yahoo.com

15-check dossier · scoreboard above, section details below

Get a pack →

Scanning…

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

resolving mx…

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

resolving dmarc…

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

tracing redirects…

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

inspecting web surface…

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.

yahoo.com

15-check dossier · scoreboard above, section details below

Get a pack →

A-

Audit-ready · 6 minor advisories

Aggregate grade across 15 checks. Auditors typically flag any High-severity finding.

Pass: 9
Warn: 6
Fail: 0

What an auditor would flag first

low
SPF
SPF present but all-qualifier unrecognised
SOC 2 CC6.7ISO 27001 A.13.2.1
low
DKIM
no DKIM selectors found — likely not configured
SOC 2 CC6.7
low
TLS certificate
cert expires in 83 days
SOC 2 CC6.6ISO 27001 A.13.1.1

Need this as an artifact your auditor can verify?

Your yahoo.com scan flagged 6 low findings. A signed pack covers the apex plus up to 100 CT-discovered subdomains, Ed25519-signed and ISO-timestamped, delivered in 10–30 minutes.

Get a pack →See methodology See a sample$29

Scanning…

15-check summary

DNS recordsA/AAAA records present
MX3 MX record(s) present
SPFSPF present but all-qualifier unrecognised
DMARCp=reject — strict policy
DKIMno DKIM selectors found — likely not configured
TLS certificatecert expires in 83 days
Redirect chainHTTPS served correctly
Security headers2 security header(s) missing
CORSno CORS headers — cross-origin requests blocked by default
Web surfaceHTTPS surface reachable (robots ✓, sitemap ✗, title ✓)
MTA-STSMTA-STS testing mode — not yet enforcing inbound TLS
TLS-RPTTLSRPT configured with reporting URI (rua=)
DNSSECDNSSEC not configured — no DS or DNSKEY records found
WHOISdomain registered until 2027-01-19
Certificate Transparencycheck failed: crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

dns

info

Open standalone →

A/AAAA records present

Why it matters: Without authoritative A or AAAA records on the apex, the domain is unreachable. Missing baseline DNS shows up in vendor reviews as evidence of unmanaged infrastructure (SOC 2 CC6.6).

A: ttl=496 74.6.231.21
ttl=496 98.137.11.163
ttl=496 98.137.11.164
ttl=496 74.6.231.20
ttl=496 74.6.143.26
ttl=496 74.6.143.25
AAAA: ttl=1192 2001:4998:44:3507::8001
ttl=1192 2001:4998:44:3507::8000
ttl=1192 2001:4998:24:120d::1:0
ttl=1192 2001:4998:24:120d::1:1
ttl=1192 2001:4998:124:1507::f001
ttl=1192 2001:4998:124:1507::f000
NS: ttl=165492 ns1.yahoo.com.
ttl=165492 ns3.yahoo.com.
ttl=165492 ns4.yahoo.com.
ttl=165492 ns5.yahoo.com.
ttl=165492 ns2.yahoo.com.
SOA: ttl=1800 ns1.yahoo.com. hostmaster.yahoo-inc.com. 2026060314 3600 300 1814400 600
CAA: ttl=1800 \# 18 00 05 69 73 73 75 65 73 65 63 74 69 67 6f 2e 63 6f 6d
ttl=1800 \# 19 00 05 69 73 73 75 65 64 69 67 69 63 65 72 74 2e 63 6f 6d
ttl=1800 \# 35 00 05 69 6f 64 65 66 6d 61 69 6c 74 6f 3a 73 65 63 75 72 69 74 79 40 79 61 68 6f 6f 69 6e 63 2e 63 6f 6d
ttl=1800 \# 21 00 05 69 73 73 75 65 67 6c 6f 62 61 6c 73 69 67 6e 2e 63 6f 6d
TXT: ttl=814 "google-site-verification=GU8WAl0zPqaxdcZqDjuN7pqdfPCpR9Amz9rwxMG91qw"
ttl=814 "google-site-verification=2b0Glh8l2icXIAgAcjOcFx16Jt26yWDgEyrk5hPD-ZY"
ttl=814 "v=spf1 redirect=_spf.mail.yahoo.com"
ttl=814 "edb3bff2c0d64622a9b2250438277a59"
ttl=814 "Zoom=13284637"
ttl=814 "_globalsign-domain-verification=iEBGIOzkOsDpYITevAypWMC0vZZCAPLt9i2xMuXlO_"
ttl=814 "google-site-verification=2b8irRvU5a2h4Mb-H_fdqNrqWjS00qmPfPcWqm8BhxI"
ttl=814 "google-site-verification=xoBvU6aKxP0gYgNL0iXqF0EccAg6nFrO7XxsHnc3iNQ"
ttl=814 "google-site-verification=w4N2bNopAWw1xYrdXKORILxx-WW3_LIiyX6dIMIidgk"
ttl=814 "google-site-verification=GLp01gkFNopm_JItbLxml4iuVbTgJa3rKu0-eq1RvsE"
ttl=814 "facebook-domain-verification=gysqrcd69g0ej34f4jfn0huivkym1p"
ttl=814 "google-site-verification=Z3-Vh6zqUMgybVH4wQl1GxKSKN7JE13kyCyeZ3TZZ-I"
ttl=814 "_globalsign-domain-verification=HOeO-_wfYsqBPIRhct0u92OioWzwfg5YahDu63Jvbg"

fetched 2026-06-04T02:34:21.014Z

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

3 MX record(s) present

Why it matters: MX records direct inbound mail. Misconfiguration silently breaks email delivery and lets attackers stand up parallel MX hosts for spoofing campaigns (ISO 27001 A.8.21).

pri=1 mta5.am0.yahoodns.net.
pri=1 mta7.am0.yahoodns.net.
pri=1 mta6.am0.yahoodns.net.

fetched 2026-06-04T02:34:21.010Z

mx

info

Open standalone →

resolving mx…

spf

low

Open standalone →

SPF present but all-qualifier unrecognised

Why it matters: SPF tells receiving servers which hosts may send mail for the domain. Without it, any sender can forge the envelope-from — the primary mechanism behind business-email-compromise (SOC 2 CC6.7).

v=spf1 redirect=_spf.mail.yahoo.com

v=spf1
redirect=_spf.mail.yahoo.com

fetched 2026-06-04T02:34:21.013Z

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

p=reject — strict policy

Why it matters: DMARC binds SPF and DKIM into an enforceable policy (quarantine or reject) and surfaces spoofing attempts via aggregate reports. `p=none` or absent means spoofing succeeds silently (SOC 2 CC6.7).

v=DMARC1; p=reject; pct=100; rua=mailto:d@rua.agari.com; ruf=mailto:d@ruf.agari.com;

v=: DMARC1
p=: reject
pct=: 100
rua=: mailto:d@rua.agari.com
ruf=: mailto:d@ruf.agari.com

fetched 2026-06-04T02:34:21.012Z

dmarc

info

Open standalone →

resolving dmarc…

dkim

low

Open standalone →

no DKIM selectors found — likely not configured

Why it matters: DKIM signs outbound mail so receivers can detect tampering. Missing selectors or rotated-away keys break DMARC alignment and let receivers downgrade trust (ISO 27001 A.8.24).

Recommendations

Enable DKIM signing in your mail provider and publish the provided TXT record
Common selectors: google._domainkey, selector1._domainkey (Microsoft), mail._domainkey

no DKIM record on probed selectors (default, google, k1, selector1, selector2, mxvault)

dkim

info

Open standalone →

probing dkim selectors…

tls

low

Open standalone →

cert expires in 83 days

Why it matters: A valid current TLS certificate is the baseline for data in transit. Expiry, weak chain, or hostname mismatch break HTTPS and fail PCI 4.2.1 / SOC 2 CC6.1.

Recommendations

Schedule certificate renewal — consider enabling auto-renewal

subject cn:: yahoo.com
issuer:: DigiCert Global G2 TLS RSA SHA256 2020 CA1 / DigiCert Inc
valid:: Mar 3 00:00:00 2026 GMT → Aug 26 23:59:59 2026 GMT
authorized:: yes
sha256:: 1E:1D:FC:32:34:AC:F4:23:59:B6:86:59:92:23:28:7A:6F:2B:90:6B:6A:12:9E:D9:9A:5D:83:AB:B5:A1:EC:C8
sans: yahoo.com
tw.rd.yahoo.com
s.yimg.com
mbp.yimg.com
hk.rd.yahoo.com
fr-ca.rogers.yahoo.com
ddl.fp.yahoo.com
ca.rogers.yahoo.com
ca.my.yahoo.com
brb.yahoo.net
add.my.yahoo.com
*.yahoo.com
*.www.yahoo.com
*.media.yahoo.com
*.att.yahoo.com
*.amp.yimg.com

fetched 2026-06-04T02:34:21.145Z

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

HTTPS served correctly

Why it matters: Bare HTTP requests must redirect to HTTPS without dropping the user mid-chain. Plain-text fallback or open redirects fail PCI 4.2.1 and feed phishing chains (SOC 2 CC6.6).

final status: 200 · 2 hops

[301] https://yahoo.com/
[200] https://www.yahoo.com/

fetched 2026-06-04T02:34:21.881Z

redirects

info

Open standalone →

tracing redirects…

headers

low

Open standalone →

2 security header(s) missing

Why it matters: Security headers — HSTS, CSP, X-Frame-Options, Referrer-Policy — defend against XSS, clickjacking, and downgrade attacks. Absent headers map directly to OWASP ASVS V14 findings (ISO 27001 A.8.23).

Recommendations

Add response header — X-Frame-Options: DENY (or SAMEORIGIN if framing is intended)
Add permissions-policy response header

final url: https://www.yahoo.com/

security headers

strict-transport-security: max-age=31536000
content-security-policy: frame-ancestors 'self' https://*.builtbygirls.com https://*.rivals.com https://*.engadget.com https://*.intheknow.com https://*.autoblog.com https://*.techcrunch.com https://*.yahoo.com https://*.aol.com https://*.huffingtonpost.com https://*.oath.com https://*.search.yahoo.com https://*.pnr.ouryahoo.com https://pnr.ouryahoo.com https://*.search.aol.com https://*.search.huffpost.com https://*.onesearch.com https://*.verizonmedia.com https://*.publishing.oath.com https://cdn.taboola.com https://ads.taboola.com chrome-extension://jdanfkhnfpagoijgfmklhgakdicpnfil; sandbox allow-forms allow-same-origin allow-scripts allow-popups allow-popups-to-escape-sandbox allow-presentation allow-top-navigation-by-user-activation; report-uri https://csp.yahoo.com/beacon/csp?src=ats&site=news&region=US&lang=en-US&device=desktop&yrid=6o9nr8tivmg0j&partner=;
x-frame-options: —
x-content-type-options: nosniff
referrer-policy: no-referrer-when-downgrade
permissions-policy: —

other headers

cache-control: max-age=0, private
connection: keep-alive
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Thu, 04 Jun 2026 02:34:21 GMT
document-policy: js-profiling
expires: -1
link: </_nca/_next/static/media/4c5a69d047c2b2dc-s.p.woff2>; rel=preload; as="font"; crossorigin=""; type="font/woff2", </_nca/_next/static/media/6563b172ef52338e-s.p.woff2>; rel=preload; as="font"; crossorigin=""; type="font/woff2", </_nca/_next/static/media/7553561d3efb1daf-s.p.woff2>; rel=preload; as="font"; crossorigin=""; type="font/woff2", </_nca/_next/static/media/f0b1e3f007006b62-s.p.woff2>; rel=preload; as="font"; crossorigin=""; type="font/woff2", </_nca/_next/static/media/f35b5e6220b536eb-s.p.woff2>; rel=preload; as="font"; crossorigin=""; type="font/woff2", </_nca/_next/static/css/c28189b1906ac9b1.css?dpl=sha-e196d61>; rel=preload; as="style", </_nca/_next/static/css/55fbb80190daac78.css?dpl=sha-e196d61>; rel=preload; as="style", </_nca/_next/static/css/56245c45231423be.css?dpl=sha-e196d61>; rel=preload; as="style", </_nca/_next/static/css/35ed6979caf5cba9.css?dpl=sha-e196d61>; rel=preload; as="style", </_nca/_next/static/css/8b25fa38c991eab4.css?dpl=sha-e196d61>; rel=preload; as="style"
server: ATS
set-cookie: AWSALBTGCORS=8A0jar8w+b/8VjPosHWTHs0jhujmQbKR/dB3zbMBzwFONXC7JPkBc77ZF/DwI4iKkGKMyKl+N0OlBGlpbMq7Ki0ztLxy6u+d4B16sxhgC5NvLRiBytgukdacDmN+Xf7iCbOMJE9YAh7O5zDp/QWVjWwzUh5K+KKdpQGFwQJyle6R; Expires=Thu, 11 Jun 2026 02:34:21 GMT; Path=/; SameSite=None; Secure
transfer-encoding: chunked
vary: Accept-Encoding
x-aws-region: unknown
x-deployment-id: sha-e196d61

fetched 2026-06-04T02:34:21.194Z

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

no CORS headers — cross-origin requests blocked by default

Why it matters: Overly permissive CORS (wildcard with credentials, or reflected origin) lets any origin read authenticated responses from this domain. OWASP A05 misconfiguration territory (NIST AC-4).

origin: https://domainposture.com
method: GET
preflight status: 301

access-control-* headers

access-control-allow-origin: —
access-control-allow-methods: —
access-control-allow-headers: —
access-control-allow-credentials: —
access-control-max-age: —
access-control-expose-headers: —

no access-control-* headers returned — site does not advertise CORS to this origin

fetched 2026-06-04T02:34:21.121Z

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

HTTPS surface reachable (robots ✓, sitemap ✗, title ✓)

Why it matters: Public files — robots.txt, sitemap.xml, head meta — are what attackers see first during reconnaissance. Misadvertised paths, stale sitemaps, and verbose generators leak more than intended (ISO 27001 A.8.9).

robots.txt

present

User-agent: *
Disallow: /info/p.gif
Disallow: /p/
Disallow: /r/
Disallow: /bin/
Disallow: /caas/
Disallow: /blank.html
Disallow: /includes/
Disallow: /_td_api
Disallow: /tdv2_fp
Disallow: /nel_ms
Disallow: /fp_ms
Disallow: /sports_fp_ms
Disallow: /search_ms
Disallow: /_tdpp_api
Disallow: /_remote
Disallow: /_multiremote
Disallow: /_tdhl_api
Disallow: /digest
Disallow: /fpjs
Disallow: /myjs
Disallow: /news/m/

User-agent: ADmantX
User-agent: AlphaBot
User-agent: anthropic-ai
User-agent: AwarioRssBot
User-agent: AwarioSmartBot
User-agent: BLEXBot
User-agent: Buzzbot
User-agent: Bytespider
User-agent: CCBot
User-agent: ChatGPT-User
User-agent: claritybot
User-agent: Claude-Web
User-agent: ClaudeBot
User-agent: cohere-ai
User-agent: Diffbot
User-agent: FacebookBot
User-agent: FriendlyCrawler
User-agent: Google-Extended
User-agent: GPTBot
User-agent: huggingface
User-agent: ImagesiftBot
User-agent: img2dataset
User-agent: magpie-crawler
User-agent: Meltwater
User-agent: Neevabot
User-agent: news-please
User-agent: NewsNow
User-agent: Nutch
User-agent: omgili
User-agent: omgilibot
User-agent: panscient.com
User-agent: Perplexity-ai
User-agent: PerplexityBot
User-agent: PetalBot
User-agent: PiplBot
User-agent: scoop.it
User-agent: Scrapy
User-agent: Seekr
User-agent: SentiBot
User-agent: SeznamBot
User-agent: TurnitinBot
User-agent: YouBot
User-agent: ZumBot
Disallow: /

User-agent: Claude-SearchBot
User-agent: OAI-SearchBot
Disallow: */articles/

Sitemap: https://www.yahoo.com/news/weather/sitemap.xml
Sitemap: https://www.yahoo.com/news-sitemap-index.xml
Sitemap: https://www.yahoo.com/sitemap-index.xml

sitemap.xml

absent

head

title: Yahoo | Mail, Weather, Search, Politics, News, Finance, Sports & Videos
description: Latest news coverage, email, free stock quotes, live scores and video are just the beginning. Discover more every day at Yahoo!

social

no OpenGraph or Twitter meta tags found

fetched 2026-06-04T02:34:21.573Z

web-surface

info

Open standalone →

inspecting web surface…

dnssec

low

Open standalone →

DNSSEC not configured — no DS or DNSKEY records found

Why it matters: DNSSEC cryptographically signs DNS responses, blocking cache-poisoning attacks. US federal civilian agencies are required to enable it under OMB M-22-09 (NIST SC-20).

Recommendations

Enable DNSSEC in your DNS provider's control panel and add the resulting DS record at your registrar

enabled: no
DS records: —
DNSKEY records: —

fetched 2026-06-04T02:34:21.017Z

dnssec

info

Open standalone →

checking dnssec…

mta-sts

low

Open standalone →

MTA-STS testing mode — not yet enforcing inbound TLS

Why it matters: MTA-STS forces inbound SMTP to use TLS and refuse downgraded connections. Without it, an in-path attacker can strip TLS and read mail in plaintext (SOC 2 CC6.7).

Recommendations

Update the MTA-STS policy file to set 'mode: enforce' once you've validated TLS delivery

mode: testing
max age: 86400s
mx: *.am0.yahoodns.net, *.mail.gm0.yahoodns.net, *.mail.am0.yahoodns.net
policy id: 20161109010200Z

fetched 2026-06-04T02:34:21.056Z

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

TLSRPT configured with reporting URI (rua=)

Why it matters: TLS-RPT publishes a reporting address for SMTP-TLS failures. Without it, downgrade attacks on inbound mail go unnoticed (SOC 2 CC7.2).

version: TLSRPTv1
rua: mailto:mta_sts.report@yahoo.com
raw: v=TLSRPTv1; rua=mailto:mta_sts.report@yahoo.com

fetched 2026-06-04T02:34:21.019Z

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

domain registered until 2027-01-19

Why it matters: Registrar and expiry tell auditors the domain is owned, current, and not about to lapse. An expired or about-to-expire domain fails business-continuity evidence (SOC 2 A1.2).

registrar: MarkMonitor Inc.
created: 1995-01-18T05:00:00Z
expires: 2027-01-19T05:00:00Z
statuses: clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited, clientTransferProhibited https://icann.org/epp#clientTransferProhibited, clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited, serverDeleteProhibited https://icann.org/epp#serverDeleteProhibited, serverTransferProhibited https://icann.org/epp#serverTransferProhibited, serverUpdateProhibited https://icann.org/epp#serverUpdateProhibited

fetched 2026-06-04T02:34:21.184Z

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

check failed: crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

Why it matters: Every certificate issued for this domain is published in Certificate Transparency logs — including subdomains you may have forgotten. Unknown subdomains in CT are pre-disclosed attack surface (ISO 27001 A.8.16).

crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.