youtube.com

15-check dossier · scoreboard above, section details below

embed badge

Markdown

[![Domain posture](https://www.domainposture.com/d/youtube.com/badge.svg)](https://www.domainposture.com/d/youtube.com)

HTML

<a href="https://www.domainposture.com/d/youtube.com"><img src="https://www.domainposture.com/d/youtube.com/badge.svg" alt="Domain posture" /></a>

Scanning…

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

resolving mx…

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

resolving dmarc…

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

tracing redirects…

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

inspecting web surface…

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.

youtube.com

15-check dossier · scoreboard above, section details below

Get a pack →

embed badge

Markdown

[![Domain posture](https://www.domainposture.com/d/youtube.com/badge.svg)](https://www.domainposture.com/d/youtube.com)

HTML

<a href="https://www.domainposture.com/d/youtube.com"><img src="https://www.domainposture.com/d/youtube.com/badge.svg" alt="Domain posture" /></a>

A-

Audit-ready · 3 minor advisories

Aggregate grade across 15 checks. Auditors typically flag any High-severity finding.

Pass: 12
Warn: 3
Fail: 0

What an auditor would flag first

low
DKIM
no DKIM selectors found — likely not configured
SOC 2 CC6.7
low
TLS certificate
cert expires in 67 days
SOC 2 CC6.6ISO 27001 A.13.1.1
low
DNSSEC
DNSSEC not configured — no DS or DNSKEY records found
SOC 2 CC6.6ISO 27001 A.13.1.1

Need this as an artifact your auditor can verify?

Your youtube.com scan flagged 3 low findings. A signed pack covers the apex plus up to 100 CT-discovered subdomains, Ed25519-signed and ISO-timestamped, delivered in 10–30 minutes.

Get a pack →See methodology See a sample$29

Scanning…

15-check summary

DNS recordsA/AAAA records present
MX1 MX record(s) present
SPF-all hardfail — strict policy
DMARCp=reject — strict policy
DKIMno DKIM selectors found — likely not configured
TLS certificatecert expires in 67 days
Redirect chainHTTPS served correctly
Security headers1 security header(s) missing
CORSno CORS headers — cross-origin requests blocked by default
Web surfaceHTTPS surface reachable (robots ✓, sitemap ✗, title ✓)
MTA-STSnot applicable: no _mta-sts TXT record
TLS-RPTnot applicable: no TLSRPT record
DNSSECDNSSEC not configured — no DS or DNSKEY records found
WHOISdomain registered until 2027-02-15
Certificate Transparency10 subdomain(s) found in CT logs (13 wildcard cert(s))

dns

info

Open standalone →

A/AAAA records present

Why it matters: Without authoritative A or AAAA records on the apex, the domain is unreachable. Missing baseline DNS shows up in vendor reviews as evidence of unmanaged infrastructure (SOC 2 CC6.6).

A: ttl=82 142.251.167.91
ttl=82 142.251.167.136
ttl=82 142.251.167.190
ttl=82 142.251.167.93
AAAA: ttl=236 2607:f8b0:4004:c09::5d
ttl=236 2607:f8b0:4004:c09::5b
ttl=236 2607:f8b0:4004:c09::88
ttl=236 2607:f8b0:4004:c09::be
NS: ttl=330671 ns2.google.com.
ttl=330671 ns3.google.com.
ttl=330671 ns1.google.com.
ttl=330671 ns4.google.com.
SOA: ttl=60 ns1.google.com. dns-admin.google.com. 925910870 900 900 1800 60
CAA: ttl=86400 \# 15 00 05 69 73 73 75 65 70 6b 69 2e 67 6f 6f 67
TXT: ttl=3600 "facebook-domain-verification=64jdes7le4h7e7lfpi22rijygx58j1"
ttl=3600 "v=spf1 include:google.com mx -all"
ttl=3600 "google-site-verification=QtQWEwHWM8tHiJ4s-jJWzEQrD_fF3luPnpzNDH-Nw-w"

fetched 2026-06-04T11:37:15.834Z

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

1 MX record(s) present

Why it matters: MX records direct inbound mail. Misconfiguration silently breaks email delivery and lets attackers stand up parallel MX hosts for spoofing campaigns (ISO 27001 A.8.21).

pri=0 smtp.google.com.

fetched 2026-06-04T11:37:15.832Z

mx

info

Open standalone →

resolving mx…

spf

info

Open standalone →

-all hardfail — strict policy

Why it matters: SPF tells receiving servers which hosts may send mail for the domain. Without it, any sender can forge the envelope-from — the primary mechanism behind business-email-compromise (SOC 2 CC6.7).

v=spf1 include:google.com mx -all

v=spf1
include:google.com
mx
-all

fetched 2026-06-04T11:37:15.831Z

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

p=reject — strict policy

Why it matters: DMARC binds SPF and DKIM into an enforceable policy (quarantine or reject) and surfaces spoofing attempts via aggregate reports. `p=none` or absent means spoofing succeeds silently (SOC 2 CC6.7).

v=DMARC1; p=reject; rua=mailto:mailauth-reports@google.com

v=: DMARC1
p=: reject
rua=: mailto:mailauth-reports@google.com

fetched 2026-06-04T11:37:15.841Z

dmarc

info

Open standalone →

resolving dmarc…

dkim

low

Open standalone →

no DKIM selectors found — likely not configured

Why it matters: DKIM signs outbound mail so receivers can detect tampering. Missing selectors or rotated-away keys break DMARC alignment and let receivers downgrade trust (ISO 27001 A.8.24).

Recommendations

Enable DKIM signing in your mail provider and publish the provided TXT record
Common selectors: google._domainkey, selector1._domainkey (Microsoft), mail._domainkey

no DKIM record on probed selectors (default, google, k1, selector1, selector2, mxvault)

dkim

info

Open standalone →

probing dkim selectors…

tls

low

Open standalone →

cert expires in 67 days

Why it matters: A valid current TLS certificate is the baseline for data in transit. Expiry, weak chain, or hostname mismatch break HTTPS and fail PCI 4.2.1 / SOC 2 CC6.1.

Recommendations

Schedule certificate renewal — consider enabling auto-renewal

subject cn:: *.google.com
issuer:: WR2 / Google Trust Services
valid:: May 18 18:35:21 2026 GMT → Aug 10 18:35:20 2026 GMT
authorized:: yes
sha256:: 33:AC:FF:FD:20:5B:CA:23:B2:51:59:85:F8:5B:A6:A4:77:F1:30:2F:85:34:B3:10:29:F2:76:A5:E0:16:DF:E8
sans: *.google.com
*.appengine.google.com
*.bdn.dev
*.origin-test.bdn.dev
*.cloud.google.com
*.crowdsource.google.com
*.datacompute.google.com
*.google.ca
*.google.cl
*.google.co.in
*.google.co.jp
*.google.co.uk
*.google.com.ar
*.google.com.au
*.google.com.br
*.google.com.co
*.google.com.mx
*.google.com.tr
*.google.com.vn
*.google.de
*.google.es
*.google.fr
*.google.hu
*.google.it
*.google.nl
*.google.pl
*.google.pt
*.gemini.cloud.google.com
*.gstatic.com
*.metric.gstatic.com
*.gvt1.com
*.gcpcdn.gvt1.com
*.gvt2.com
*.gcp.gvt2.com
*.url.google.com
*.youtube-nocookie.com
*.ytimg.com
ai.android
android.com
*.android.com
*.flash.android.com
g.co
*.g.co
goo.gl
www.goo.gl
google-analytics.com
*.google-analytics.com
google.com
googlecommerce.com
*.googlecommerce.com
urchin.com
*.urchin.com
youtu.be
youtube.com
*.youtube.com
music.youtube.com
*.music.youtube.com
youtubeeducation.com
*.youtubeeducation.com
youtubekids.com
*.youtubekids.com
yt.be
*.yt.be
android.clients.google.com
*.aistudio.google.com

fetched 2026-06-04T11:37:15.889Z

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

HTTPS served correctly

Why it matters: Bare HTTP requests must redirect to HTTPS without dropping the user mid-chain. Plain-text fallback or open redirects fail PCI 4.2.1 and feed phishing chains (SOC 2 CC6.6).

final status: 200 · 2 hops

[301] https://youtube.com/
[200] https://www.youtube.com/

fetched 2026-06-04T11:37:16.041Z

redirects

info

Open standalone →

tracing redirects…

headers

info

Open standalone →

1 security header(s) missing

Why it matters: Security headers — HSTS, CSP, X-Frame-Options, Referrer-Policy — defend against XSS, clickjacking, and downgrade attacks. Absent headers map directly to OWASP ASVS V14 findings (ISO 27001 A.8.23).

Recommendations

Add response header — Referrer-Policy: strict-origin-when-cross-origin

final url: https://www.youtube.com/

security headers

strict-transport-security: max-age=31536000
content-security-policy: require-trusted-types-for 'script', base-uri 'self';object-src 'none';script-src 'report-sample' 'nonce-MTjh5Dk0AW6T34ScBJoYfg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';report-uri https://csp.withgoogle.com/csp/youtube_main/strict
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
referrer-policy: —
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*

other headers

accept-ch: Sec-CH-Viewport-Width, Sec-CH-DPR, Device-Memory
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-opener-policy: same-origin-allow-popups; report-to="youtube_main"
date: Thu, 04 Jun 2026 11:37:16 GMT
document-policy: include-js-call-stacks-in-crash-reports
expires: Mon, 01 Jan 1990 00:00:00 GMT
origin-trial: AmhMBR6zCLzDDxpW+HfpP67BqwIknWnyMOXOQGfzYswFmJe+fgaI6XZgAzcxOrzNtP7hEDsOo1jdjFnVr2IdxQ4AAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTc1ODA2NzE5OSwiaXNTdWJkb21haW4iOnRydWV9, AiDEBptUfVeO93q48VdVMe/ubupazdAl8AaHP+NBzdnW8quUcHdzJUyGSfrmtpKJu7EOvwRp9ug2rEo3XU+WMAMAAAB2eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJEZXZpY2VCb3VuZFNlc3Npb25DcmVkZW50aWFsczIiLCJleHBpcnkiOjE3NzQzMTA0MDAsImlzU3ViZG9tYWluIjp0cnVlfQ==
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info."
pragma: no-cache
report-to: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]}
reporting-endpoints: crash-reporting="/web-reports?context=eJwNzX9M1HUcx3G-PMvYnXL3ve_3-_m8b7RsxmrNHR1M2ZCcRuWKDXVzbRgaAZ3NRXcKB8Iw55pUllBsOqPUWGOFsi7NrY3I0DZixY-K2iQWkmY66tYP-wGEZp8_Hnv_2F57-Y4syn0kbm25p846sC5p_fNO0nqvP2ml72y0KpY1WrXTTdaxYHlm028-Kpb7-abUT3q9n2e2-PnwXT_9H_iZuupnRcNiznQuoerSEnr6stk4lE2H8euNbApXB2iMBfA3Bnhjf4D8wwH0FwHO5AYpKgsy_maQ294P8v1skPaVNkces5mqtCl72mb3bpt9Rkm7zcAJm5yUTXmfTcW0ze0zNpfmbG6WhiirCHE1EaJ43Ow5Dr1LHSIrHbatdZjb4OBLOPy012HzIYePTzusm3A4eM3h-oLDK67LRu1SnXTZ0-mS6nL5qtslPeQSH3HpnXB5dtLlaIbH667HQ8rjLvH4MsejealH_d0eJZs8jr_gUfuSx6mXPaxDHqOjHn3feWRe9Gi96fGRrch1FMXGwn2KqnxF1nrFazWKkVrFbL3iXIOipVnR87xi9T5Fqkdx8oTi95OKg0OK3knFmh8VnTOKnHnFX5mas_dqRvI0y9doTpdofjFSj2oySjXzTZorbeY-pWn9RJM1oImf01z4VDM5qOke1syMaSLfavYY9ec1q6Y1W3_QlFw282dNhzF-TXPjT82KvzVFRtuc-RvWv6ZvwXTdKryYJTzgEx4OCBtEGMsXQkWCGPWrhCEjfL_QXCa0G89tErrKhbWbhbPG4q3CyJPCEzHBSZhsUshoES4bu_YLHcaOV4WqY8LOt83f2NltcseFbGO432QGhYLPhceHTeeoMDgmtJ0X3poQiqcEdUE4cNHsaSFl8IcwOivcMS-0XBeuZIZ5kDCHbwmzNxAm5M9Kf9b69aJg18B_vmWR5kRDsqE6lrcrVh3ZVpeIJyOx-FORmrrtye01VbWVBdGCwmhhtCAvWlS5I_o_VPj5Xw"
server: ESF
set-cookie: VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgMg%3D%3D; Domain=.youtube.com; Expires=Tue, 01-Dec-2026 11:37:16 GMT; Path=/; Secure; HttpOnly; SameSite=none
transfer-encoding: chunked
vary: Sec-CH-Viewport-Width, Sec-CH-DPR, Device-Memory
x-xss-protection: 0

fetched 2026-06-04T11:37:16.033Z

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

no CORS headers — cross-origin requests blocked by default

Why it matters: Overly permissive CORS (wildcard with credentials, or reflected origin) lets any origin read authenticated responses from this domain. OWASP A05 misconfiguration territory (NIST AC-4).

origin: https://domainposture.com
method: GET
preflight status: 405

access-control-* headers

access-control-allow-origin: —
access-control-allow-methods: —
access-control-allow-headers: —
access-control-allow-credentials: —
access-control-max-age: —
access-control-expose-headers: —

no access-control-* headers returned — site does not advertise CORS to this origin

fetched 2026-06-04T11:37:15.930Z

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

HTTPS surface reachable (robots ✓, sitemap ✗, title ✓)

Why it matters: Public files — robots.txt, sitemap.xml, head meta — are what attackers see first during reconnaissance. Misadvertised paths, stale sitemaps, and verbose generators leak more than intended (ISO 27001 A.8.9).

robots.txt

present

# robots.txt file for YouTube
# Created in the distant future (the year 2000) after
# the robotic uprising of the mid 90's which wiped out all humans.

User-agent: Mediapartners-Google*
Disallow:

User-agent: *
Disallow: /api/
Disallow: /comment
Disallow: /feeds/videos.xml
Disallow: /file_download
Disallow: /get_video
Disallow: /get_video_info
Disallow: /get_midroll_info
Disallow: /live_chat
Disallow: /login
Disallow: /qr
Disallow: /results
Disallow: /signup
Disallow: /t/terms
Disallow: /timedtext_video
Disallow: /verify_age
Disallow: /watch_ajax
Disallow: /watch_fragments_ajax
Disallow: /watch_popup
Disallow: /watch_queue_ajax
Disallow: /youtubei/

Sitemap: https://www.youtube.com/sitemaps/sitemap.xml
Sitemap: https://www.youtube.com/product/sitemap.xml

sitemap.xml

absent

head

title: YouTube
description: Enjoy the videos and music you love, upload original content, and share it all with friends, family, and the world on YouTube.

social

og:image: https://www.youtube.com/img/desktop/yt_1200.png
og:title: YouTube

fetched 2026-06-04T11:37:16.105Z

web-surface

info

Open standalone →

inspecting web surface…

dnssec

low

Open standalone →

DNSSEC not configured — no DS or DNSKEY records found

Why it matters: DNSSEC cryptographically signs DNS responses, blocking cache-poisoning attacks. US federal civilian agencies are required to enable it under OMB M-22-09 (NIST SC-20).

Recommendations

Enable DNSSEC in your DNS provider's control panel and add the resulting DS record at your registrar

enabled: no
DS records: —
DNSKEY records: —

fetched 2026-06-04T11:37:15.845Z

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

not applicable: no _mta-sts TXT record

Why it matters: MTA-STS forces inbound SMTP to use TLS and refuse downgraded connections. Without it, an in-path attacker can strip TLS and read mail in plaintext (SOC 2 CC6.7).

no _mta-sts TXT record

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

not applicable: no TLSRPT record

Why it matters: TLS-RPT publishes a reporting address for SMTP-TLS failures. Without it, downgrade attacks on inbound mail go unnoticed (SOC 2 CC7.2).

no TLSRPT record

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

domain registered until 2027-02-15

Why it matters: Registrar and expiry tell auditors the domain is owned, current, and not about to lapse. An expired or about-to-expire domain fails business-continuity evidence (SOC 2 A1.2).

registrar: MarkMonitor Inc.
created: 2005-02-15T05:13:12Z
expires: 2027-02-15T05:13:12Z
statuses: clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited, clientTransferProhibited https://icann.org/epp#clientTransferProhibited, clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited, serverDeleteProhibited https://icann.org/epp#serverDeleteProhibited, serverTransferProhibited https://icann.org/epp#serverTransferProhibited, serverUpdateProhibited https://icann.org/epp#serverUpdateProhibited

fetched 2026-06-04T11:37:16.185Z

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

10 subdomain(s) found in CT logs (13 wildcard cert(s))

Why it matters: Every certificate issued for this domain is published in Certificate Transparency logs — including subdomains you may have forgotten. Unknown subdomains in CT are pre-disclosed attack surface (ISO 27001 A.8.16).

source: crt.sh
certificates seen: 787
subdomains in CT: 10 discovered (full list in Domain Audit Report)
wildcards: *.c.youtube.com, *.cache1.c.youtube.com, *.cache2.c.youtube.com, *.cache3.c.youtube.com, *.cache4.c.youtube.com, *.cache5.c.youtube.com, *.cache6.c.youtube.com, *.cache7.c.youtube.com, *.cache8.c.youtube.com, *.cctldtest.youtube.com, *.gdata.youtube.com, *.sandbox.youtube.com, *.youtube.com

fetched 2026-06-04T11:37:25.145Z

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.