aol.com

15-check dossier · scoreboard above, section details below

Get a pack →

Scanning…

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

resolving mx…

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

resolving dmarc…

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

tracing redirects…

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

inspecting web surface…

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.

aol.com

15-check dossier · scoreboard above, section details below

Get a pack →

A-

Audit-ready · 4 minor advisories

Aggregate grade across 15 checks. Auditors typically flag any High-severity finding.

Pass: 11
Warn: 4
Fail: 0

What an auditor would flag first

low
SPF
SPF present but all-qualifier unrecognised
SOC 2 CC6.7ISO 27001 A.13.2.1
low
DKIM
no DKIM selectors found — likely not configured
SOC 2 CC6.7
low
Security headers
2 security header(s) missing
SOC 2 CC6.6ISO 27001 A.14.1.2

Need this as an artifact your auditor can verify?

Your aol.com scan flagged 4 low findings. A signed pack covers the apex plus up to 100 CT-discovered subdomains, Ed25519-signed and ISO-timestamped, delivered in 10–30 minutes.

Get a pack →See methodology See a sample$29

Scanning…

15-check summary

DNS recordsA/AAAA records present
MX1 MX record(s) present
SPFSPF present but all-qualifier unrecognised
DMARCp=reject — strict policy
DKIMno DKIM selectors found — likely not configured
TLS certificatecert valid for 165 days
Redirect chainHTTPS served correctly
Security headers2 security header(s) missing
CORSno CORS headers — cross-origin requests blocked by default
Web surfaceHTTPS surface reachable (robots ✓, sitemap ✓, title ✓)
MTA-STSnot applicable: no _mta-sts TXT record
TLS-RPTnot applicable: no TLSRPT record
DNSSECDNSSEC not configured — no DS or DNSKEY records found
WHOISdomain registered until 2027-11-23
Certificate Transparencycheck failed: crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

dns

info

Open standalone →

A/AAAA records present

Why it matters: Without authoritative A or AAAA records on the apex, the domain is unreachable. Missing baseline DNS shows up in vendor reviews as evidence of unmanaged infrastructure (SOC 2 CC6.6).

A: ttl=1136 13.248.158.7
ttl=1136 76.223.84.192
AAAA: —
NS: ttl=170083 ns2.yahoo.com.
ttl=170083 ns3.yahoo.com.
ttl=170083 ns5.yahoo.com.
ttl=170083 ns1.yahoo.com.
ttl=170083 ns4.yahoo.com.
SOA: ttl=3600 hidden-master.yahoo.com. hostmaster.yahoo-inc.com. 2026052203 28800 900 604800 600
CAA: ttl=3600 \# 19 00 05 69 73 73 75 65 64 69 67 69 63 65 72 74 2e 63 6f 6d
ttl=3600 \# 22 00 05 69 73 73 75 65 61 6d 61 7a 6f 6e 74 72 75 73 74 2e 63 6f 6d
ttl=3600 \# 35 00 05 69 6f 64 65 66 6d 61 69 6c 74 6f 3a 73 65 63 75 72 69 74 79 40 79 61 68 6f 6f 69 6e 63 2e 63 6f 6d
ttl=3600 \# 21 00 05 69 73 73 75 65 67 6c 6f 62 61 6c 73 69 67 6e 2e 63 6f 6d
ttl=3600 \# 20 00 05 69 73 73 75 65 61 6d 61 7a 6f 6e 61 77 73 2e 63 6f 6d
ttl=3600 \# 19 00 05 69 73 73 75 65 61 77 73 74 72 75 73 74 2e 63 6f 6d
ttl=3600 \# 22 00 05 69 73 73 75 65 6c 65 74 73 65 6e 63 72 79 70 74 2e 6f 72 67
ttl=3600 \# 17 00 05 69 73 73 75 65 61 6d 61 7a 6f 6e 2e 63 6f 6d
TXT: ttl=2096 "_globalsign-domain-verification=A8559NR8s5jDgfIOiI89M1Ln_KDohG1F-obiPNLdkK"
ttl=2096 "google-site-verification=vWa8DccevgR6DN9S4K4ydAcrlRn7SCXHx6sQRmqElLc"
ttl=2096 "knowbe4-site-verification=bc3830115833f4f956e30f506f1da8c8"
ttl=2096 "google-site-verification=Urd7MSITHYcx-rtP1PTVfeiC8RZ2QaKF_6bd6mW_51U"
ttl=2096 "'4a751cdeec084ee2bc9e2cb2e94ba8af'"
ttl=2096 "google-site-verification=A3SjuAs-uLOfPY5VcSW-yJJIi6gjOC3HRXsZ3FhVaLs"
ttl=2096 "google-site-verification=rrvUvV8gUjL0YugQKfcRVnaeQSBJT50UYL_CRwTdKAc"
ttl=2096 "facebook-domain-verification=ervjrx9gun9l4uhc6o4d05p65r2824"
ttl=2096 "v=spf1 redirect=_spf.mail.yahoo.com"
ttl=2096 "google-site-verification=BNb5wrsmDzzWz2SS35sCfIYkrZOQWWY-3ZdY-pgip4k"
ttl=2096 "google-site-verification=ducLuHpystFIiiH_U1devs1CL3q7nhkjCV3BQQtxwWM"
ttl=2096 "google-site-verification=cr9372hSYxSXo52q8ME19Decs88FL4U8DGETLFhcD9A"
ttl=2096 "google-site-verification=NqM_NKWhteDHiJCOfhlQqKT4nxexIeFRie5MmWA1RBk"
ttl=2096 "_globalsign-domain-verification=5qAMTVb8BnarU3IjRaQnyRZI3P1sfIcYF2K1VaJdS4"
ttl=2096 "_globalsign-domain-verification=W22K-ATZWdBDmzMIsFCF5smJ_T5-7Zl-JDnV8qNe-i"

fetched 2026-05-23T09:27:06.431Z

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

1 MX record(s) present

Why it matters: MX records direct inbound mail. Misconfiguration silently breaks email delivery and lets attackers stand up parallel MX hosts for spoofing campaigns (ISO 27001 A.8.21).

pri=10 mx-aol.mail.gm0.yahoodns.net.

fetched 2026-05-23T09:27:06.430Z

mx

info

Open standalone →

resolving mx…

spf

low

Open standalone →

SPF present but all-qualifier unrecognised

Why it matters: SPF tells receiving servers which hosts may send mail for the domain. Without it, any sender can forge the envelope-from — the primary mechanism behind business-email-compromise (SOC 2 CC6.7).

v=spf1 redirect=_spf.mail.yahoo.com

v=spf1
redirect=_spf.mail.yahoo.com

fetched 2026-05-23T09:27:06.438Z

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

p=reject — strict policy

Why it matters: DMARC binds SPF and DKIM into an enforceable policy (quarantine or reject) and surfaces spoofing attempts via aggregate reports. `p=none` or absent means spoofing succeeds silently (SOC 2 CC6.7).

v=DMARC1; p=reject; pct=100; rua=mailto:d@rua.agari.com; ruf=mailto:d@ruf.agari.com;

v=: DMARC1
p=: reject
pct=: 100
rua=: mailto:d@rua.agari.com
ruf=: mailto:d@ruf.agari.com

fetched 2026-05-23T09:27:06.431Z

dmarc

info

Open standalone →

resolving dmarc…

dkim

low

Open standalone →

no DKIM selectors found — likely not configured

Why it matters: DKIM signs outbound mail so receivers can detect tampering. Missing selectors or rotated-away keys break DMARC alignment and let receivers downgrade trust (ISO 27001 A.8.24).

Recommendations

Enable DKIM signing in your mail provider and publish the provided TXT record
Common selectors: google._domainkey, selector1._domainkey (Microsoft), mail._domainkey

no DKIM record on probed selectors (default, google, k1, selector1, selector2, mxvault)

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

cert valid for 165 days

Why it matters: A valid current TLS certificate is the baseline for data in transit. Expiry, weak chain, or hostname mismatch break HTTPS and fail PCI 4.2.1 / SOC 2 CC6.1.

subject cn:: src8.yahoo.com
issuer:: DigiCert Global G2 TLS RSA SHA256 2020 CA1 / DigiCert Inc
valid:: May 11 00:00:00 2026 GMT → Nov 4 23:59:59 2026 GMT
authorized:: yes
sha256:: 3E:C3:CA:DA:7B:02:9B:4B:9B:A0:AD:B0:96:11:AE:4C:D8:C6:D4:C8:01:C7:61:B2:F7:3C:54:E0:5E:A3:79:97
sans: src8.yahoo.com
*.aol.com
*.aol.de
*.ops.aol.com
*.web.aol.com
*.aol.co.uk
*.aol.jp
*.aol.fr
*.aol.ca
*.onemobile.aol.com
*.isp.netscape.com
*.main.welcomescreen.aol.com
*.sb.welcomescreen.aol.com
*.toshiba.aol.ca
build.aol.com
feeds.contenthub.aol.com
gochat.desktop.aol.com
webmail.aol.com.br
mail.latino.aol.com
corp.aol.com
helpisp.netscape.com
sfrclient.welcome.aol.fr
www.netscape.com
webmail.cs.com
webmail.wmconnect.com
webmail.compuserve.com
nic.aol.com
compuserve.com
getnetscape.com
aol.ca
aol.co.uk
aol.com
aol.de
aol.fr
aol.jp
netscape.com
wmconnect.com

fetched 2026-05-23T09:27:06.461Z

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

HTTPS served correctly

Why it matters: Bare HTTP requests must redirect to HTTPS without dropping the user mid-chain. Plain-text fallback or open redirects fail PCI 4.2.1 and feed phishing chains (SOC 2 CC6.6).

final status: 200 · 2 hops

[301] https://aol.com/
[200] https://www.aol.com/

fetched 2026-05-23T09:27:06.836Z

redirects

info

Open standalone →

tracing redirects…

headers

low

Open standalone →

2 security header(s) missing

Why it matters: Security headers — HSTS, CSP, X-Frame-Options, Referrer-Policy — defend against XSS, clickjacking, and downgrade attacks. Absent headers map directly to OWASP ASVS V14 findings (ISO 27001 A.8.23).

Recommendations

Add response header — Content-Security-Policy: default-src 'self' (tune per app)
Add permissions-policy response header

final url: https://www.aol.com/

security headers

strict-transport-security: max-age=31536000
content-security-policy: —
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
referrer-policy: no-referrer-when-downgrade
permissions-policy: —

other headers

age: 0
cache-control: private, no-cache, no-store, max-age=0, must-revalidate
connection: keep-alive
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Sat, 23 May 2026 09:27:06 GMT
link: <https://s.yimg.com/ec/aol-web/prod/_next/static/css/42118adc31c6db3d.css>; rel=preload; as="style"
server: ATS
set-cookie: plid=67f15efc-7d75-4ee6-99cc-3a77886d5e54; Path=/; Expires=Sun, 23 May 2027 09:27:06 GMT; Max-Age=31536000; Domain=.aol.com; Secure; HttpOnly; SameSite=lax
transfer-encoding: chunked
vary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch, Accept-Encoding
x-dns-prefetch-control: on
x-xss-protection: 1; mode=block

fetched 2026-05-23T09:27:06.825Z

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

no CORS headers — cross-origin requests blocked by default

Why it matters: Overly permissive CORS (wildcard with credentials, or reflected origin) lets any origin read authenticated responses from this domain. OWASP A05 misconfiguration territory (NIST AC-4).

origin: https://drwho.me
method: GET
preflight status: 301

access-control-* headers

access-control-allow-origin: —
access-control-allow-methods: —
access-control-allow-headers: —
access-control-allow-credentials: —
access-control-max-age: —
access-control-expose-headers: —

no access-control-* headers returned — site does not advertise CORS to this origin

fetched 2026-05-23T09:27:06.508Z

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

HTTPS surface reachable (robots ✓, sitemap ✓, title ✓)

Why it matters: Public files — robots.txt, sitemap.xml, head meta — are what attackers see first during reconnaissance. Misadvertised paths, stale sitemaps, and verbose generators leak more than intended (ISO 27001 A.8.9).

robots.txt

present

User-agent: *
Allow: /author/
Disallow: /forward
Disallow: /traffic
Disallow: /mm_track
Disallow: /dl_track
Disallow: /_uac/adpage.html
Disallow: /api/
Disallow: /amp-proxy/
Disallow: /auth
Disallow: /login
Disallow: /logout
Disallow: /config
Disallow: /_/authenticate/
Disallow: /video/play/
Disallow: /m/
Disallow: /article/m/
Disallow: /metrics/pageView
Disallow: /game/playUpdate
User-agent: ADmantX
Disallow: /
User-agent: AlphaBot
Disallow: /
User-agent: anthropic-ai
Disallow: /
User-agent: AwarioRssBot
Disallow: /
User-agent: AwarioSmartBot
Disallow: /
User-agent: BLEXBot
Disallow: /
User-agent: Buzzbot
Disallow: /
User-agent: Bytespider
Disallow: /
User-agent: CCBot
Disallow: /
User-agent: ChatGPT-User
Disallow: /
User-agent: claritybot
Disallow: /
User-agent: Claude-Web
Disallow: /
User-agent: ClaudeBot
Disallow: /
User-agent: cohere-ai
Disallow: /
User-agent: Diffbot
Disallow: /
User-agent: FacebookBot
Disallow: /
User-agent: FriendlyCrawler
Disallow: /
User-agent: Google-Extended
Disallow: /
User-agent: GPTBot
Disallow: /
User-agent: huggingface
Disallow: /
User-agent: ImagesiftBot
Disallow: /
User-agent: img2dataset
Disallow: /
User-agent: magpie-crawler
Disallow: /
User-agent: Meltwater
Disallow: /
User-agent: Neevabot
Disallow: /
User-agent: news-please
Disallow: /
User-agent: NewsNow
Disallow: /
User-agent: Nutch
Disallow: /
User-agent: omgili
Disallow: /
User-agent: omgilibot
Disallow: /
User-agent: panscient.com
Disallow: /
User-agent: Perplexity-ai
Disallow: /
User-agent: PerplexityBot
Disallow: /
User-agent: PetalBot
Disallow: /
User-agent: PiplBot
Disallow: /
User-agent: scoop.it
Disallow: /
User-agent: Scrapy
Disallow: /
User-agent: Seekr
Disallow: /
User-agent: SentiBot
Disallow: /
User-agent: SeznamBot
Disallow: /
User-agent: TurnitinBot
Disallow: /
User-agent: YouBot
Disallow: /
User-agent: ZumBot
Disallow: /
Sitemap: https://www.aol.com/sitemap_index.xml
Sitemap: https://www.aol.com/sitemaps/aolnews-sitemap_index_US_en-US.xml.gz
Sitemap: https://www.aol.com/sitemaps/aolnews-sitemap_googlenewsindex_US_en-US.xml.gz
Sitemap: https://www.aol.com/sitemaps/aolentertainment-sitemap_index_US_en-US.xml.gz
Sitemap: https://www.aol.com/sitemaps/aolentertainment-sitemap_googlenewsindex_US_en-US.xml.gz
Sitemap: https://www.aol.com/sitemaps/aolfinance-sitemap_index_US_en-US.xml.gz
Sitemap: https://www.aol.com/sitemaps/aolfinance-sitemap_googlenewsindex_US_en-US.xml.gz
Sitemap: https://www.aol.com/sitemaps/aollifestyle-sitemap_index_US_en-US.xml.gz
Sitemap: https://www.aol.com/sitemaps/aollifestyle-sitemap_googlenewsindex_US_en-US.xml.gz
Sitemap: https://www.aol.com/sitemaps/aolweather-sitemap_index_US_en-US.xml.gz
Sitemap: https://www.aol.com/sitemaps/aolweather-sitemap_googlenewsindex_US_en-US.xml.gz
Sitemap: https://www.aol.com/products/sitemap.xml
Sitemap: https://www.aol.com/seo-sitemaps/weather-sitemapindex.xml
Sitemap: https://www.aol.com/seo-sitemaps/aol-channel-list.xml
Sitemap: https://www.aol.com/sitemaps/us/sitemap-index.xml.gz
Sitemap: https://www.aol.com/sitemaps/us/news-sitemap-index.xml.gz

sitemap.xml

present — 10 url(s)

head

title: News, Politics, Sports, Mail & Latest Headlines - AOL.com
description: Discover the latest breaking news in the U.S. and around the world — politics, weather, entertainment, lifestyle, finance, sports and much more.

social

og:title: News, Politics, Sports, Mail & Latest Headlines - AOL.com
og:description: Discover the latest breaking news in the U.S. and around the world — politics, weather, entertainment, lifestyle, finance, sports and much more.
og:site_name: AOL.com
og:image: https://s.yimg.com/cv/apiv2/aolfp/images/og-image.png
og:image:width: 1200
og:image:height: 630
og:type: website
twitter:card: summary
twitter:site: @AOL
twitter:site:id: 66237835
twitter:title: News, Politics, Sports, Mail & Latest Headlines - AOL.com
twitter:description: Discover the latest breaking news in the U.S. and around the world — politics, weather, entertainment, lifestyle, finance, sports and much more.
twitter:image: https://s.yimg.com/cv/apiv2/aolfp/images/og-image.png
twitter:image:width: 1200
twitter:image:height: 630

fetched 2026-05-23T09:27:06.789Z

web-surface

info

Open standalone →

inspecting web surface…

dnssec

low

Open standalone →

DNSSEC not configured — no DS or DNSKEY records found

Why it matters: DNSSEC cryptographically signs DNS responses, blocking cache-poisoning attacks. US federal civilian agencies are required to enable it under OMB M-22-09 (NIST SC-20).

Recommendations

Enable DNSSEC in your DNS provider's control panel and add the resulting DS record at your registrar

enabled: no
DS records: —
DNSKEY records: —

fetched 2026-05-23T09:27:06.441Z

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

not applicable: no _mta-sts TXT record

Why it matters: MTA-STS forces inbound SMTP to use TLS and refuse downgraded connections. Without it, an in-path attacker can strip TLS and read mail in plaintext (SOC 2 CC6.7).

no _mta-sts TXT record

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

not applicable: no TLSRPT record

Why it matters: TLS-RPT publishes a reporting address for SMTP-TLS failures. Without it, downgrade attacks on inbound mail go unnoticed (SOC 2 CC7.2).

no TLSRPT record

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

domain registered until 2027-11-23

Why it matters: Registrar and expiry tell auditors the domain is owned, current, and not about to lapse. An expired or about-to-expire domain fails business-continuity evidence (SOC 2 A1.2).

registrar: GoDaddy.com, LLC
created: 1995-06-22T04:00:00Z
expires: 2027-11-23T12:02:22Z
statuses: clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited, clientRenewProhibited https://icann.org/epp#clientRenewProhibited, clientTransferProhibited https://icann.org/epp#clientTransferProhibited, clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited

fetched 2026-05-23T09:27:06.547Z

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

check failed: crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

Why it matters: Every certificate issued for this domain is published in Certificate Transparency logs — including subdomains you may have forgotten. Unknown subdomains in CT are pre-disclosed attack surface (ISO 27001 A.8.16).

crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.