ally.com

15-check dossier · scoreboard above, section details below

Get a pack →

Scanning…

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

resolving mx…

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

resolving dmarc…

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

tracing redirects…

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

inspecting web surface…

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.

ally.com

15-check dossier · scoreboard above, section details below

Get a pack →

Mostly compliant · 3 items need attention

Aggregate grade across 15 checks. Auditors typically flag any High-severity finding.

Pass: 12
Warn: 3
Fail: 0

What an auditor would flag first

medium
SPF
~all softfail — receivers may still accept
SOC 2 CC6.7ISO 27001 A.13.2.1
low
DKIM
no DKIM selectors found — likely not configured
SOC 2 CC6.7
low
DNSSEC
DNSSEC not configured — no DS or DNSKEY records found
SOC 2 CC6.6ISO 27001 A.13.1.1

Need this as an artifact your auditor can verify?

Your ally.com scan flagged 1 medium and 2 low findings. A signed pack covers the apex plus up to 100 CT-discovered subdomains, Ed25519-signed and ISO-timestamped, delivered in 10–30 minutes.

Get a pack →See methodology See a sample$29

Scanning…

15-check summary

DNS recordsA/AAAA records present
MX2 MX record(s) present
SPF~all softfail — receivers may still accept
DMARCp=reject — strict policy
DKIMno DKIM selectors found — likely not configured
TLS certificatecert valid for 200 days
Redirect chainHTTPS served correctly
Security headers2 security header(s) missing
CORSno CORS headers — cross-origin requests blocked by default
Web surfaceHTTPS surface reachable (robots ✓, sitemap ✓, title ✓)
MTA-STSnot applicable: no _mta-sts TXT record
TLS-RPTnot applicable: no TLSRPT record
DNSSECDNSSEC not configured — no DS or DNSKEY records found
WHOISdomain registered until 2027-04-28
Certificate Transparencycheck failed: crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

dns

info

Open standalone →

A/AAAA records present

Why it matters: Without authoritative A or AAAA records on the apex, the domain is unreachable. Missing baseline DNS shows up in vendor reviews as evidence of unmanaged infrastructure (SOC 2 CC6.6).

A: ttl=300 198.74.81.46
AAAA: —
NS: ttl=3449 gns7.ally.com.
ttl=3449 gns6.ally.com.
ttl=3449 gns5.ally.com.
ttl=3449 gns8.ally.com.
SOA: ttl=3600 dfw1oapdn103.ally.corp. ddi.ally.com. 2021081598 10800 3600 1209600 300
CAA: —
TXT: ttl=300 "webexdomainverification.=093bebf3-4842-471c-899d-837a63d96379"
ttl=300 "SFMC-PWsQDUYc2HuMzpM2VBXPQblG7wPZ20LGwSsVOgMR"
ttl=300 "insomnia-validation=657f61e38de24875953c59dee342923a08f8b6cc2a0f5195b5044e7fa7d42bc6"
ttl=300 "13911eb3-ee9c-4f11-ace4-e73250806147"
ttl=300 "SFMC-0gTidSj37KYZh-7zADpBEh1KEL7QdtV_Jcw2DCC0"
ttl=300 "v=spf1 include:%{ir}.%{v}.%{d}.spf.has.pphosted.com ~all"
ttl=300 "google-site-verification=YtxOAUvQXWdx2I8UVdfmmfEwb1ClO5ApFrntUgSnm78"
ttl=300 "google-gws-recovery-domain-verification=38862587"
ttl=300 "liveramp-site-verification=aHzueBCX-OyzAFZ2voagJ8ZzR5s05-gjzlhsK1qVyCU"
ttl=300 "r3xrpqnkdsh68ygxp0k2w3ntlp4bvxm6"
ttl=300 "Dynatrace-site-verification=cb538360-0815-4d85-a3f0-0550ca0f0d3a__fpfbmmv12snugf4e0tqi7k6olj"
ttl=300 "SFMC-GL042NqugDaOEjARuaFW7WoVny5_SGcU1_zhYEmI"
ttl=300 "paloaltonetworks-site-verification=18c39075bcf74ed651c694a243bfea7dd3505441c37259617de43d38d989f13d"
ttl=300 "jamf-site-verification=Kb3AzdioSTPBf2efxQQ7OA"
ttl=300 "atlassian-domain-verification=sTtr/XgRKK01aHbx09iQaOOsO4GIlQ0yYOJNdvFWGq69h6n21RoYx4nkLMW9hjiD"
ttl=300 "dell-technologies-domain-verification=ally.com_66d1b11a-4234-4bf0-960d-9e42de2428fa_1693427615"
ttl=300 "apple-domain-verification=GWJ-iUUTA43esg4EcJedLLnyIwu0GnxXFPRMr6s_I9s"
ttl=300 "DirectFedAuthUrl=osttra.com"
ttl=300 "intersight=f0b8a9d7cc3b9e700ae64f67b2c560aeef121f20d61191a3d992f0af24db9500"
ttl=300 "adobe-idp-site-verification=ba1eb9d7-754f-40c5-bdd5-11b67ea30cde"
ttl=300 "2cJ18otk1bCh3+h5NS8bx5a/VR6Zf0g4GQrj2FEUGorhKsv8kTirC9BFP0NflDWaTvqjw2OlWcbIQmkjjlbTQA=="
ttl=300 "MS=ms48616993"
ttl=300 "MS=129E8E8968610DA59495B49D481D901967005E94"
ttl=300 "google-site-verification=wcGTr39DGh3KtqzmYKe2FO2HP-huHaytl5LeNAtCXQ8"

fetched 2026-05-23T09:21:13.469Z

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

2 MX record(s) present

Why it matters: MX records direct inbound mail. Misconfiguration silently breaks email delivery and lets attackers stand up parallel MX hosts for spoofing campaigns (ISO 27001 A.8.21).

pri=10 mxb-00239e02.gslb.pphosted.com.
pri=10 mxa-00239e02.gslb.pphosted.com.

fetched 2026-05-23T09:21:13.445Z

mx

info

Open standalone →

resolving mx…

spf

medium

Open standalone →

~all softfail — receivers may still accept

Why it matters: SPF tells receiving servers which hosts may send mail for the domain. Without it, any sender can forge the envelope-from — the primary mechanism behind business-email-compromise (SOC 2 CC6.7).

Recommendations

Move to -all (hardfail) once your mail flow is confirmed — softfail gives no real protection

v=spf1 include:%{ir}.%{v}.%{d}.spf.has.pphosted.com ~all

v=spf1
include:%{ir}.%{v}.%{d}.spf.has.pphosted.com
~all

fetched 2026-05-23T09:21:13.473Z

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

p=reject — strict policy

Why it matters: DMARC binds SPF and DKIM into an enforceable policy (quarantine or reject) and surfaces spoofing attempts via aggregate reports. `p=none` or absent means spoofing succeeds silently (SOC 2 CC6.7).

v=DMARC1; p=reject; fo=1; ri=3600; rua=mailto:dmarc_rua@emaildefense.proofpoint.com; ruf=mailto:dmarc_ruf@emaildefense.proofpoint.com

v=: DMARC1
p=: reject
fo=: 1
ri=: 3600
rua=: mailto:dmarc_rua@emaildefense.proofpoint.com
ruf=: mailto:dmarc_ruf@emaildefense.proofpoint.com

fetched 2026-05-23T09:21:13.444Z

dmarc

info

Open standalone →

resolving dmarc…

dkim

low

Open standalone →

no DKIM selectors found — likely not configured

Why it matters: DKIM signs outbound mail so receivers can detect tampering. Missing selectors or rotated-away keys break DMARC alignment and let receivers downgrade trust (ISO 27001 A.8.24).

Recommendations

Enable DKIM signing in your mail provider and publish the provided TXT record
Common selectors: google._domainkey, selector1._domainkey (Microsoft), mail._domainkey

no DKIM record on probed selectors (default, google, k1, selector1, selector2, mxvault)

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

cert valid for 200 days

Why it matters: A valid current TLS certificate is the baseline for data in transit. Expiry, weak chain, or hostname mismatch break HTTPS and fail PCI 4.2.1 / SOC 2 CC6.1.

subject cn:: ally.com
issuer:: Sectigo Public Server Authentication CA OV R36 / Sectigo Limited
valid:: Dec 9 00:00:00 2025 GMT → Dec 9 23:59:59 2026 GMT
authorized:: yes
sha256:: 29:29:82:E8:44:A6:1A:93:70:45:2A:FC:82:0A:97:04:36:EA:EA:E3:10:2A:78:DF:D3:56:34:80:7E:94:49:70
sans: ally.com
allybank.com
bank.ally.com
learn.ally.com
m.allybank.com
upgrade.ally.com
www.ally.com
www.allybank.com

fetched 2026-05-23T09:21:13.527Z

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

HTTPS served correctly

Why it matters: Bare HTTP requests must redirect to HTTPS without dropping the user mid-chain. Plain-text fallback or open redirects fail PCI 4.2.1 and feed phishing chains (SOC 2 CC6.6).

final status: 200 · 2 hops

[301] https://ally.com/
[200] https://www.ally.com/

fetched 2026-05-23T09:21:13.687Z

redirects

info

Open standalone →

tracing redirects…

headers

info

Open standalone →

2 security header(s) missing

Why it matters: Security headers — HSTS, CSP, X-Frame-Options, Referrer-Policy — defend against XSS, clickjacking, and downgrade attacks. Absent headers map directly to OWASP ASVS V14 findings (ISO 27001 A.8.23).

Recommendations

Add response header — Referrer-Policy: strict-origin-when-cross-origin
Add permissions-policy response header

final url: https://www.ally.com/

security headers

strict-transport-security: max-age=31536000 ; includeSubDomains
content-security-policy: frame-ancestors 'self' *.ally.com;
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff, nosniff
referrer-policy: —
permissions-policy: —

other headers

cache-control: max-age=300
connection: keep-alive, Transfer-Encoding
content-encoding: gzip
content-type: text/html
date: Sat, 23 May 2026 09:21:13 GMT
etag: W/"8bfd68dcb4650d3c9d054e2d29b4d9c4"
last-modified: Thu, 21 May 2026 16:22:49 GMT
server-timing: cdn-cache; desc=MISS, edge; dur=50, origin; dur=9, ak_p; desc="1779528073574_389073003_2885252898_5919_13002_1_77_-";dur=1
set-cookie: bm_sz=53DAE0CB541146EB156A1CB0A9F7B679~YAAQa8gwFz4V41CeAQAALIIjVB+kT4D7Zv4GR27Mhrru19qKcWM5zu3bCn4eEXhy74XA9gaF/sF2UF5j8c4bPopUfFFqyCqmliLZaWf40mAXxFk1BlQHeHejDla+c5n6x8x7vGQ3sO3xnakEGuSb91aE0mTKC/RxiAWWzk+qhNqK6mJTUbAVdJ6hZ82+4P5SmyGcX1EzpHpd/8/Par3grSo6FGxq5HgKthnMYiqRAsxR5SPk0/CHL5MS8sPnfuFeLU+oLzOP+I5oOGFhWC717WuCof7oZcGewTcV7kt/TjFZj+NJwtelQSX9mZkpI6VfKBk0mqehr5GCdYuVpQANTdMyh4svPA76u4x+xLs=~4604229~3682865; Domain=.ally.com; Path=/; Expires=Sat, 23 May 2026 13:21:13 GMT; Max-Age=14400
transfer-encoding: chunked
vary: Accept-Encoding
x-akamai-transformed: 9 39757 0 pmb=mTOE,2mRUM,2
x-amz-server-side-encryption-aws-kms-key-id: arn:aws:kms:us-east-1:091285051682:key/f5a3872b-3358-4b20-988c-32db82660413
x-amz-server-side-encryption-bucket-key-enabled: true
x-amz-storage-class: INTELLIGENT_TIERING
x-amz-version-id: DsSRwfZlJ3QxRLrCo1sZVMDBq_V27aDL
x-edgeconnect-midmile-rtt: 5
x-edgeconnect-origin-mex-latency: 9
x-xss-protection: 1; mode=block

fetched 2026-05-23T09:21:13.776Z

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

no CORS headers — cross-origin requests blocked by default

Why it matters: Overly permissive CORS (wildcard with credentials, or reflected origin) lets any origin read authenticated responses from this domain. OWASP A05 misconfiguration territory (NIST AC-4).

origin: https://drwho.me
method: GET
preflight status: 301

access-control-* headers

access-control-allow-origin: —
access-control-allow-methods: —
access-control-allow-headers: —
access-control-allow-credentials: —
access-control-max-age: —
access-control-expose-headers: —

no access-control-* headers returned — site does not advertise CORS to this origin

fetched 2026-05-23T09:21:13.568Z

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

HTTPS surface reachable (robots ✓, sitemap ✓, title ✓)

Why it matters: Public files — robots.txt, sitemap.xml, head meta — are what attackers see first during reconnaissance. Misadvertised paths, stale sitemaps, and verbose generators leak more than intended (ISO 27001 A.8.9).

robots.txt

present

User-agent: *
Disallow: /content/dam/static/js/tagging/

User-agent: googlebot
Disallow: */internals/


sitemap: https://www.ally.com/content/dam/xml/sitemaps/sitemap.xml
sitemap: https://www.ally.com/stories/sitemap.xml
sitemap: https://www.ally.com/content/dam/xml/sitemaps/go-sitemap.xml
sitemap: https://www.ally.com/content/dam/xml/sitemaps/tech-sitemap.xml

sitemap.xml

present — 217 url(s)

head

title: Banking, Investing & Auto Finance | Ally
description: Manage your money with Ally: online banking, auto financing, and investments. Financial products designed to help you pursue your goals.

social

og:title: Banking, Investing & Auto Finance | Ally
og:description: Manage your money with Ally: online banking, auto financing, and investments. Financial products designed to help you pursue your goals.
og:url: https://www.ally.com/
og:site_name: Ally
og:image: https://secure.ally.com/acs/content/cms/images/201178/0xsu4cuk2auf/3ztLdlVoPW1WEoVTTup0ag/576b5f64747f833326b5e609b3921301/ally_open_graph.png?w=1200&h=630&fit=fill
og:image:width: 1200
og:image:height: 630
og:type: website
twitter:card: summary_large_image
twitter:title: Banking, Investing & Auto Finance | Ally
twitter:description: Manage your money with Ally: online banking, auto financing, and investments. Financial products designed to help you pursue your goals.
twitter:image: https://secure.ally.com/acs/content/cms/images/201178/0xsu4cuk2auf/3ztLdlVoPW1WEoVTTup0ag/576b5f64747f833326b5e609b3921301/ally_open_graph.png?w=1200&h=630&fit=fill
twitter:image:width: 1200
twitter:image:height: 630

fetched 2026-05-23T09:21:13.771Z

web-surface

info

Open standalone →

inspecting web surface…

dnssec

low

Open standalone →

DNSSEC not configured — no DS or DNSKEY records found

Why it matters: DNSSEC cryptographically signs DNS responses, blocking cache-poisoning attacks. US federal civilian agencies are required to enable it under OMB M-22-09 (NIST SC-20).

Recommendations

Enable DNSSEC in your DNS provider's control panel and add the resulting DS record at your registrar

enabled: no
DS records: —
DNSKEY records: —

fetched 2026-05-23T09:21:13.445Z

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

not applicable: no _mta-sts TXT record

Why it matters: MTA-STS forces inbound SMTP to use TLS and refuse downgraded connections. Without it, an in-path attacker can strip TLS and read mail in plaintext (SOC 2 CC6.7).

no _mta-sts TXT record

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

not applicable: no TLSRPT record

Why it matters: TLS-RPT publishes a reporting address for SMTP-TLS failures. Without it, downgrade attacks on inbound mail go unnoticed (SOC 2 CC7.2).

no TLSRPT record

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

domain registered until 2027-04-28

Why it matters: Registrar and expiry tell auditors the domain is owned, current, and not about to lapse. An expired or about-to-expire domain fails business-continuity evidence (SOC 2 A1.2).

registrar: GoDaddy Corporate Domains, LLC
created: 1995-04-27T04:00:00Z
expires: 2027-04-28T04:00:00Z
statuses: clientTransferProhibited https://icann.org/epp#clientTransferProhibited, serverDeleteProhibited https://icann.org/epp#serverDeleteProhibited, serverTransferProhibited https://icann.org/epp#serverTransferProhibited, serverUpdateProhibited https://icann.org/epp#serverUpdateProhibited

fetched 2026-05-23T09:21:13.474Z

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

check failed: crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

Why it matters: Every certificate issued for this domain is published in Certificate Transparency logs — including subdomains you may have forgotten. Unknown subdomains in CT are pre-disclosed attack surface (ISO 27001 A.8.16).

crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.