apnews.com

15-check dossier · scoreboard above, section details below

Get a pack →

Scanning…

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

resolving mx…

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

resolving dmarc…

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

tracing redirects…

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

inspecting web surface…

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.

apnews.com

15-check dossier · scoreboard above, section details below

Get a pack →

Mostly compliant · 4 items need attention

Aggregate grade across 15 checks. Auditors typically flag any High-severity finding.

Pass: 11
Warn: 4
Fail: 0

What an auditor would flag first

medium
SPF
~all softfail — receivers may still accept
SOC 2 CC6.7ISO 27001 A.13.2.1
low
DKIM
2/6 DKIM selectors valid
SOC 2 CC6.7
low
TLS certificate
cert expires in 59 days
SOC 2 CC6.6ISO 27001 A.13.1.1

Need this as an artifact your auditor can verify?

Your apnews.com scan flagged 1 medium and 3 low findings. A signed pack covers the apex plus up to 100 CT-discovered subdomains, Ed25519-signed and ISO-timestamped, delivered in 10–30 minutes.

Get a pack →See methodology See a sample$29

Scanning…

15-check summary

DNS recordsA/AAAA records present
MX1 MX record(s) present
SPF~all softfail — receivers may still accept
DMARCp=reject — strict policy
DKIM2/6 DKIM selectors valid
TLS certificatecert expires in 59 days
Redirect chainHTTPS served correctly
Security headers4 security header(s) missing
CORSno CORS headers — cross-origin requests blocked by default
Web surfaceHTTPS surface reachable (robots ✓, sitemap ✓, title ✓)
MTA-STSnot applicable: no _mta-sts TXT record
TLS-RPTnot applicable: no TLSRPT record
DNSSECDNSSEC enabled — DS records present and chain validated (AD flag)
WHOISdomain registered until 2027-07-11
Certificate Transparencycheck failed: crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

dns

info

Open standalone →

A/AAAA records present

Why it matters: Without authoritative A or AAAA records on the apex, the domain is unreachable. Missing baseline DNS shows up in vendor reviews as evidence of unmanaged infrastructure (SOC 2 CC6.6).

A: ttl=66 104.16.23.8
ttl=66 104.16.22.8
AAAA: ttl=158 2606:4700::6810:1608
ttl=158 2606:4700::6810:1708
NS: ttl=86400 beau.ns.cloudflare.com.
ttl=86400 edna.ns.cloudflare.com.
SOA: ttl=1800 beau.ns.cloudflare.com. dns.cloudflare.com. 2404955869 10000 2400 604800 1800
CAA: ttl=300 \# 20 00 05 69 73 73 75 65 61 6d 61 7a 6f 6e 61 77 73 2e 63 6f 6d
ttl=300 \# 19 00 05 69 73 73 75 65 63 6f 6d 6f 64 6f 63 61 2e 63 6f 6d
ttl=300 \# 45 00 05 69 73 73 75 65 64 69 67 69 63 65 72 74 2e 63 6f 6d 3b 20 63 61 6e 73 69 67 6e 68 74 74 70 65 78 63 68 61 6e 67 65 73 3d 79 65 73
ttl=300 \# 18 00 05 69 73 73 75 65 65 6e 74 72 75 73 74 2e 6e 65 74
ttl=300 \# 22 00 05 69 73 73 75 65 6c 65 74 73 65 6e 63 72 79 70 74 2e 6f 72 67
ttl=300 \# 41 00 05 69 73 73 75 65 70 6b 69 2e 67 6f 6f 67 3b 20 63 61 6e 73 69 67 6e 68 74 74 70 65 78 63 68 61 6e 67 65 73 3d 79 65 73
ttl=300 \# 14 00 05 69 73 73 75 65 73 73 6c 2e 63 6f 6d
ttl=300 \# 23 00 09 69 73 73 75 65 77 69 6c 64 61 77 73 74 72 75 73 74 2e 63 6f 6d
ttl=300 \# 23 00 09 69 73 73 75 65 77 69 6c 64 63 6f 6d 6f 64 6f 63 61 2e 63 6f 6d
ttl=300 \# 49 00 09 69 73 73 75 65 77 69 6c 64 64 69 67 69 63 65 72 74 2e 63 6f 6d 3b 20 63 61 6e 73 69 67 6e 68 74 74 70 65 78 63 68 61 6e 67 65 73 3d 79 65 73
ttl=300 \# 26 00 09 69 73 73 75 65 77 69 6c 64 6c 65 74 73 65 6e 63 72 79 70 74 2e 6f 72 67
ttl=300 \# 45 00 09 69 73 73 75 65 77 69 6c 64 70 6b 69 2e 67 6f 6f 67 3b 20 63 61 6e 73 69 67 6e 68 74 74 70 65 78 63 68 61 6e 67 65 73 3d 79 65 73
ttl=300 \# 18 00 09 69 73 73 75 65 77 69 6c 64 73 73 6c 2e 63 6f 6d
TXT: ttl=300 "0ed1fe018a659bc9aaf1cc4909b24caca224f1323c"
ttl=300 "amazonses:uPNJVwPHtMBNjcVsGvGl/ALzB/80iGwlwpY8b51GpFQ="
ttl=300 "facebook-domain-verification=k61hsxl5exwd8tqs2yyf70qxzlnfqr"
ttl=300 "v=spf1 include:%{i}._ip.%{h}._ehlo.%{d}._spf.vali.email ~all"
ttl=300 "yahoo-verification-key=XudvBX5cE8wKPWJiOgY66RZ5LyrPJZ2prSAPnxFCTrI="
ttl=300 "google-site-verification=32rjWmzlnqZkxw2BVfnRSJu75tJ5OBiRXQ5nPwCG-Fk"
ttl=300 "google-site-verification=AQvbsGiI8LZV6WWz21PL5Rk1bIbFjnorCLhVUN4lygg"
ttl=300 "google-site-verification=HX6YuFG0MGVxD_ax6yxlrxMsv326LXOsLWq1U-3rmGQ"
ttl=300 "google-site-verification=RcYLOmFT9fRWOStZxM9fpGEwEOCKb7evUu8IXC9MhtY"
ttl=300 "google-site-verification=Zx5fwblUAEBE0AkHI9ZzMStIY-byF7rTDll-WjEo6pA"
ttl=300 "google-site-verification=bJdvGOsVDI28yqe1Osdmpg5pXQjkaH27xmvcDQhMTUY"
ttl=300 "google-site-verification=q8ur0tkk9JJUj02dj1o7WnogFK0p2eUELo1NPBBEoWg"
ttl=300 "stripe-verification=78d284c6563b238744cff7d6a25fd2ca108c18e3a38b3624cd79ab31dc84ce41"
ttl=300 "VvdBLsIYv6d+dTZl11XR4x8krj2mgiEHIU8WF4y81brQiVlpzXb3PxOfEIqwkUx2Ua3phDiq934CVFXaPEnLxA=="
"tollbit-domain-verification=3516adf873bda5620e3b93cce732fe3a3fd566f00f1f664337e53f25b2defd5f"

fetched 2026-05-23T09:28:04.389Z

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

1 MX record(s) present

Why it matters: MX records direct inbound mail. Misconfiguration silently breaks email delivery and lets attackers stand up parallel MX hosts for spoofing campaigns (ISO 27001 A.8.21).

pri=0 apnews-com.mail.protection.outlook.com.

fetched 2026-05-23T09:28:04.389Z

mx

info

Open standalone →

resolving mx…

spf

medium

Open standalone →

~all softfail — receivers may still accept

Why it matters: SPF tells receiving servers which hosts may send mail for the domain. Without it, any sender can forge the envelope-from — the primary mechanism behind business-email-compromise (SOC 2 CC6.7).

Recommendations

Move to -all (hardfail) once your mail flow is confirmed — softfail gives no real protection

v=spf1 include:%{i}._ip.%{h}._ehlo.%{d}._spf.vali.email ~all

v=spf1
include:%{i}._ip.%{h}._ehlo.%{d}._spf.vali.email
~all

fetched 2026-05-23T09:28:04.390Z

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

p=reject — strict policy

Why it matters: DMARC binds SPF and DKIM into an enforceable policy (quarantine or reject) and surfaces spoofing attempts via aggregate reports. `p=none` or absent means spoofing succeeds silently (SOC 2 CC6.7).

v=DMARC1; p=reject; rua=mailto:dmarc_agg@vali.email

v=: DMARC1
p=: reject
rua=: mailto:dmarc_agg@vali.email

fetched 2026-05-23T09:28:04.404Z

dmarc

info

Open standalone →

resolving dmarc…

dkim

low

Open standalone →

2/6 DKIM selectors valid

Why it matters: DKIM signs outbound mail so receivers can detect tampering. Missing selectors or rotated-away keys break DMARC alignment and let receivers downgrade trust (ISO 27001 A.8.24).

Recommendations

Check the missing selectors in your DNS provider and re-add any removed records

default:: —
google:: —
k1:: —
selector1:: v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDBSS2qK+vzIzdqHWQ9/wsQiPJkWmXPojHUeqQYPOu3S7eC4saLVu+y9DyDgWH328UVo/8PXfsIbUvFz4BariyRpc5/vrnGdyqGbzprpc3Ug2yUZFv8YPt8qLS6nH0F7frcKMxANDfdQf0j8GqsXUQ7svm7pVm4wiSHMCeNjjEzVQIDAQAB; n=1024,1496916149,1
selector2:: v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCpigtTNy9B6+Mn7O524/8GTHGCAV54SrHafKdjZpGATpmEA5uO0Zh165/jsuYGJVwASzHKWVGIRs3cOGf19fBTLAfB8J+zCnGvmtO1TdGWnbRbXbbCduChm60GbVL3/QWaPl54zevMviPJvFOsEfKzLGpQrTUDmTUHr/AV+UklpwIDAQAB; n=1024,1496916149,1
mxvault:: —

fetched 2026-05-23T09:28:04.392Z

dkim

info

Open standalone →

probing dkim selectors…

tls

low

Open standalone →

cert expires in 59 days

Why it matters: A valid current TLS certificate is the baseline for data in transit. Expiry, weak chain, or hostname mismatch break HTTPS and fail PCI 4.2.1 / SOC 2 CC6.1.

Recommendations

Schedule certificate renewal — consider enabling auto-renewal

subject cn:: apnews.com
issuer:: E8 / Let's Encrypt
valid:: Apr 22 17:12:03 2026 GMT → Jul 21 17:12:02 2026 GMT
authorized:: yes
sha256:: A5:B1:91:C9:F1:5F:3A:8C:FE:D4:73:64:47:DB:80:F8:98:37:81:51:2C:D0:F5:43:58:10:EB:2B:D7:34:41:5E
sans: *.apnews.com
apnews.com

fetched 2026-05-23T09:28:04.432Z

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

HTTPS served correctly

Why it matters: Bare HTTP requests must redirect to HTTPS without dropping the user mid-chain. Plain-text fallback or open redirects fail PCI 4.2.1 and feed phishing chains (SOC 2 CC6.6).

final status: 200 · 1 hop

[200] https://apnews.com/

fetched 2026-05-23T09:28:04.481Z

redirects

info

Open standalone →

tracing redirects…

headers

low

Open standalone →

4 security header(s) missing

Why it matters: Security headers — HSTS, CSP, X-Frame-Options, Referrer-Policy — defend against XSS, clickjacking, and downgrade attacks. Absent headers map directly to OWASP ASVS V14 findings (ISO 27001 A.8.23).

Recommendations

Add response header — X-Frame-Options: DENY (or SAMEORIGIN if framing is intended)
Add response header — X-Content-Type-Options: nosniff
Add response header — Referrer-Policy: strict-origin-when-cross-origin
Add permissions-policy response header

final url: https://apnews.com/

security headers

strict-transport-security: max-age=31536000; includeSubDomains
content-security-policy: frame-ancestors 'self' https://cms.apnews.com/
x-frame-options: —
x-content-type-options: —
referrer-policy: —
permissions-policy: —

other headers

age: 75
alt-svc: h3=":443"; ma=86400
cache-control: public, max-age=120, stale-if-error=86400
cf-cache-status: HIT
cf-ray: a0030743bb401ffd-IAD
connection: keep-alive
content-encoding: br
content-type: text/html;charset=UTF-8
date: Sat, 23 May 2026 09:28:04 GMT
last-modified: Sat, 23 May 2026 09:26:48 GMT
server: cloudflare
set-cookie: _cfuvid=xWm0mNA3zGpX_RVdS_zi1MaY2xo0n2S1_L2jNYzYraI-1779528484.4368882-1.0.1.1-2E8IOmgM1VIzUZy2dniO1Adil9Gu8Xg.JXxv5Ut5org; HttpOnly; SameSite=None; Secure; Path=/; Domain=apnews.com
transfer-encoding: chunked
vary: Accept-Encoding
via: 1.1 google
x-envoy-decorator-operation: brightspot-frontend-verify.prod-news.svc.cluster.local:80/*
x-envoy-upstream-service-time: 2830
x-powered-by: Brightspot

fetched 2026-05-23T09:28:04.506Z

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

no CORS headers — cross-origin requests blocked by default

Why it matters: Overly permissive CORS (wildcard with credentials, or reflected origin) lets any origin read authenticated responses from this domain. OWASP A05 misconfiguration territory (NIST AC-4).

origin: https://drwho.me
method: GET
preflight status: 200

access-control-* headers

access-control-allow-origin: —
access-control-allow-methods: —
access-control-allow-headers: —
access-control-allow-credentials: —
access-control-max-age: —
access-control-expose-headers: —

no access-control-* headers returned — site does not advertise CORS to this origin

fetched 2026-05-23T09:28:06.923Z

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

HTTPS surface reachable (robots ✓, sitemap ✓, title ✓)

Why it matters: Public files — robots.txt, sitemap.xml, head meta — are what attackers see first during reconnaissance. Misadvertised paths, stale sitemaps, and verbose generators leak more than intended (ISO 27001 A.8.9).

robots.txt

present

User-Agent: *
Disallow:
Disallow: *_ptid=*
Disallow: *?prx_t=*
Disallow: /zephr*
Disallow: /blaize*
Disallow: /search?q=*
Disallow: /*.rss
Disallow: /buyline-shopping/*
Disallow: /buyline-personal-finance/*
Disallow: *?jw_start
Disallow: *&jw_start
Disallow: /gallery/
Disallow: /config/newrelic/prod
Disallow: /parsely-api-endpoint
Disallow: /apdata/
Disallow: /article/border-immigration-election-2182fec11fa008ec96c4202e5656d19e
Disallow: /api/v2/feed/

Sitemap: https://apnews.com/ap-sitemap.xml
Sitemap: https://apnews.com/news-sitemap-content.xml
Sitemap: https://apnews.com/hubs-sitemap-content.xml
Sitemap: https://apnews.com/video-sitemap.xml
Sitemap: https://apnews.com/projects/elections-2026/sitemap-index.xml

# Disallow Rules

User-agent: CCBot
Disallow: /

User-agent: GPTBot
Disallow: /

User-agent: anthropic-ai
Disallow: /

User-agent: ClaudeBot
Disallow: /

User-agent: Claude-Web
Disallow: /

User-agent: cohere-ai
Disallow: /

User-agent: PerplexityBot
Disallow: /

User-agent: Amazonbot
Disallow: /

User-agent: Applebot-Extended
Disallow: /

User-agent: Bytedance
Disallow: /

User-agent: Timpibot
Disallow: /

User-agent: Claude-User
Disallow: /

User-agent: Claude-SearchBot
Disallow: /

sitemap.xml

present — 226 url(s)

head

title: Associated Press News: Breaking News, Latest Headlines and Videos | AP News
description: Read the latest headlines, breaking news, and videos at APNews.com, the definitive source for independent journalism from every corner of the globe.

social

og:title: Associated Press News: Breaking News | Latest News Today
og:url: https://apnews.com/
og:image: https://dims.apnews.com/dims4/default/295c329/2147483647/strip/true/crop/675x450+12+0/resize/980x653!/quality/90/?url=https%3A%2F%2Fassets.apnews.com%2F90%2F29%2F4e3c1cc7446089a9101a7bdff4c8%2Fdefaultshareimage-copy.png
og:image:url: https://dims.apnews.com/dims4/default/295c329/2147483647/strip/true/crop/675x450+12+0/resize/980x653!/quality/90/?url=https%3A%2F%2Fassets.apnews.com%2F90%2F29%2F4e3c1cc7446089a9101a7bdff4c8%2Fdefaultshareimage-copy.png
og:image:width: 980
og:image:height: 653
og:image:type: image/png
og:description: Read the latest headlines, breaking news, and videos at APNews.com, the definitive source for independent journalism from every corner of the globe.
og:site_name: AP News
og:type: website
twitter:card: summary_large_image
twitter:description: Stay informed and read the latest news today from The Associated Press, the definitive source for independent journalism from every corner of the globe.
twitter:site: @AP
twitter:title: Associated Press News: Breaking News | Latest News Today

fetched 2026-05-23T09:28:04.494Z

web-surface

info

Open standalone →

inspecting web surface…

dnssec

info

Open standalone →

DNSSEC enabled — DS records present and chain validated (AD flag)

Why it matters: DNSSEC cryptographically signs DNS responses, blocking cache-poisoning attacks. US federal civilian agencies are required to enable it under OMB M-22-09 (NIST SC-20).

enabled: yes
DS records: 2371 ECDSAP256SHA256 2 6bf4709f375db324a746c7a74eac8b145384c97bcbdbdc11ad7f8db32fd7b402, DS ECDSAP256SHA256 2 86400 1780108490 1779499490 27677 com. arcXZRrzHTAEMd3kqyt/mzV5uMRLaDCo7TPU7KJLO7varTwZ2TE196FZGI2xkG4wecfoFV+2vd34JWSeOlle1g==
DNSKEY records: 3 key(s)

fetched 2026-05-23T09:28:04.398Z

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

not applicable: no _mta-sts TXT record

Why it matters: MTA-STS forces inbound SMTP to use TLS and refuse downgraded connections. Without it, an in-path attacker can strip TLS and read mail in plaintext (SOC 2 CC6.7).

no _mta-sts TXT record

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

not applicable: no TLSRPT record

Why it matters: TLS-RPT publishes a reporting address for SMTP-TLS failures. Without it, downgrade attacks on inbound mail go unnoticed (SOC 2 CC7.2).

no TLSRPT record

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

domain registered until 2027-07-11

Why it matters: Registrar and expiry tell auditors the domain is owned, current, and not about to lapse. An expired or about-to-expire domain fails business-continuity evidence (SOC 2 A1.2).

registrar: Network Solutions, LLC
created: 1991-07-12T04:00:00Z
expires: 2027-07-11T04:00:00Z
statuses: clientTransferProhibited https://icann.org/epp#clientTransferProhibited

fetched 2026-05-23T09:28:04.781Z

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

check failed: crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

Why it matters: Every certificate issued for this domain is published in Certificate Transparency logs — including subdomains you may have forgotten. Unknown subdomains in CT are pre-disclosed attack surface (ISO 27001 A.8.16).

crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.