airtel.in

15-check dossier · scoreboard above, section details below

Get a pack →

Scanning…

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

resolving mx…

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

resolving dmarc…

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

tracing redirects…

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

inspecting web surface…

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.

airtel.in

15-check dossier · scoreboard above, section details below

Get a pack →

A-

Audit-ready · 4 minor advisories

Aggregate grade across 15 checks. Auditors typically flag any High-severity finding.

Pass: 11
Warn: 4
Fail: 0

What an auditor would flag first

low
DMARC
p=quarantine — receivers send to spam
SOC 2 CC6.7ISO 27001 A.13.2.1
low
DKIM
no DKIM selectors found — likely not configured
SOC 2 CC6.7
low
Security headers
4 security header(s) missing
SOC 2 CC6.6ISO 27001 A.14.1.2

Need this as an artifact your auditor can verify?

Your airtel.in scan flagged 4 low findings. A signed pack covers the apex plus up to 100 CT-discovered subdomains, Ed25519-signed and ISO-timestamped, delivered in 10–30 minutes.

Get a pack →See methodology See a sample$29

Scanning…

15-check summary

DNS recordsA/AAAA records present
MX15 MX record(s) present
SPF-all hardfail — strict policy
DMARCp=quarantine — receivers send to spam
DKIMno DKIM selectors found — likely not configured
TLS certificatecert valid for 195 days
Redirect chainHTTPS served correctly
Security headers4 security header(s) missing
CORSno CORS headers — cross-origin requests blocked by default
Web surfaceHTTPS surface reachable (robots ✓, sitemap ✓, title ✓)
MTA-STSnot applicable: no _mta-sts TXT record
TLS-RPTnot applicable: no TLSRPT record
DNSSECDNSSEC not configured — no DS or DNSKEY records found
WHOISdomain registered until 2034-01-06
Certificate Transparencycheck failed: crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

dns

info

Open standalone →

A/AAAA records present

Why it matters: Without authoritative A or AAAA records on the apex, the domain is unreachable. Missing baseline DNS shows up in vendor reviews as evidence of unmanaged infrastructure (SOC 2 CC6.6).

A: ttl=172800 125.16.74.90
AAAA: ttl=600 2404:a800:ff00:1::101
NS: ttl=26501 dnsdel.mantraonline.com.
ttl=26501 aaadel.mantraonline.com.
SOA: ttl=28800 aaadel.mantraonline.com. root.dnsdel.mantraonline.com. 3363 10800 3600 2419200 900
CAA: —
TXT: ttl=3600 "airtel.in--" "pmsxj88cf1fmfqp091011qzzgpnzm2wq"
ttl=3600 "airtel.in" "-" "40qskjfl0rr084dtr0yjrcb3r7w5nv8n"
ttl=3600 "vb5vdhj4irsfv2bnrln90p84dn"
ttl=3600 "zgys6vbvqkc3bsz8kvkkqtlbm1j1z8mg"
ttl=3600 "538nb22w1vwx67t3c39bp3zgb41bsc3x"
ttl=3600 "v=spf1 a:meeting.videoiq.airtel.in a:dashboard.videoiq.airtel.in include:airtel.com -all"
ttl=3600 "MS=ms76018696"
ttl=3600 "ntv52vcbc0l52fbnmaf79isu35"
ttl=3600 "h2hj2pn0y92h1vv213vx4qcv358f0hnx"
ttl=3600 "1lqgdnsfp8t0qn79n6kdx7vkg0f5m55v"
ttl=3600 "5n6m36104g555731c8159xxpk01y7mn9"
ttl=3600 "security_contact=mailto:securitybugs@airtel.com"
ttl=3600 "kvw1v8kc00b6sq74bmgskvnc656zvbvm"
ttl=3600 "sending_domain1080903=13391316b971927b81c1b09fc1fe701a4a5eb507585afdf5af3b3b419e304c0c"
ttl=3600 "_tvoxqlzd3f304bj7sewxj6s45wgsrnu"
ttl=3600 "_slm42zy9tcpw6jitxfynbdgy7ucv8op"
ttl=3600 "_n5zea02m54ta56ohiaroffxx1arca17"
ttl=3600 "d033qghwc238c1nf9nw4j7hmvtt9j83v"
ttl=3600 "21F6-15AC-B616-A27A-273F-FAD6-3ED8-7DCE"
ttl=3600 "701e4vklfj3lt8hef4luka3jbc"

fetched 2026-05-23T09:37:10.802Z

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

15 MX record(s) present

Why it matters: MX records direct inbound mail. Misconfiguration silently breaks email delivery and lets attackers stand up parallel MX hosts for spoofing campaigns (ISO 27001 A.8.21).

pri=0 airtel-in.mail.protection.outlook.com.
pri=5 mx-mail6.airtel.com.
pri=5 mx-mail5.airtel.com.
pri=5 mx-mail41.airtel.com.
pri=5 mx-mail40.airtel.com.
pri=5 mx-mail4.airtel.com.
pri=5 mx-mail39.airtel.com.
pri=5 mx-mail38.airtel.com.
pri=5 mx-mail37.airtel.com.
pri=5 mx-mail36.airtel.com.
pri=5 mx-mail35.airtel.com.
pri=5 mx-mail34.airtel.com.
pri=5 mx-mail3.airtel.com.
pri=15 mx-mail2.airtel.com.
pri=15 mx-mail1.airtel.com.

fetched 2026-05-23T09:37:10.801Z

mx

info

Open standalone →

resolving mx…

spf

info

Open standalone →

-all hardfail — strict policy

Why it matters: SPF tells receiving servers which hosts may send mail for the domain. Without it, any sender can forge the envelope-from — the primary mechanism behind business-email-compromise (SOC 2 CC6.7).

v=spf1 a:meeting.videoiq.airtel.in a:dashboard.videoiq.airtel.in include:airtel.com -all

v=spf1
a:meeting.videoiq.airtel.in
a:dashboard.videoiq.airtel.in
include:airtel.com
-all

fetched 2026-05-23T09:37:10.806Z

spf

info

Open standalone →

resolving spf…

dmarc

low

Open standalone →

p=quarantine — receivers send to spam

Why it matters: DMARC binds SPF and DKIM into an enforceable policy (quarantine or reject) and surfaces spoofing attempts via aggregate reports. `p=none` or absent means spoofing succeeds silently (SOC 2 CC6.7).

Recommendations

Upgrade to p=reject once your SPF and DKIM pass rates are consistently high

v=DMARC1; p=quarantine; rua=mailto:dmarc17@airtel.in; ruf=mailto:dmarc17@airtel.in; adkim=r; aspf=s; rf=afrf

v=: DMARC1
p=: quarantine
rua=: mailto:dmarc17@airtel.in
ruf=: mailto:dmarc17@airtel.in
adkim=: r
aspf=: s
rf=: afrf

fetched 2026-05-23T09:37:10.789Z

dmarc

info

Open standalone →

resolving dmarc…

dkim

low

Open standalone →

no DKIM selectors found — likely not configured

Why it matters: DKIM signs outbound mail so receivers can detect tampering. Missing selectors or rotated-away keys break DMARC alignment and let receivers downgrade trust (ISO 27001 A.8.24).

Recommendations

Enable DKIM signing in your mail provider and publish the provided TXT record
Common selectors: google._domainkey, selector1._domainkey (Microsoft), mail._domainkey

no DKIM record on probed selectors (default, google, k1, selector1, selector2, mxvault)

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

cert valid for 195 days

Why it matters: A valid current TLS certificate is the baseline for data in transit. Expiry, weak chain, or hostname mismatch break HTTPS and fail PCI 4.2.1 / SOC 2 CC6.1.

subject cn:: airtel.in
issuer:: DigiCert Global G2 TLS RSA SHA256 2020 CA1 / DigiCert Inc
valid:: May 20 00:00:00 2026 GMT → Dec 4 23:59:59 2026 GMT
authorized:: yes
sha256:: DA:10:F3:48:04:1A:E4:47:B4:4F:F2:40:84:4F:FB:5A:DC:CD:06:81:32:7B:18:A8:1F:F1:F1:59:14:23:EE:93
sans: airtel.in
zapi.airtel.in
m.airtel.in
ebpp.airtelworld.com
business.airtel.in
opennetwork.airtel.in
www.airtel.in
dlt.airtel.in

fetched 2026-05-23T09:37:09.755Z

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

HTTPS served correctly

Why it matters: Bare HTTP requests must redirect to HTTPS without dropping the user mid-chain. Plain-text fallback or open redirects fail PCI 4.2.1 and feed phishing chains (SOC 2 CC6.6).

final status: 200 · 2 hops

[302] https://airtel.in/
[200] https://www.airtel.in/

fetched 2026-05-23T09:37:09.999Z

redirects

info

Open standalone →

tracing redirects…

headers

low

Open standalone →

4 security header(s) missing

Why it matters: Security headers — HSTS, CSP, X-Frame-Options, Referrer-Policy — defend against XSS, clickjacking, and downgrade attacks. Absent headers map directly to OWASP ASVS V14 findings (ISO 27001 A.8.23).

Recommendations

Add response header — Content-Security-Policy: default-src 'self' (tune per app)
Add response header — X-Content-Type-Options: nosniff
Add response header — Referrer-Policy: strict-origin-when-cross-origin
Add permissions-policy response header

final url: https://www.airtel.in/

security headers

strict-transport-security: max-age=63072000
content-security-policy: —
x-frame-options: SAMEORIGIN
x-content-type-options: —
referrer-policy: —
permissions-policy: —

other headers

accept-ranges: bytes
access-control-allow-headers: X-AT-Client, x-bsy-countryCode, providerTkn, merchantId, agentId, userId, Origin, X-Requested-With, Content-Type, channel , Accept ,emailId, MSISDN, TOKEN, OTP, OTP_FLOW, googleCookie, adsHeader, cc, test-header, x-bsy-net, x-bsy-network, x-bsy-locale, x-bsy-snet, x-client, x-bsy-dt, x-bsy-os, x-bsy-bn, x-bsy-utkn, x-bsy-did, iv-user, requestSrc, generateToken, text, freetext, requesterId, LOB, visitorID,true-client-ip,userAgent,completeUrl,shortUrl,flow,edTkn,homes-token,X-ADF-CHANNEL,x-jhs-ml,dvCookie,X-Consumer-Name
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: *
access-control-expose-headers: TOKEN, googleCookie,edTkn,dvCookie,x-jhs-ml
access-control-max-age: 0
airtel_server: ONLINE
cache-control: no-cache, no-store, must-revalidate
connection: keep-alive
content-encoding: gzip
content-length: 1190
content-type: text/html; charset=UTF-8
date: Sat, 23 May 2026 09:37:10 GMT
etag: "9b9-6523111a27ac0-gzip"
expires: Sat, 23 May 2026 09:37:10 GMT
last-modified: Tue, 19 May 2026 19:56:03 GMT
pragma: no-cache
server: Apache
server-timing: ak_p; desc="1779529030034_399898289_1208310920_32_11412_1_2_-";dur=1
vary: Accept-Encoding

fetched 2026-05-23T09:37:10.052Z

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

no CORS headers — cross-origin requests blocked by default

Why it matters: Overly permissive CORS (wildcard with credentials, or reflected origin) lets any origin read authenticated responses from this domain. OWASP A05 misconfiguration territory (NIST AC-4).

origin: https://drwho.me
method: GET
preflight status: 302

access-control-* headers

access-control-allow-origin: —
access-control-allow-methods: —
access-control-allow-headers: —
access-control-allow-credentials: —
access-control-max-age: —
access-control-expose-headers: —

no access-control-* headers returned — site does not advertise CORS to this origin

fetched 2026-05-23T09:37:10.002Z

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

HTTPS surface reachable (robots ✓, sitemap ✓, title ✓)

Why it matters: Public files — robots.txt, sitemap.xml, head meta — are what attackers see first during reconnaissance. Misadvertised paths, stale sitemaps, and verbose generators leak more than intended (ISO 27001 A.8.9).

robots.txt

present

User-Agent: *

Disallow:/airtellive/*
Disallow:/growth-cms-pages/*
Disallow:/app*
Disallow:/mobile*
Disallow:/forme*
Disallow:/aes*
Disallow:/m/*
Disallow:/hfz-hellotunes/*
Disallow:/Y/*
Disallow:/4g_lte/*
Disallow:/ga*
Disallow:/personal/*
Disallow:/wps/*
Disallow:/prepaid-recharge/complete
Disallow:/postpaid-bill-pay/complete
Disallow:/index-all/product-listing.html
Allow:/bank/*
Allow: /digital-store/
Disallow:/blog/author/*/*/*
Disallow:*&*
Disallow:*/digital-store/*/*utm*
Disallow:/business/b2b/airtel-iq/api-docs/**

# ============================
# AI / LLM Crawlers (Allowed)
# ============================

User-agent: GPTBot
Allow: /

User-agent: PerplexityBot
Allow: /

User-agent: bingbot
Allow: /

User-agent: BingPreview
Allow: /

User-agent: bingGPT
Allow: /

User-agent: Googlebot
Allow: /

User-agent: Google-Extended
Allow: /

User-agent: Bard
Allow: /

User-agent: Gemini
Allow: /

User-agent: ClaudeBot
Allow: /

# ============================
# Restricted Crawlers
# ============================


User-Agent: Slurp
Disallow: /

# ============================
# Sitemap Directives
# ============================

Sitemap: https://www.airtel.in/sitemap.xml
Sitemap: https://www.airtel.in/infinity-sitemap.xml
Sitemap: https://www.airtel.in/isp-sitemap.xml
Sitemap: https://www.airtel.in/broadband-sitemap.xml
Sitemap: https://www.airtel.in/cms-sitemap.xml
Sitemap: https://www.airtel.in/dth-sitemap.xml
Sitemap: https://www.airtel.in/bank/sitemap.xml
Sitemap: https://www.airtel.in/growth-sitemaps/growth-sitemap6.xml
Sitemap: https://www.airtel.in/growth-sitemaps/growth-sitemap5.xml
Sitemap: https://www.airtel.in/growth-sitemaps/growth-sitemap4.xml
Sitemap: https://www.airtel.in/growth-sitemaps/growth-sitemap3.xml
Sitemap: https://www.airtel.in/growth-sitemaps/growth-sitemap2.xml
Sitemap: https://www.airtel.in/growth-sitemaps/growth-sitemap1.xml
Sitemap: https://www.airtel.in/business-sitemap.xml

sitemap.xml

present — 97 url(s)

head

title: Airtel: Wi-Fi, Postpaid, Prepaid, DTH, Bank & Business
description: We are India

social

no OpenGraph or Twitter meta tags found

fetched 2026-05-23T09:37:10.456Z

web-surface

info

Open standalone →

inspecting web surface…

dnssec

low

Open standalone →

DNSSEC not configured — no DS or DNSKEY records found

Why it matters: DNSSEC cryptographically signs DNS responses, blocking cache-poisoning attacks. US federal civilian agencies are required to enable it under OMB M-22-09 (NIST SC-20).

Recommendations

Enable DNSSEC in your DNS provider's control panel and add the resulting DS record at your registrar

enabled: no
DS records: —
DNSKEY records: —

fetched 2026-05-23T09:37:10.792Z

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

not applicable: no _mta-sts TXT record

Why it matters: MTA-STS forces inbound SMTP to use TLS and refuse downgraded connections. Without it, an in-path attacker can strip TLS and read mail in plaintext (SOC 2 CC6.7).

no _mta-sts TXT record

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

not applicable: no TLSRPT record

Why it matters: TLS-RPT publishes a reporting address for SMTP-TLS failures. Without it, downgrade attacks on inbound mail go unnoticed (SOC 2 CC7.2).

no TLSRPT record

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

domain registered until 2034-01-06

Why it matters: Registrar and expiry tell auditors the domain is owned, current, and not about to lapse. An expired or about-to-expire domain fails business-continuity evidence (SOC 2 A1.2).

registrar: GoDaddy
created: 2005-01-06T03:10:05.860Z
expires: 2034-01-06T03:10:05.860Z
statuses: client renew prohibited, client update prohibited, client transfer prohibited, client delete prohibited

fetched 2026-05-23T09:37:09.738Z

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

check failed: crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

Why it matters: Every certificate issued for this domain is published in Certificate Transparency logs — including subdomains you may have forgotten. Unknown subdomains in CT are pre-disclosed attack surface (ISO 27001 A.8.16).

crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.