed113835965c11f5d3efdcf41f0f76783644"
ttl=1800 "drift-domain-verification=037d796c2fb963479b208d9589d914d89464ce0a62d2d3ce4a0fca032822d1a3"
ttl=1800 "globalsign-domain-verification=Mu0l5q7-DpNUoQavDtNZzf0uJbIEPoIvjC3sh0RVs4"
ttl=1800 "google-site-verification=kmSE1Jv0PlKHn28y-gpZYDqYcnu7TGNlONXeQSXPQN8"
ttl=1800 "segment-site-verification=3Wcs67F61NFgMQVYs1r4YGFb6wFblu0v"
ttl=1800 "onetrust-domain-verification=4ce11987a86b4e0dbd19e37653d62f67"
ttl=1800 "segment-site-verification=E8tmyWjOlO0KoUvUJ0UsO65V3d33Xow1"
ttl=1800 "gather-domain-verification=29a3210e-0507-483e-b475-c43d7ac90197"
ttl=1800 "anthropic-domain-verification-az2gvc=09vnyAMIwiYq5irLNebDImQAG"
ttl=1800 "google-site-verification=aYAie_U7Bmz0fF3bArdMXDa2NnMIj6c7ZZjruQdrQFs"
ttl=1800 "canva-site-verification=MEs-7JGKac7VRzKB54S5Kg"
ttl=1800 "teamviewer-sso-verification=754b8ddf2c41471fb3ae968eca176dbe"
ttl=1800 "google-site-verification=bM-rhtBCm6TIyWkPJYC3iFZoxbZovlvpk1yr_0HIvS0"
ttl=1800 "mixpanel-domain-verify=2e11ad0f-d070-4c8d-83f4-0158986cf75c"
ttl=1800 "h1-domain-verification=J2qsDnS3ux5yHUVC87BfU7VfHxTUkMWaYCZKKwW4GjG3sHui"
ttl=1800 "59b8eec3-90c4-4dd1-b37d-1996dd18c5cd"
ttl=1800 "keybase-site-verification=bSkY9Ol3WL1ofhJnH_cjty8u3H1w823Iuu0F6M7UyQs"
ttl=1800 "atlassian-domain-verification=W7l5tMItTm4lNEq8QOucCxLdAbqWNuMG6fHGtkVrN1HsVvbh7EyRFF6gNLpiUgdB"
ttl=1800 "atlassian-domain-verification=kZjnh7EbCCFuwNJggkbSlB7z9mNrZWe3mkTow6/YMhjtTcfRM0NecIsYYX11undU"
ttl=1800 "v=spf1 include:twilio.com._nspf.vali.email include:%{i}._ip.%{h}._ehlo.%{d}._spf.vali.email ~all"

fetched 2026-06-04T02:36:10.146Z

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

1 MX record(s) present

Why it matters: MX records direct inbound mail. Misconfiguration silently breaks email delivery and lets attackers stand up parallel MX hosts for spoofing campaigns (ISO 27001 A.8.21).

pri=0 smtp.google.com.

fetched 2026-06-04T02:36:10.146Z

mx

info

Open standalone →

resolving mx…

spf

medium

Open standalone →

~all softfail — receivers may still accept

Why it matters: SPF tells receiving servers which hosts may send mail for the domain. Without it, any sender can forge the envelope-from — the primary mechanism behind business-email-compromise (SOC 2 CC6.7).

Recommendations

Move to -all (hardfail) once your mail flow is confirmed — softfail gives no real protection

v=spf1 include:twilio.com._nspf.vali.email include:%{i}._ip.%{h}._ehlo.%{d}._spf.vali.email ~all

v=spf1
include:twilio.com._nspf.vali.email
include:%{i}._ip.%{h}._ehlo.%{d}._spf.vali.email
~all

fetched 2026-06-04T02:36:10.147Z

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

p=reject — strict policy

Why it matters: DMARC binds SPF and DKIM into an enforceable policy (quarantine or reject) and surfaces spoofing attempts via aggregate reports. `p=none` or absent means spoofing succeeds silently (SOC 2 CC6.7).

v=DMARC1; p=reject; rua=mailto:dmarc_agg@vali.email; ruf=mailto:dmarc@twilio.com

v=: DMARC1
p=: reject
rua=: mailto:dmarc_agg@vali.email
ruf=: mailto:dmarc@twilio.com

fetched 2026-06-04T02:36:10.147Z

dmarc

info

Open standalone →

resolving dmarc…

dkim

low

Open standalone →

no DKIM selectors found — likely not configured

Why it matters: DKIM signs outbound mail so receivers can detect tampering. Missing selectors or rotated-away keys break DMARC alignment and let receivers downgrade trust (ISO 27001 A.8.24).

Recommendations

Enable DKIM signing in your mail provider and publish the provided TXT record
Common selectors: google._domainkey, selector1._domainkey (Microsoft), mail._domainkey

no DKIM record on probed selectors (default, google, k1, selector1, selector2, mxvault)

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

cert valid for 236 days

Why it matters: A valid current TLS certificate is the baseline for data in transit. Expiry, weak chain, or hostname mismatch break HTTPS and fail PCI 4.2.1 / SOC 2 CC6.1.

subject cn:: *.twilio.com
issuer:: Amazon RSA 2048 M01 / Amazon
valid:: Dec 28 00:00:00 2025 GMT → Jan 26 23:59:59 2027 GMT
authorized:: yes
sha256:: 27:D1:60:C8:A7:94:C6:D8:F6:36:CA:87:35:59:64:2D:65:7E:1B:91:90:2A:B6:86:53:F2:D2:70:F8:BE:C3:07
sans: *.twilio.com
*.internal.us1.twilio.com
*.twilio.org
*.au1.twilio.com
*.internal.ie1.twilio.com
*.internal.au1.twilio.com
*.internal.twilio.com
*.ie1.twilio.com
twilio.com
*.us1.twilio.com

fetched 2026-06-04T02:36:10.151Z

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

HTTPS served correctly

Why it matters: Bare HTTP requests must redirect to HTTPS without dropping the user mid-chain. Plain-text fallback or open redirects fail PCI 4.2.1 and feed phishing chains (SOC 2 CC6.6).

final status: 200 · 3 hops

[301] https://twilio.com/
[301] https://www.twilio.com/
[200] https://www.twilio.com/en-us

fetched 2026-06-04T02:36:10.241Z

redirects

info

Open standalone →

tracing redirects…

headers

low

Open standalone →

3 security header(s) missing

Why it matters: Security headers — HSTS, CSP, X-Frame-Options, Referrer-Policy — defend against XSS, clickjacking, and downgrade attacks. Absent headers map directly to OWASP ASVS V14 findings (ISO 27001 A.8.23).

Recommendations

Add response header — Content-Security-Policy: default-src 'self' (tune per app)
Add response header — Referrer-Policy: strict-origin-when-cross-origin
Add permissions-policy response header

final url: https://www.twilio.com/en-us

security headers

strict-transport-security: max-age=31557600
content-security-policy: —
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
referrer-policy: —
permissions-policy: —

other headers

accept-ranges: bytes
age: 214
cache-control: max-age=600,stale-while-revalidate=30,stale-if-error=7200
connection: keep-alive
content-encoding: gzip
content-length: 95449
content-type: text/html;charset=utf-8
date: Thu, 04 Jun 2026 02:32:36 GMT
etag: "ae4ae-65363a60b0986-gzip"
expires: Thu, 04 Jun 2026 02:37:36 GMT
last-modified: Thu, 04 Jun 2026 01:41:52 GMT
set-cookie: affinity="5d9188f07c566013"; Path=/; HttpOnly; secure
vary: Accept-Encoding
via: 1.1 6c1ad5735448633ec32f42aeac09a99e.cloudfront.net (CloudFront)
x-amz-cf-id: v8h-KYgw1HuIZOqdF20-BIvgg7qjuXiY4qtrrsExmjvxQtj7xzxWRg==
x-amz-cf-pop: IAD12-P5
x-cache: Hit from cloudfront
x-served-by: cache-iad-kcgs7200022-IAD
x-timer: S1780537357.530759,VS0,VS0,VE33
x-vhost: twilio-com

fetched 2026-06-04T02:36:10.293Z

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

no CORS headers — cross-origin requests blocked by default

Why it matters: Overly permissive CORS (wildcard with credentials, or reflected origin) lets any origin read authenticated responses from this domain. OWASP A05 misconfiguration territory (NIST AC-4).

origin: https://domainposture.com
method: GET
preflight status: 301

access-control-* headers

access-control-allow-origin: —
access-control-allow-methods: —
access-control-allow-headers: —
access-control-allow-credentials: —
access-control-max-age: —
access-control-expose-headers: —

no access-control-* headers returned — site does not advertise CORS to this origin

fetched 2026-06-04T02:36:10.183Z

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

HTTPS surface reachable (robots ✓, sitemap ✓, title ✓)

Why it matters: Public files — robots.txt, sitemap.xml, head meta — are what attackers see first during reconnaissance. Misadvertised paths, stale sitemaps, and verbose generators leak more than intended (ISO 27001 A.8.9).

robots.txt

present

User-agent: *

Disallow: /resources/
Disallow: /azure
Disallow: /search
Disallow: /help/search

# 'Allow' - nonstandard REP Directive
Allow: /docs/libraries/reference/twilio-php/index.html
Allow: /docs/libraries/reference/twilio-node/index.html
Allow: /docs/libraries/reference/twilio-java/index.html
Allow: /docs/libraries/reference/twilio-ruby/index.html
Allow: /docs/libraries/reference/twilio-python/index.html
Allow: /docs/libraries/reference/twilio-csharp/index.html

Disallow: /docs/libraries/reference/twilio-php/
Disallow: /docs/libraries/reference/twilio-node/
Disallow: /docs/libraries/reference/twilio-java/
Disallow: /docs/libraries/reference/twilio-ruby/
Disallow: /docs/libraries/reference/twilio-python/
Disallow: /docs/libraries/reference/twilio-csharp/
Disallow: /docs/admin/
Disallow: /en-us/test
Disallow: /en-us/personalized-solutions

User-agent: Swiftbot
Crawl-delay: 1

sitemap.xml

present — 7 url(s)

head

title: Conversational AI and APIs for SMS, Email, Voice | Twilio
description: Build amazing customer experiences on the Twilio platform with APIs for SMS, RCS, voice, and email, plus conversational AI for smarter engagement, and identity verification for trust.

social

og:url: https://www.twilio.com/en-us
og:type: website
og:site_name: Twilio
og:title: Conversational AI and APIs for SMS, Email, Voice
og:description: Build amazing customer experiences on the Twilio platform with APIs for SMS, RCS, voice, and email, plus conversational AI for smarter engagement, and identity verification for trust.
og:image: https://www.twilio.com/content/dam/twilio-com/core-assets/social/twilio-com-default-ogimage.png
twitter:url: https://www.twilio.com/en-us
twitter:site: @twilio
twitter:title: Conversational AI and APIs for SMS, Email, Voice
twitter:description: Build amazing customer experiences on the Twilio platform with APIs for SMS, RCS, voice, and email, plus conversational AI for smarter engagement, and identity verification for trust.
twitter:image: https://www.twilio.com/content/dam/twilio-com/core-assets/social/twilio-com-default-ogimage.png
twitter:card: summary_large_image

fetched 2026-06-04T02:36:10.281Z

web-surface

info

Open standalone →

inspecting web surface…

dnssec

low

Open standalone →

DNSSEC not configured — no DS or DNSKEY records found

Why it matters: DNSSEC cryptographically signs DNS responses, blocking cache-poisoning attacks. US federal civilian agencies are required to enable it under OMB M-22-09 (NIST SC-20).

Recommendations

Enable DNSSEC in your DNS provider's control panel and add the resulting DS record at your registrar

enabled: no
DS records: —
DNSKEY records: —

fetched 2026-06-04T02:36:10.158Z

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

not applicable: no _mta-sts TXT record

Why it matters: MTA-STS forces inbound SMTP to use TLS and refuse downgraded connections. Without it, an in-path attacker can strip TLS and read mail in plaintext (SOC 2 CC6.7).

no _mta-sts TXT record

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

not applicable: no TLSRPT record

Why it matters: TLS-RPT publishes a reporting address for SMTP-TLS failures. Without it, downgrade attacks on inbound mail go unnoticed (SOC 2 CC7.2).

no TLSRPT record

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

domain registered until 2026-10-26

Why it matters: Registrar and expiry tell auditors the domain is owned, current, and not about to lapse. An expired or about-to-expire domain fails business-continuity evidence (SOC 2 A1.2).

registrar: MarkMonitor Inc.
created: 2007-10-26T22:26:18Z
expires: 2026-10-26T22:26:18Z
statuses: clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited, clientTransferProhibited https://icann.org/epp#clientTransferProhibited, clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited, serverDeleteProhibited https://icann.org/epp#serverDeleteProhibited, serverTransferProhibited https://icann.org/epp#serverTransferProhibited, serverUpdateProhibited https://icann.org/epp#serverUpdateProhibited

fetched 2026-06-04T02:36:10.346Z

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

check failed: crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

Why it matters: Every certificate issued for this domain is published in Certificate Transparency logs — including subdomains you may have forgotten. Unknown subdomains in CT are pre-disclosed attack surface (ISO 27001 A.8.16).

crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.