zendesk.com

15-check dossier · scoreboard above, section details below

Get a pack →

Scanning…

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

resolving mx…

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

resolving dmarc…

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

tracing redirects…

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

inspecting web surface…

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.

zendesk.com

15-check dossier · scoreboard above, section details below

Get a pack →

Mostly compliant · 5 items need attention

Aggregate grade across 15 checks. Auditors typically flag any High-severity finding.

Pass: 10
Warn: 5
Fail: 0

What an auditor would flag first

medium
SPF
~all softfail — receivers may still accept
SOC 2 CC6.7ISO 27001 A.13.2.1
low
DKIM
no DKIM selectors found — likely not configured
SOC 2 CC6.7
low
TLS certificate
cert expires in 55 days
SOC 2 CC6.6ISO 27001 A.13.1.1

Need this as an artifact your auditor can verify?

Your zendesk.com scan flagged 1 medium and 4 low findings. A signed pack covers the apex plus up to 100 CT-discovered subdomains, Ed25519-signed and ISO-timestamped, delivered in 10–30 minutes.

Get a pack →See methodology See a sample$29

Scanning…

15-check summary

DNS recordsA/AAAA records present
MX6 MX record(s) present
SPF~all softfail — receivers may still accept
DMARCp=reject — strict policy
DKIMno DKIM selectors found — likely not configured
TLS certificatecert expires in 55 days
Redirect chainHTTPS served correctly
Security headers3 security header(s) missing
CORSno CORS headers — cross-origin requests blocked by default
Web surfaceHTTPS surface reachable (robots ✓, sitemap ✓, title ✓)
MTA-STSnot applicable: no _mta-sts TXT record
TLS-RPTnot applicable: no TLSRPT record
DNSSECDNSSEC not configured — no DS or DNSKEY records found
WHOISdomain registered until 2027-05-16
Certificate Transparencycheck failed: crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

dns

info

Open standalone →

A/AAAA records present

Why it matters: Without authoritative A or AAAA records on the apex, the domain is unreachable. Missing baseline DNS shows up in vendor reviews as evidence of unmanaged infrastructure (SOC 2 CC6.6).

A: ttl=260 216.198.53.2
ttl=260 216.198.54.2
AAAA: —
NS: ttl=172800 ns-1213.awsdns-23.org.
ttl=172800 ns-1858.awsdns-40.co.uk.
ttl=172800 ns-444.awsdns-55.com.
ttl=172800 ns-754.awsdns-30.net.
SOA: ttl=900 ns-1213.awsdns-23.org. awsdns-hostmaster.amazon.com. 1 7200 900 1209600 86400
CAA: —
TXT: ttl=2803 "0ed1fe018a2374893f27154f25a6f54784f96b4b3b"
ttl=2803 "92cfb88d-b895-4f46-934b-4ecd107e59a1"
ttl=2803 "942552362-2482447"
ttl=2803 "DirectFedAuthUrl=https://zendesk.okta.com/app/zendesk_aiagentsazurezig_1/exk12ddadohvIJh7H2p8/sso/saml"
ttl=2803 "ENJUTYRYQ"
ttl=2803 "MS=ms87052054"
ttl=2803 "MS=ms91445911"
ttl=2803 "adobe-idp-site-verification=f87b90e3b016c68095df9b01c1339e70eaeb158b9517711d3c483357c52e2e9d"
ttl=2803 "adobe-idp-site-verification=fbc17c835736a1814a7f09390192ce1da750205f984fa2e7582277ae8ceb1cb2"
ttl=2803 "apple-domain-verification=3pfH4AKY0NA72nHl"
ttl=2803 "asv=63067a6ba7ee681dbe3e26dce01a13a5"
ttl=2803 "atlassian-domain-verification=1EBT0aNzHvpjA0mUqdCF+qU/gsS8qxjjo50wYVc4nlCooKAJZUmVI2MnseANx2dd"
ttl=2803 "atlassian-domain-verification=VKatnNN6Z5k9QFIABnW7CaZM1H0z5bp40v0DPNj7ba9zcn8JmG3POJsGOopCJ62O"
ttl=2803 "atlassian-sending-domain-verification=740db120-4e15-4d5d-a7b0-66da110fa222"
ttl=2803 "bettercomp-verify=eeb8764cb09d9e7ef96ba262012aac38cb571dbbb4fc996b5e3403a665bfe878"
ttl=2803 "box-domain-verification=a9056151b8e911fcdba552e791c9b4d8b8cc2f16d1bf5e9eced4abfcf3d32a30"
ttl=2803 "ca3-f35d69855c2041b4b2d4e861cb9fdd6f"
ttl=2803 "canva-site-verification=U1b9IGcuRrxhapP7GzJMAw"
ttl=2803 "count-okta-7SkGZInGQ7j0z4Cy4efxK"
ttl=2803 "cursor-domain-verification-w67ssa=qctFFin6s0w3gtIS0YHW62IRx"
ttl=2803 "docker-verification=c5555047-3106-4749-98b2-1ae5745ba193"
ttl=2803 "docusign=76412763-2e7d-4385-a9cf-227e938144d6"
ttl=2803 "figma-domain-verification=d38ad4a1c1d6029e954e8d5c827d71106fb9844707ae35040523094f7bf4ce19-1740563203"
ttl=2803 "google-site-verification=0B1l6Hmp14vgBWc3Yi9Lkdn98KxqEfm3_IcgKsBrUoc"
ttl=2803 "google-site-verification=LYyGUy8j5JeOt_Faduw1TMPTAR4fEzxfXDoT5B79giw"
ttl=2803 "google-site-verification=Xcw5HeCMN0tRTA_wtmvXyrNJhnkOfxqydAJziyZYbs8"
ttl=2803 "google-site-verification=egnMXsUGOEcJHf0AEe6sA2ui1hxV56dVP5ekk029C8M"
ttl=2803 "hj-ownership=uF7x7UmKwsPqPAfBVE6Tg"
ttl=2803 "hubspot-developer-verification=NmFlNmZmNWEtYWFkMS00NjFhLWIzNDEtMGE1ZTMxZDNkY2Y2"
ttl=2803 "hubspot-developer-verification=YmRjZTlhZTItZmRhNy00ZjZhLWFhZTYtMDVlNzIwMmM2ZDgx"
ttl=2803 "jTHbayHetmTY@@lm5PYDcPqV*F$W3Z&4AM$6u3acBLo$%xKnt!Kwr^@TP^jB43*pO^F6O8S8RizT8D03gHs#MWhF45fW3Tk%$mI"
ttl=2803 "jamf-site-verification=03ryvTnFRg7t7K1fdvusNQ"
ttl=2803 "mailru-verification: c287c4d52bb5fd3c"
ttl=2803 "miro-verification=3673a7d2bed1d9d95363960b5842c237312cf42a"
ttl=2803 "mongodb-site-verification=e30FUzWMBmdMTeKqSkHvbokTve6pZOvw"
ttl=2803 "mongodb-site-verification=yDpxj8ExSlalPAMCJ8OgGqccAE3RKtjy"
ttl=2803 "neat-pulse-domain-verification-VvrqZ7N=34d3bfcf-c556-4b05-a643-2019e0b08983"
ttl=2803 "onetrust-domain-verification=8cfd00023e5b4b53836b5be310a416cd"
ttl=2803 "openai-domain-verification=dv-cKgK7AWQErYbWivKlTNsL7qJ"
ttl=2803 "qxxIl-wTDURBUBT4magGxQ"
ttl=2803 "segment-site-verification=GEXWlzlTT3BdxCVHHD6RoG5BBa6eRlcg"
ttl=2803 "smartsheet-site-validation=uO9zE6IM1MDanLjT5EieLufj1cgQCau-"
ttl=2803 "thousandeyes:p6xh4ric6juof7rvskyh89vk8wvoruq7"
ttl=2803 "v=spf1 ip4:103.151.192.0/23 ip4:104.43.243.237 ip4:149.97.173.180 ip4:163.116.128.0/17 ip4:170.10.128.0/24 ip4:170.10.129.0/24 ip4:170.10.132.56/29 ip4:170.10.132.64/29 ip4:170.10.133.0/24 ip4:18.194.95.56 ip4:18.198.96.88 include:_spf1.zendesk.com ~all"

fetched 2026-06-04T00:15:22.918Z

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

6 MX record(s) present

Why it matters: MX records direct inbound mail. Misconfiguration silently breaks email delivery and lets attackers stand up parallel MX hosts for spoofing campaigns (ISO 27001 A.8.21).

pri=0 us-smtp-inbound-1.mimecast.com.
pri=0 us-smtp-inbound-2.mimecast.com.
pri=110 aspmx.l.google.com.
pri=120 alt1.aspmx.l.google.com.
pri=120 alt2.aspmx.l.google.com.
pri=130 aspmx2.googlemail.com.

fetched 2026-06-04T00:15:22.919Z

mx

info

Open standalone →

resolving mx…

spf

medium

Open standalone →

~all softfail — receivers may still accept

Why it matters: SPF tells receiving servers which hosts may send mail for the domain. Without it, any sender can forge the envelope-from — the primary mechanism behind business-email-compromise (SOC 2 CC6.7).

Recommendations

Move to -all (hardfail) once your mail flow is confirmed — softfail gives no real protection

v=spf1 ip4:103.151.192.0/23 ip4:104.43.243.237 ip4:149.97.173.180 ip4:163.116.128.0/17 ip4:170.10.128.0/24 ip4:170.10.129.0/24 ip4:170.10.132.56/29 ip4:170.10.132.64/29 ip4:170.10.133.0/24 ip4:18.194.95.56 ip4:18.198.96.88 include:_spf1.zendesk.com ~all

v=spf1
ip4:103.151.192.0/23
ip4:104.43.243.237
ip4:149.97.173.180
ip4:163.116.128.0/17
ip4:170.10.128.0/24
ip4:170.10.129.0/24
ip4:170.10.132.56/29
ip4:170.10.132.64/29
ip4:170.10.133.0/24
ip4:18.194.95.56
ip4:18.198.96.88
include:_spf1.zendesk.com
~all

fetched 2026-06-04T00:15:22.919Z

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

p=reject — strict policy

Why it matters: DMARC binds SPF and DKIM into an enforceable policy (quarantine or reject) and surfaces spoofing attempts via aggregate reports. `p=none` or absent means spoofing succeeds silently (SOC 2 CC6.7).

v=DMARC1; p=reject

v=: DMARC1
p=: reject

fetched 2026-06-04T00:15:22.920Z

dmarc

info

Open standalone →

resolving dmarc…

dkim

low

Open standalone →

no DKIM selectors found — likely not configured

Why it matters: DKIM signs outbound mail so receivers can detect tampering. Missing selectors or rotated-away keys break DMARC alignment and let receivers downgrade trust (ISO 27001 A.8.24).

Recommendations

Enable DKIM signing in your mail provider and publish the provided TXT record
Common selectors: google._domainkey, selector1._domainkey (Microsoft), mail._domainkey

no DKIM record on probed selectors (default, google, k1, selector1, selector2, mxvault)

dkim

info

Open standalone →

probing dkim selectors…

tls

low

Open standalone →

cert expires in 55 days

Why it matters: A valid current TLS certificate is the baseline for data in transit. Expiry, weak chain, or hostname mismatch break HTTPS and fail PCI 4.2.1 / SOC 2 CC6.1.

Recommendations

Schedule certificate renewal — consider enabling auto-renewal

subject cn:: zendesk.com
issuer:: E8 / Let's Encrypt
valid:: Apr 30 15:26:51 2026 GMT → Jul 29 15:26:50 2026 GMT
authorized:: yes
sha256:: C4:4E:7B:DB:E3:F7:FA:A5:58:B0:60:C8:8B:9E:B1:D7:03:B5:C8:8D:D2:AB:AC:D5:07:18:C6:73:99:B2:E2:67
sans: *.zendesk.com
zendesk.com

fetched 2026-06-04T00:15:22.924Z

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

HTTPS served correctly

Why it matters: Bare HTTP requests must redirect to HTTPS without dropping the user mid-chain. Plain-text fallback or open redirects fail PCI 4.2.1 and feed phishing chains (SOC 2 CC6.6).

final status: 200 · 2 hops

[301] https://zendesk.com/
[200] https://www.zendesk.com/

fetched 2026-06-04T00:15:23.161Z

redirects

info

Open standalone →

tracing redirects…

headers

low

Open standalone →

3 security header(s) missing

Why it matters: Security headers — HSTS, CSP, X-Frame-Options, Referrer-Policy — defend against XSS, clickjacking, and downgrade attacks. Absent headers map directly to OWASP ASVS V14 findings (ISO 27001 A.8.23).

Recommendations

Add response header — X-Frame-Options: DENY (or SAMEORIGIN if framing is intended)
Add response header — Referrer-Policy: strict-origin-when-cross-origin
Add permissions-policy response header

final url: https://www.zendesk.com/

security headers

strict-transport-security: max-age=0; preload
content-security-policy: default-src * wss://*.zopim.com 'unsafe-inline' 'unsafe-eval'; frame-ancestors 'self' *.zendesk.com *.zendesk.co.jp *.zendesk.co.uk *.zendesk.com.br *.zendesk.com.mx *.zendesk.de *.zendesk.es *.zendesk.fr *.zendesk.kr *.zendesk.nl *.zendesk.tw *.zendesk.hk staging500.resultsbydesign.com zendesk.ddev.site; font-src * data:; img-src * blob: data:; media-src * blob:;worker-src 'self' blob:
x-frame-options: —
x-content-type-options: nosniff
referrer-policy: —
permissions-policy: —

other headers

age: 3176
cache-control: public, max-age=3600
cf-cache-status: HIT
cf-ray: a062be293a190a52-IAD
connection: keep-alive
content-encoding: br
content-type: text/html; charset=utf-8
date: Thu, 04 Jun 2026 00:15:23 GMT
expires: Thu, 04 Jun 2026 01:15:23 GMT
last-modified: Wed, 03 Jun 2026 23:22:26 GMT
link: <https://web-assets.zendesk.com>; rel=preconnect, </scripts/adobe-websdk.js>; rel=preload; as=script
nc: T
server: cloudflare
set-cookie: __cf_bm=lT3v2kTt6eLSdGNQQvqnke7GAPx123ZVOZgiDXodqZ4-1780532123-1.0.1.1-a_GiZpVhkIk4ws32sOg64e0cZgSJ3XHDRWYjcIUfY_pKcBkfFBhNAWLTOYNYfmJb5aBc6.Ar4SljVtMxXwIP9E._8JPcNj5hy_gJPj4RyzI; path=/; expires=Thu, 04-Jun-26 00:45:23 GMT; domain=.www.zendesk.com; HttpOnly; Secure; SameSite=None
transfer-encoding: chunked
vary: accept-encoding

fetched 2026-06-04T00:15:23.126Z

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

no CORS headers — cross-origin requests blocked by default

Why it matters: Overly permissive CORS (wildcard with credentials, or reflected origin) lets any origin read authenticated responses from this domain. OWASP A05 misconfiguration territory (NIST AC-4).

origin: https://domainposture.com
method: GET
preflight status: 301

access-control-* headers

access-control-allow-origin: —
access-control-allow-methods: —
access-control-allow-headers: —
access-control-allow-credentials: —
access-control-max-age: —
access-control-expose-headers: —

no access-control-* headers returned — site does not advertise CORS to this origin

fetched 2026-06-04T00:15:23.010Z

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

HTTPS surface reachable (robots ✓, sitemap ✓, title ✓)

Why it matters: Public files — robots.txt, sitemap.xml, head meta — are what attackers see first during reconnaissance. Misadvertised paths, stale sitemaps, and verbose generators leak more than intended (ISO 27001 A.8.9).

robots.txt

present

User-agent: *
Allow: /
Disallow: /thank-you/
Disallow: /thank-you-enterprise-demo/
Disallow: /company/index/thank-you/
Disallow: /lp/adwords
Disallow: /zendesk-adwords-template/
Disallow: /brand
Disallow: /brand/
Disallow: /public/assets/html/
Disallow: /company/add-ons-agreement/
Disallow: /company/reseller-add-ons-agreement/
Disallow: /public/assets/sitemaps/
Disallow: /blog-ads-api-output/
Disallow: /blog/tags/expertise-zip
Disallow: /blog/tags/innovation-zip
Disallow: /blog/tags/trends-insight-zip
Disallow: /blog/tags/customer-service-zip
Disallow: /blog/tags/employee-service-zip
Disallow: /blog/tags/executive-insights-zip
Disallow: /blog/tags/best-practices-zip
Disallow: /blog/tags/product-news-zip
Disallow: /blog/tags/research-and-data-zip
Disallow: /blog/tags/customers-and-partners-zip
Disallow: /blog/tags/benchmark-zip
Disallow: /blog/tags/guides-zip
Disallow: /blog/tags/leadership-zip
Disallow: /blog/tags/podcasts-zip
Disallow: /blog/tags/reports-zip
Sitemap: https://www.zendesk.com/generated_sitemap.xml

sitemap.xml

present — 2 url(s)

head

title: AI-Powered Service Platform | Zendesk
description: Move beyond deflection with AI agents that resolve issues end-to-end. Improve service quality, speed, and scale. Start your free trial.

social

og:locale: en_US
og:type: website
og:title: AI-Powered Service Platform | Zendesk
og:description: Move beyond deflection with AI agents that resolve issues end-to-end. Improve service quality, speed, and scale. Start your free trial.
og:url: https://www.zendesk.com/
og:site_name: Zendesk
og:image: https://d1eipm3vz40hy0.cloudfront.net/images/logos/favicons/zendesk-image.png
twitter:card: summary
twitter:site: @zendesk

fetched 2026-06-04T00:15:23.216Z

web-surface

info

Open standalone →

inspecting web surface…

dnssec

low

Open standalone →

DNSSEC not configured — no DS or DNSKEY records found

Why it matters: DNSSEC cryptographically signs DNS responses, blocking cache-poisoning attacks. US federal civilian agencies are required to enable it under OMB M-22-09 (NIST SC-20).

Recommendations

Enable DNSSEC in your DNS provider's control panel and add the resulting DS record at your registrar

enabled: no
DS records: —
DNSKEY records: —

fetched 2026-06-04T00:15:23.012Z

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

not applicable: no _mta-sts TXT record

Why it matters: MTA-STS forces inbound SMTP to use TLS and refuse downgraded connections. Without it, an in-path attacker can strip TLS and read mail in plaintext (SOC 2 CC6.7).

no _mta-sts TXT record

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

not applicable: no TLSRPT record

Why it matters: TLS-RPT publishes a reporting address for SMTP-TLS failures. Without it, downgrade attacks on inbound mail go unnoticed (SOC 2 CC7.2).

no TLSRPT record

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

domain registered until 2027-05-16

Why it matters: Registrar and expiry tell auditors the domain is owned, current, and not about to lapse. An expired or about-to-expire domain fails business-continuity evidence (SOC 2 A1.2).

registrar: MarkMonitor Inc.
created: 2005-05-16T18:05:12Z
expires: 2027-05-16T18:05:12Z
statuses: clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited, clientTransferProhibited https://icann.org/epp#clientTransferProhibited, clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited, serverDeleteProhibited https://icann.org/epp#serverDeleteProhibited, serverTransferProhibited https://icann.org/epp#serverTransferProhibited, serverUpdateProhibited https://icann.org/epp#serverUpdateProhibited

fetched 2026-06-04T00:15:23.219Z

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

check failed: crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

Why it matters: Every certificate issued for this domain is published in Certificate Transparency logs — including subdomains you may have forgotten. Unknown subdomains in CT are pre-disclosed attack surface (ISO 27001 A.8.16).

crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.