wsj.com

15-check dossier · scoreboard above, section details below

embed badge

Markdown

[![Domain posture](https://www.domainposture.com/d/wsj.com/badge.svg)](https://www.domainposture.com/d/wsj.com)

HTML

<a href="https://www.domainposture.com/d/wsj.com"><img src="https://www.domainposture.com/d/wsj.com/badge.svg" alt="Domain posture" /></a>

Scanning…

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

resolving mx…

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

resolving dmarc…

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

tracing redirects…

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

inspecting web surface…

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.

wsj.com

15-check dossier · scoreboard above, section details below

Get a pack →

embed badge

Markdown

[![Domain posture](https://www.domainposture.com/d/wsj.com/badge.svg)](https://www.domainposture.com/d/wsj.com)

HTML

<a href="https://www.domainposture.com/d/wsj.com"><img src="https://www.domainposture.com/d/wsj.com/badge.svg" alt="Domain posture" /></a>

Mostly compliant · 5 items need attention

Aggregate grade across 15 checks. Auditors typically flag any High-severity finding.

Pass: 10
Warn: 5
Fail: 0

What an auditor would flag first

medium
SPF
~all softfail — receivers may still accept
SOC 2 CC6.7ISO 27001 A.8.20
medium
Security headers
6 security header(s) missing
SOC 2 CC6.6ISO 27001 A.8.23
low
DMARC
p=quarantine — receivers send to spam
SOC 2 CC6.7ISO 27001 A.5.14

Need this as an artifact your auditor can verify?

Your wsj.com scan flagged 2 medium and 3 low findings. A signed pack covers the apex plus up to 100 CT-discovered subdomains, Ed25519-signed and ISO-timestamped, delivered in 10–30 minutes.

Get a pack →See methodology See a sample$29

Scanning…

15-check summary

DNS recordsA/AAAA records present
MX2 MX record(s) present
SPF~all softfail — receivers may still accept
DMARCp=quarantine — receivers send to spam
DKIM2/6 DKIM selectors valid
TLS certificatecert valid for 185 days
Redirect chainHTTPS served correctly
Security headers6 security header(s) missing
CORSno CORS headers — cross-origin requests blocked by default
Web surfaceHTTPS surface reachable (robots ✓, sitemap ✓, title ✓)
MTA-STSnot applicable: no _mta-sts TXT record
TLS-RPTnot applicable: no TLSRPT record
DNSSECDNSSEC not configured — no DS or DNSKEY records found
WHOISdomain registered until 2027-05-25
Certificate Transparencycheck failed: crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

dns

info

Open standalone →

A/AAAA records present

Why it matters: Without authoritative A or AAAA records on the apex, the domain is unreachable. Missing baseline DNS shows up in vendor reviews as evidence of unmanaged infrastructure (SOC 2 CC6.6).

A: ttl=7 18.161.97.105
ttl=7 18.161.97.7
ttl=7 18.161.97.101
ttl=7 18.161.97.34
AAAA: —
NS: ttl=1800 ns-1291.awsdns-33.org.
ttl=1800 ns-1588.awsdns-06.co.uk.
ttl=1800 ns-450.awsdns-56.com.
ttl=1800 ns-705.awsdns-24.net.
SOA: ttl=900 ns-1588.awsdns-06.co.uk. awsdns-hostmaster.amazon.com. 1 7200 900 1209600 86400
CAA: —
TXT: ttl=300 "1da8ea47a55e41d8a5e3547014ff0df3"
ttl=300 "ValidationTokenValue=313dc83f-c48d-468e-beb9-f1009db743b7"
ttl=300 "ZOOM_verify_FrSli5rrR7yyjTeOO-0Ngw"
ttl=300 "_jebpalp9qdenvdol02xdobrh9kedj5t"
ttl=300 "adobe-idp-site-verification=7ef638bb68822798685f96e436bfc87a6f79319dd86369e447b84bb8ea9c6f68"
ttl=300 "atlassian-domain-verification=uNoIhBXurxzVlQa0FvK2t9Yld5byfvXbFRQaMToGvrieKjBdylMs8jcSXRKQKqao"
ttl=300 "datadome-domain-verify=mBXJ0OcsBIxmEYtkepO9rBwdPNmfTk5Q"
ttl=300 "docker-verification=77f906b0-c371-45ad-af43-084c70efa72d"
ttl=300 "e2ma-verification=o5peb"
ttl=300 "figma-domain-verification=b411f1d2852c2c7e057a2d6d70fb22896f37ccc1412d1e1bb4f9da14e2b78ad9-1769000244"
ttl=300 "google-site-verification=9qAZcXg57okZKr9DmmJfHe540wYK1-ptJrv6Z0e6qS0"
ttl=300 "google-site-verification=B9Y1v38RU7B3nMrC2uZp4I-H_XMuyi_Wm1XVIjhq5xE"
ttl=300 "google-site-verification=YGwiPA44Zuu_uIHo-u9QdaOVx-I2x6kDuWap7rd4v0U"
ttl=300 "google-site-verification=cpHbd4daRMpm-WshkkCy3asDVJ84-jzlvFbwDSqgAWU"
ttl=300 "google-site-verification=j-2HeIEh27wGRTkTSxbVfyX5vZ9FXAfFNk91rVlF-EI"
ttl=300 "google-site-verification=rWQ3-0ObuFwNI6hnwBCQ7LE6ihPnYaoH9tY1gnLCBvY"
ttl=300 "knowbe4-site-verification=0694ce74005828dc4bb8b7299bfb6f61"
ttl=300 "miro-verification=fc4f542b1bf4fc981e2f11e463246349bde0a8d0"
ttl=300 "mongodb-site-verification=Ht3HUyOSg9IfQp3EIA76fuAf6YmQqXIU"
ttl=300 "mongodb-site-verification=KfW1ZcenFTu2m17XiRpByNOwlYDj6u3G"
ttl=300 "openai-domain-verification=dv-63834euf9HsL6r8GJAQfNf6Z"
ttl=300 "openai-domain-verification=dv-JwASLFwVo5pvxd0F8tRz4NK3"
ttl=300 "pardot858843=b677571961124861149dc1ce6b9bce01a13dc2dd2a9b59fa25eefa29cf847480"
ttl=300 "pardot937523=183e8670efb27a80833eb77a7c73d2081d1bc36da7763e1f4fefaf95d4f9e405"
ttl=300 "pardot937523=a84acf2c5ec076341f4486d7e5caf2f4918fee1860b93796da08e56c6ce610ae"
ttl=300 "pardot937523=ad9cb1ba6a487d2f26f5e1f3f14378a243aeb5d7aa02b3e70bcbf668dec68cb1"
ttl=300 "pendo-domain-verification=tTAAYqapp5CTCkkrUtw8bmgAxLg"
ttl=300 "traction-guest=e4337250-04c9-4060-87ac-df29271721ca"
ttl=300 "v=spf1 include:%{ir}.%{v}.%{d}.spf.has.pphosted.com ~all"

fetched 2026-06-17T08:30:57.920Z

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

2 MX record(s) present

Why it matters: MX records direct inbound mail. Misconfiguration silently breaks email delivery and lets attackers stand up parallel MX hosts for spoofing campaigns (ISO 27001 A.8.21).

pri=10 mxa-00596a01.gslb.pphosted.com.
pri=10 mxb-00596a01.gslb.pphosted.com.

fetched 2026-06-17T08:30:57.918Z

mx

info

Open standalone →

resolving mx…

spf

medium

Open standalone →

~all softfail — receivers may still accept

Why it matters: SPF tells receiving servers which hosts may send mail for the domain. Without it, any sender can forge the envelope-from — the primary mechanism behind business-email-compromise (SOC 2 CC6.7).

Recommendations

Move to -all (hardfail) once your mail flow is confirmed — softfail gives no real protection

v=spf1 include:%{ir}.%{v}.%{d}.spf.has.pphosted.com ~all

v=spf1
include:%{ir}.%{v}.%{d}.spf.has.pphosted.com
~all

fetched 2026-06-17T08:30:57.921Z

spf

info

Open standalone →

resolving spf…

dmarc

low

Open standalone →

p=quarantine — receivers send to spam

Why it matters: DMARC binds SPF and DKIM into an enforceable policy (quarantine or reject) and surfaces spoofing attempts via aggregate reports. `p=none` or absent means spoofing succeeds silently (SOC 2 CC6.7).

Recommendations

Upgrade to p=reject once your SPF and DKIM pass rates are consistently high

v=DMARC1; p=quarantine; fo=1; rua=mailto:[email protected]; ruf=mailto:[email protected]

v=: DMARC1
p=: quarantine
fo=: 1
rua=: mailto:[email protected]
ruf=: mailto:[email protected]

fetched 2026-06-17T08:30:57.917Z

dmarc

info

Open standalone →

resolving dmarc…

dkim

low

Open standalone →

2/6 DKIM selectors valid

Why it matters: DKIM signs outbound mail so receivers can detect tampering. Missing selectors or rotated-away keys break DMARC alignment and let receivers downgrade trust (ISO 27001 A.8.24).

Recommendations

Check the missing selectors in your DNS provider and re-add any removed records

default:: —
google:: v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC/TBI/mOwv05TRIJ6zqmJbHx2lL8jGgbKjUasBCwuY4RLwysp1+WCao0kEOR9xKDj0ckFptc/6NajFmAydRL41Y9Lk51AU+jqv9aIKk6I9pOi2hJ/+//gb4Zc1PW7nW04PGDRBkdLM2uA+KGzKY0I0sQzOX52KcJabJYtGVU3k5QIDAQAB
k1:: —
selector1:: —
selector2:: v=DKIM1; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAngDZ+OLa8LW3fdcSS3tTMuK1R428kZs1COYx7kNOuiLIXogABfhoM28kCR3/ZJlKyzRDdLTEn/sHN49rXHbujVPEjDgWLOeMo/ozA4ZiPeX/MVkukoN12rBL0FWDQcAUI77/RqjxaJKCDj1qr2lDrv0/cdOMnXR7lzvD+ulZhZTgrUYR8jHvjxRY0ME9iF0ON4VMiclsAVdXcDiZnvDkFwkj5YrLNTdF6jCQWVtihPuFCBHoH9jPwgn6TeyiEZFXch1ido6+VASdHq/40x0K6wyjhKEMxdsGMkE4Yr7OAfvov3/ITsgPoV3edlLMwqxhXPM0lictv5IGKejhIkJ/8wIDAQAB;
mxvault:: —

fetched 2026-06-17T08:30:57.920Z

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

cert valid for 185 days

Why it matters: A valid current TLS certificate is the baseline for data in transit. Expiry, weak chain, or hostname mismatch break HTTPS and fail PCI 4.2.1 / SOC 2 CC6.1.

subject cn:: online.wsj.com
issuer:: Amazon RSA 2048 M04 / Amazon
valid:: Jun 5 00:00:00 2026 GMT → Dec 19 23:59:59 2026 GMT
authorized:: yes
sha256:: 23:92:49:83:72:E3:F6:95:9D:4C:AF:2A:44:64:A7:83:36:EF:9A:EB:28:D8:E3:CF:B4:3E:E4:BA:6A:27:FF:22
sans: online.wsj.com
wsjmagazine.com
wsj.com

fetched 2026-06-17T08:30:57.937Z

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

HTTPS served correctly

Why it matters: Bare HTTP requests must redirect to HTTPS without dropping the user mid-chain. Plain-text fallback or open redirects fail PCI 4.2.1 and feed phishing chains (SOC 2 CC6.6).

final status: 401 · 2 hops

[301] https://wsj.com/
[401] https://www.wsj.com/

fetched 2026-06-17T08:30:58.066Z

redirects

info

Open standalone →

tracing redirects…

headers

medium

Open standalone →

6 security header(s) missing

Why it matters: Security headers — HSTS, CSP, X-Frame-Options, Referrer-Policy — defend against XSS, clickjacking, and downgrade attacks. Absent headers map directly to OWASP ASVS V14 findings (ISO 27001 A.8.23).

Recommendations

Add response header — Strict-Transport-Security: max-age=15552000; includeSubDomains
Add response header — Content-Security-Policy: default-src 'self' (tune per app)
Add response header — X-Frame-Options: DENY (or SAMEORIGIN if framing is intended)
Add response header — X-Content-Type-Options: nosniff
Add response header — Referrer-Policy: strict-origin-when-cross-origin
Add permissions-policy response header

final url: https://www.wsj.com/

security headers

strict-transport-security: —
content-security-policy: —
x-frame-options: —
x-content-type-options: —
referrer-policy: —
permissions-policy: —

other headers

accept-ch: Sec-CH-UA,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Arch,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model,Sec-CH-Device-Memory
access-control-allow-credentials: true
access-control-allow-origin: *
access-control-expose-headers: x-dd-b, x-set-cookie
cache-control: max-age=0, private, no-cache, no-store, must-revalidate
charset: utf-8
connection: keep-alive
content-length: 770
content-type: text/html;charset=utf-8
date: Wed, 17 Jun 2026 08:30:58 GMT
pragma: no-cache
server: CloudFront
set-cookie: datadome=Ky3AnCJYTE8x9KcsMewy~wiqAZgxMH2HwMV01JbaY39zjmLe8WcAw7e2K03NvZoNK1GSpzh8Aq~e5Owd_YEHbZ8UjFvr2DfFq5RqVPHTcbYKgu5r50KIgbzB7exsqzff; Max-Age=31536000; Domain=.wsj.com; Path=/; SameSite=Lax
via: 1.1 2aed9c1f8cf3c3af95d9c9bc13629052.cloudfront.net (CloudFront)
x-amz-cf-id: _S_Sw36UMjn76H3e-CFHTdiIHxAWUkO6yRW5RPlW0QvV8pGMqBBm-g==
x-amz-cf-pop: BOM78-P10
x-cache: LambdaGeneratedResponse from cloudfront
x-datadome: protected
x-datadome-cid: AHrlqAAAAAMAQo_OZivCioUAerOMUg==

fetched 2026-06-17T08:30:58.062Z

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

no CORS headers — cross-origin requests blocked by default

Why it matters: Overly permissive CORS (wildcard with credentials, or reflected origin) lets any origin read authenticated responses from this domain. OWASP A05 misconfiguration territory (NIST AC-4).

origin: https://domainposture.com
method: GET
preflight status: 301

access-control-* headers

access-control-allow-origin: —
access-control-allow-methods: —
access-control-allow-headers: —
access-control-allow-credentials: —
access-control-max-age: —
access-control-expose-headers: —

no access-control-* headers returned — site does not advertise CORS to this origin

fetched 2026-06-17T08:30:59.013Z

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

HTTPS surface reachable (robots ✓, sitemap ✓, title ✓)

Why it matters: Public files — robots.txt, sitemap.xml, head meta — are what attackers see first during reconnaissance. Misadvertised paths, stale sitemaps, and verbose generators leak more than intended (ISO 27001 A.8.9).

robots.txt

present

# NOTICE: Collection of content and other data on https://www.wsj.com/ through
# automated means is prohibited unless you have express written
# permission from Dow Jones & Company, Inc. and may only be conducted for the
# limited purpose contained in said permission.
#
# Dow Jones & Company, Inc. Terms of Use may be found at
# https://www.dowjones.com/terms-of-use/
#
# If you would like to apply for permission to license the
# intellectual property and/or other materials of Dow Jones & Company, Inc.’s
# brands, please contact us via email at [email protected].

User-agent: *
Disallow: /

User-agent: googlebot
User-agent: googlebot-image
User-agent: GoogleOther
User-agent: Googlebot-Video
User-agent: Google-InspectionTool
User-agent: AdsBot-Google
User-agent: AdsBot-Google-Mobile
User-agent: AdsBot-Google-Mobile-Apps
User-agent: Storebot-Google
User-agent: google-read-aloud
User-agent: mediapartners-google
User-agent: bingbot
User-agent: msnbot
User-agent: bingpreview
User-agent: slurp
User-agent: yahoo
User-agent: baiduspider
User-agent: Pinterestbot
User-agent: Yeti
User-agent: MojeekBot
User-agent: 360Spider
User-agent: google-cloudvertexbot
User-agent: duckduckbot
User-agent: Applebot
User-agent: flipboard
User-agent: qwantbot
User-agent: SeznamBot



User-agent: proximic
User-agent: admantx
User-agent: thetradedesk
User-agent: outbrain
User-agent: ias_crawler
User-agent: AmazonAdBot
User-agent: pubmatic
User-agent: smartologybot
User-agent: parselybot


User-agent: Screaming Frog SEO Spider
User-agent: AhrefsBot
User-agent: SemrushBot
User-agent: SimilarWebBot
User-agent: SISTRIX
User-agent: botify
User-agent: Chrome-Lighthouse


User-agent: ChatGPT-User
User-agent: GPTBot
User-agent: OAI-SearchBot


User-agent: facebookexternalhit
User-agent: facebot
User-agent: twitterbot
User-agent: linkedinbot
User-agent: snapchat
User-agent: sentry
User-agent: Iframely
User-agent: Vocabtracker
User-agent: EpvzCrawl6194680250
User-agent: Citoid
User-agent: ZoteroTranslationServer



Allow: /

User-agent: mediapartners-google
Disallow: /
Allow: /watchlist

Disallow: /article_email/*
Disallow: /user/*
Disallow: /pdf/documents/*
Disallow: /login/*
Disallow: /acct/*
Disallow: /msgcenter/*
Disallow: /setup/*
Disallow: /marketing/*
Disallow: /public/article/*
Disallow: /public/resources/documents/*
Disallow: /public/search/
Disallow: /public/search*
Disallow: /search*
Disallow: /public/page/wsj-x-marketing.html
Disallow: /public/page/news-media-marketing.html
Disallow: /public/page/0_0_WP_RT_MARKETING.html
Disallow: /news/articles/SB2*
Disallow: /news/articles/SB3*
Disallow: /news/articles/SB4*
Disallow: /articles/SB2*
Disallow: /articles/SB3*
Disallow: /articles/SB4*
Disallow: /article/AP*
Disallow: /article/BT-CO*
Disallow: /article/DN-CO*
Disallow: /article/PR-CO*
Disallow: /article/HUG*
Disallow: /video/search/*
Disallow: /articles/BT-CO*
Disallow: /articles/DN-CO*
Disallow: /articles/PR-CO*
Disallow: /news/articles/BT-CO*
Disallow: /news/articles/DN-CO*
Disallow: /news/articles/PR-CO*
Disallow: /catchup/*
Disallow: /articles/the-meaning-behind-juneteenth-11592413234
Disallow: /emailservice/*
Disallow: /emailsignup/*
Disallow: /insetsrv/v1/*
Disallow: /user/fpd/api/*
Disallow: /Date(*
Disallow: /auth/sso/proxy-login*
Disallow: /client/

# For Buyside Search Results
Disallow: /buyside/search-results?*term=*
# Don't crawl non-indexable sites
Disallow: /*?type=mdc_*&id=*
Disallow: /*?id=*&type=mdc_*
Disallow: /market-data/quotes/*/options/*
Disallow: /subscribe/?inttrackingCode=*
Disallow: /subscribe/?template=*

Sitemap: https://www.wsj.com/sitemap.xml
Sitemap: https://www.wsj.com/wsjsitemaps/wsj_google_news.xml
Sitemap: https://www.wsj.com/wsj_video_recent.xml
Sitemap: https://www.wsj.com/sitemap_topics.xml
Sitemap: https://www.wsj.com/sitemaps/web/wsj/en/sitemap_wsj_en_index.xml
Sitemap: https://www.wsj.com/live_news_sitemap.xml
Sitemap: https://www.wsj.com/authors_sitemap.xml
Sitemap: https://www.wsj.com/sitemaps/web/video/en/sitemap_video_en_index.xml
Sitemap: https://www.wsj.com/buyside/sitemap.xml
Sitemap: https://www.wsj

sitemap.xml

present — 221 url(s)

head

title: wsj.com
description: —

social

no OpenGraph or Twitter meta tags found

fetched 2026-06-17T08:30:58.904Z

web-surface

info

Open standalone →

inspecting web surface…

dnssec

low

Open standalone →

DNSSEC not configured — no DS or DNSKEY records found

Why it matters: DNSSEC cryptographically signs DNS responses, blocking cache-poisoning attacks. US federal civilian agencies are required to enable it under OMB M-22-09 (NIST SC-20).

Recommendations

Enable DNSSEC in your DNS provider's control panel and add the resulting DS record at your registrar

enabled: no
DS records: —
DNSKEY records: —

fetched 2026-06-17T08:30:57.921Z

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

not applicable: no _mta-sts TXT record

Why it matters: MTA-STS forces inbound SMTP to use TLS and refuse downgraded connections. Without it, an in-path attacker can strip TLS and read mail in plaintext (SOC 2 CC6.7).

no _mta-sts TXT record

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

not applicable: no TLSRPT record

Why it matters: TLS-RPT publishes a reporting address for SMTP-TLS failures. Without it, downgrade attacks on inbound mail go unnoticed (SOC 2 CC7.2).

no TLSRPT record

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

domain registered until 2027-05-25

Why it matters: Registrar and expiry tell auditors the domain is owned, current, and not about to lapse. An expired or about-to-expire domain fails business-continuity evidence (SOC 2 A1.2).

registrar: CSC Corporate Domains, Inc.
created: 1994-05-26T04:00:00Z
expires: 2027-05-25T04:00:00Z
statuses: clientTransferProhibited https://icann.org/epp#clientTransferProhibited, serverDeleteProhibited https://icann.org/epp#serverDeleteProhibited, serverTransferProhibited https://icann.org/epp#serverTransferProhibited, serverUpdateProhibited https://icann.org/epp#serverUpdateProhibited

fetched 2026-06-17T08:30:58.459Z

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

check failed: crt.sh: Error: crt.sh http 429; certspotter: TypeError: fetch failed

Why it matters: Every certificate issued for this domain is published in Certificate Transparency logs — including subdomains you may have forgotten. Unknown subdomains in CT are pre-disclosed attack surface (ISO 27001 A.8.16).

crt.sh: Error: crt.sh http 429; certspotter: TypeError: fetch failed

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.