asahi.com

15-check dossier · scoreboard above, section details below

Get a pack →

Scanning…

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

resolving mx…

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

resolving dmarc…

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

tracing redirects…

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

inspecting web surface…

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.

asahi.com

15-check dossier · scoreboard above, section details below

Get a pack →

C+

6 items need attention

Aggregate grade across 15 checks. Auditors typically flag any High-severity finding.

Pass: 9
Warn: 6
Fail: 0

What an auditor would flag first

medium
SPF
~all softfail — receivers may still accept
SOC 2 CC6.7ISO 27001 A.13.2.1
medium
DMARC
p=none — monitoring only, no enforcement
SOC 2 CC6.7ISO 27001 A.13.2.1
medium
Security headers
6 security header(s) missing
SOC 2 CC6.6ISO 27001 A.14.1.2

Need this as an artifact your auditor can verify?

Your asahi.com scan flagged 3 medium and 3 low findings. A signed pack covers the apex plus up to 100 CT-discovered subdomains, Ed25519-signed and ISO-timestamped, delivered in 10–30 minutes.

Get a pack →See methodology See a sample$29

Scanning…

15-check summary

DNS recordsA/AAAA records present
MX1 MX record(s) present
SPF~all softfail — receivers may still accept
DMARCp=none — monitoring only, no enforcement
DKIM2/6 DKIM selectors valid
TLS certificatecert valid for 243 days
Redirect chainHTTPS served correctly
Security headers6 security header(s) missing
CORSno CORS headers — cross-origin requests blocked by default
Web surfaceHTTPS surface reachable (robots ✓, sitemap ✓, title ✓)
MTA-STSnot applicable: no _mta-sts TXT record
TLS-RPTnot applicable: no TLSRPT record
DNSSECDNSSEC not configured — no DS or DNSKEY records found
WHOISdomain expires in 65 days — renew soon
Certificate Transparencycheck failed: crt.sh: Error: crt.sh http 502; certspotter: Error: certspotter http 429

dns

info

Open standalone →

A/AAAA records present

Why it matters: Without authoritative A or AAAA records on the apex, the domain is unreachable. Missing baseline DNS shows up in vendor reviews as evidence of unmanaged infrastructure (SOC 2 CC6.6).

A: ttl=20 23.49.177.213
AAAA: —
NS: ttl=1634 a24-64.akam.net.
ttl=1634 a8-66.akam.net.
ttl=1634 a1-8.akam.net.
ttl=1634 a9-67.akam.net.
ttl=1634 a13-67.akam.net.
ttl=1634 a26-65.akam.net.
SOA: ttl=1800 a1-8.akam.net. tech-adm.asahi.com. 2026051900 1800 900 604800 1800
CAA: —
TXT: ttl=1800 "MS=ms97639603"
ttl=1800 "atlassian-domain-verification=ohrq3/7P/gW2J47iXhMcl8otmcHNRpcHPcXaybWaWooX5xaqRro4xmq/smBUlh5T"
ttl=1800 "UT1QRD2OQOHO2E5TJPFRANFNFR"
ttl=1800 "v=spf1" " include:spf01.asahi.com" " include:spf02.asahi.com" " include:spft-v1.apfmail.asahi.com" " include:amazonses.com" " include:hubspotemail.net" " include:spf.protection.outlook.com" " exists:%{i}.spf.hc198955.iphmx.com" " ~all"
ttl=1800 "adobe-idp-site-verification=188eaa66-481b-4d2c-b597-7b48f1e4e78e"
ttl=1800 "atlassian-sending-domain-verification=1ea23e66-be1a-4e79-a81e-efb9feaa6dd0"
ttl=1800 "seculio-domain-verification-code=f7a843b97c7fd7ed684cef0ad09cd612ee8d164236df2f9d0c993e5d701745f5"
ttl=1800 "scsf04ud2j4fg3r6k4q7i61n5s"
ttl=1800 "atlassian-domain-verification=U6Y71Ic4TSCXXnf4Y5seCXu00U6Qihl4kR6Xf6VPSd2fC5RxqVfNSfMmlk6c5cGw"
ttl=1800 "google-site-verification=Zy1eXVKL4P1BqGnAjuIVZp6K31FsDky77X2_kZRRJpU"
ttl=1800 "gcxqzzsm94c91c2sh7jptb0vwrn92ygg"
ttl=1800 "BSO692QHB47TN5HA2J955LGU75"
ttl=1800 "facebook-domain-verification=kglzpcvp6hq2uec8aburxdrew6f3u7"
ttl=1800 "MS=F547E41E3C2EAF104E32CBF73F73BB873A66B638"
ttl=1800 "s7psie6ec1cvpq29659p82trb1"
ttl=1800 "google-site-verification=CMRxn5sb2Pg06cn2vd96PM5x49NFWhatWCxLssbIC2g"
ttl=1800 "google-site-verification=9d7y4c_VMA9CRtFQXc76sRjZWdr1h8EqbJ8Lfa4PtUI"
ttl=1800 "google-site-verification=Uotgq2gHQn13TjlkUBYnSzUuPeNWcY3YSk4hajeifPs"

fetched 2026-05-23T10:33:53.489Z

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

1 MX record(s) present

Why it matters: MX records direct inbound mail. Misconfiguration silently breaks email delivery and lets attackers stand up parallel MX hosts for spoofing campaigns (ISO 27001 A.8.21).

pri=5 mx1.hc198955.iphmx.com.

fetched 2026-05-23T10:33:53.488Z

mx

info

Open standalone →

resolving mx…

spf

medium

Open standalone →

~all softfail — receivers may still accept

Why it matters: SPF tells receiving servers which hosts may send mail for the domain. Without it, any sender can forge the envelope-from — the primary mechanism behind business-email-compromise (SOC 2 CC6.7).

Recommendations

Move to -all (hardfail) once your mail flow is confirmed — softfail gives no real protection

v=spf1 include:spf01.asahi.com include:spf02.asahi.com include:spft-v1.apfmail.asahi.com include:amazonses.com include:hubspotemail.net include:spf.protection.outlook.com exists:%{i}.spf.hc198955.iphmx.com ~all

v=spf1
include:spf01.asahi.com
include:spf02.asahi.com
include:spft-v1.apfmail.asahi.com
include:amazonses.com
include:hubspotemail.net
include:spf.protection.outlook.com
exists:%{i}.spf.hc198955.iphmx.com
~all

fetched 2026-05-23T10:33:53.489Z

spf

info

Open standalone →

resolving spf…

dmarc

medium

Open standalone →

p=none — monitoring only, no enforcement

Why it matters: DMARC binds SPF and DKIM into an enforceable policy (quarantine or reject) and surfaces spoofing attempts via aggregate reports. `p=none` or absent means spoofing succeeds silently (SOC 2 CC6.7).

Recommendations

Review rua= aggregate reports to confirm legitimate mail passes SPF/DKIM
Move to p=quarantine and then p=reject once mail flow is validated

v=DMARC1; p=none; rua=mailto:tech-dmarc-report@asahi.com,mailto:ci-dmarc@asahi.com;

v=: DMARC1
p=: none
rua=: mailto:tech-dmarc-report@asahi.com,mailto:ci-dmarc@asahi.com

fetched 2026-05-23T10:33:53.487Z

dmarc

info

Open standalone →

resolving dmarc…

dkim

low

Open standalone →

2/6 DKIM selectors valid

Why it matters: DKIM signs outbound mail so receivers can detect tampering. Missing selectors or rotated-away keys break DMARC alignment and let receivers downgrade trust (ISO 27001 A.8.24).

Recommendations

Check the missing selectors in your DNS provider and re-add any removed records

default:: —
google:: —
k1:: —
selector1:: v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCpEeJaRC8TFtvsBE9NwM8GOFvIY+JmZ6o9NeLEfly4NvcQhizeBw9ZJvcIHPQS6N8KqrLyJc+B9QXqHhmb3FPr8GO8My1SdxwYe2DtwYoQvX0Bl1J8l5lTvr3uooZa0+trZaxwkjZXZRJDd4jexWcbnES6fqFkvdfewnh4a+huHwIDAQAB;
selector2:: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAoDfL8zHdtwOiJ8793ElxdSUpKs8LZKcibCfKoeU8DCKeqsGNeMu+1yymWDcdNMUG8/c2S6tBa3Au0s2yALBwzPI/lF83cCOGoQZnasQPMshwhuxHPxKDurUNrYMJl7hQVFxeLCu1gruftMkwXCoXILyigxtF78U7MNKjLU5hjFVHbYUAREA2dYRNB+uQyoafCazQH02Yc85ymVndDJHXTEgDt9CoMonjs0qI4a4peK0Sj9zyN29w09kxHzmlmv5bNpikh205tVKtxgdTH/wIMMw07uR48eYGGFBNeHPuGv594dywDz2LhBX8Hcy+hgZVhzhJF7mgkFQYLqHsNrCxGQIDAQAB;
mxvault:: —

fetched 2026-05-23T10:33:53.501Z

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

cert valid for 243 days

Why it matters: A valid current TLS certificate is the baseline for data in transit. Expiry, weak chain, or hostname mismatch break HTTPS and fail PCI 4.2.1 / SOC 2 CC6.1.

subject cn:: *.asahi.com
issuer:: DigiCert Global G3 TLS ECC SHA384 2020 CA1 / DigiCert Inc
valid:: Jan 22 00:00:00 2026 GMT → Jan 21 23:59:59 2027 GMT
authorized:: yes
sha256:: 51:12:29:06:57:6B:9D:CD:B9:28:62:97:D6:19:C4:4D:FB:5D:61:E6:D9:58:49:8F:D9:4F:A9:70:FD:20:96:15
sans: *.asahi.com
asahi.com

fetched 2026-05-23T10:33:53.563Z

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

HTTPS served correctly

Why it matters: Bare HTTP requests must redirect to HTTPS without dropping the user mid-chain. Plain-text fallback or open redirects fail PCI 4.2.1 and feed phishing chains (SOC 2 CC6.6).

final status: 200 · 2 hops

[301] https://asahi.com/
[200] https://www.asahi.com/

fetched 2026-05-23T10:33:54.302Z

redirects

info

Open standalone →

tracing redirects…

headers

medium

Open standalone →

6 security header(s) missing

Why it matters: Security headers — HSTS, CSP, X-Frame-Options, Referrer-Policy — defend against XSS, clickjacking, and downgrade attacks. Absent headers map directly to OWASP ASVS V14 findings (ISO 27001 A.8.23).

Recommendations

Add response header — Strict-Transport-Security: max-age=15552000; includeSubDomains
Add response header — Content-Security-Policy: default-src 'self' (tune per app)
Add response header — X-Frame-Options: DENY (or SAMEORIGIN if framing is intended)
Add response header — X-Content-Type-Options: nosniff
Add response header — Referrer-Policy: strict-origin-when-cross-origin
Add permissions-policy response header

final url: https://www.asahi.com/

security headers

strict-transport-security: —
content-security-policy: —
x-frame-options: —
x-content-type-options: —
referrer-policy: —
permissions-policy: —

other headers

cache-control: max-age=0, no-cache
connection: keep-alive, Transfer-Encoding
content-encoding: gzip
content-type: text/html
date: Sat, 23 May 2026 10:33:54 GMT
etag: W/"6a117fd0-fbc0"
expires: Sat, 23 May 2026 10:33:54 GMT
pragma: no-cache
server: nginx
set-cookie: LocChecked=1;expires=Sat, 23 May 2026 10:33:54 GMT; path=/;
transfer-encoding: chunked
vary: Accept-Encoding

fetched 2026-05-23T10:33:54.300Z

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

no CORS headers — cross-origin requests blocked by default

Why it matters: Overly permissive CORS (wildcard with credentials, or reflected origin) lets any origin read authenticated responses from this domain. OWASP A05 misconfiguration territory (NIST AC-4).

origin: https://drwho.me
method: GET
preflight status: 301

access-control-* headers

access-control-allow-origin: —
access-control-allow-methods: —
access-control-allow-headers: —
access-control-allow-credentials: —
access-control-max-age: —
access-control-expose-headers: —

no access-control-* headers returned — site does not advertise CORS to this origin

fetched 2026-05-23T10:33:53.580Z

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

HTTPS surface reachable (robots ✓, sitemap ✓, title ✓)

Why it matters: Public files — robots.txt, sitemap.xml, head meta — are what attackers see first during reconnaissance. Misadvertised paths, stale sitemaps, and verbose generators leak more than intended (ISO 27001 A.8.9).

robots.txt

present

User-Agent: *
Disallow: /travel/event/search/
Disallow: /car/index.html
Disallow: /housing/index.html
Disallow: /english/newsfeatures.html
Disallow: /english/business.html
Disallow: /english/cooljapan.html
Disallow: /english/sports.html
Disallow: /*/search/results*
Allow: /
Allow: /.well-known/assetlinks.json
Allow: /ads/tu/


User-agent: Googlebot
Disallow: /*klpuid=*

User-agent: CCBot
Disallow: /

User-agent: OAI-SearchBot
Disallow: /

User-agent: ChatGPT-User
Disallow: /

User-agent: GPTBot
Disallow: /

User-agent: Google-Extended
Disallow: /

User-agent: Google-CloudVertexBot
Disallow: /

User-agent: ICC-Crawler
Disallow: /

User-agent: anthropic-ai
Disallow: /

User-agent: ClaudeBot
Disallow: /

User-agent: Claude-Web
Disallow: /

User-agent: Claude-SearchBot
Disallow: /

User-agent: Claude-User
Disallow: /

User-agent: Applebot-Extended
Disallow: /

User-agent: cohere-ai
Disallow: /

User-agent: Cohere-training-data-crawler
Disallow: /

User-agent: omgili
Disallow: /

User-agent: omgilibot
Disallow: /

User-agent: PerplexityBot
Disallow: /

User-agent: Perplexity-ai
Disallow: /

User-agent: Perplexity-User
Disallow: /

User-agent: FacebookBot
Disallow: /

User-agent: Meta-ExternalAgent
Disallow: /

User-agent: Meta-externalfetcher
Disallow: /

User-agent: Bytespider
Disallow: /

User-agent: Gensparkbot
Disallow: /

User-agent: AmazonBot
Disallow: /

User-agent: Diffbot
Disallow: /

User-agent: Magpie-crawler
Disallow: /

User-agent: Scrapy
Disallow: /

User-agent: Timpibot
Disallow: /

User-agent: Webzio-Extended
Disallow: /

User-agent: SBIntuitionsBot
Disallow: /

User-agent: SBIntuitions-SearchBot
Disallow: /

User-agent: OpenindexSpider
Disallow: /

User-agent: AI2Bot
Disallow: /

sitemap: https://www.asahi.com/sitemap.xml

sitemap.xml

present — 8 url(s)

head

title: 朝日新聞：朝日新聞社のニュースサイト
description: 朝日新聞社のニュースサイトです。政治、経済、社会、国際、スポーツ、文化、科学などの速報ニュースに加え、教育、医療、環境などの話題や写真も。

social

og:locale: ja_JP
og:title: 朝日新聞：朝日新聞社のニュースサイト
og:url: https://www.asahi.com/
og:image: https://www.asahicom.jp/images/logo_ogp.png
og:site_name: 朝日新聞
og:type: website
og:description: 朝日新聞社のニュースサイトです。政治、経済、社会、国際、スポーツ、文化、科学などの速報ニュースに加え、教育、医療、環境などの話題や写真も。
twitter:card: summary
twitter:site: @asahi

fetched 2026-05-23T10:33:54.282Z

web-surface

info

Open standalone →

inspecting web surface…

dnssec

low

Open standalone →

DNSSEC not configured — no DS or DNSKEY records found

Why it matters: DNSSEC cryptographically signs DNS responses, blocking cache-poisoning attacks. US federal civilian agencies are required to enable it under OMB M-22-09 (NIST SC-20).

Recommendations

Enable DNSSEC in your DNS provider's control panel and add the resulting DS record at your registrar

enabled: no
DS records: —
DNSKEY records: —

fetched 2026-05-23T10:33:53.500Z

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

not applicable: no _mta-sts TXT record

Why it matters: MTA-STS forces inbound SMTP to use TLS and refuse downgraded connections. Without it, an in-path attacker can strip TLS and read mail in plaintext (SOC 2 CC6.7).

no _mta-sts TXT record

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

not applicable: no TLSRPT record

Why it matters: TLS-RPT publishes a reporting address for SMTP-TLS failures. Without it, downgrade attacks on inbound mail go unnoticed (SOC 2 CC7.2).

no TLSRPT record

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

low

Open standalone →

domain expires in 65 days — renew soon

Why it matters: Registrar and expiry tell auditors the domain is owned, current, and not about to lapse. An expired or about-to-expire domain fails business-continuity evidence (SOC 2 A1.2).

Recommendations

Enable auto-renewal at your registrar to avoid accidental expiry

registrar: Japan Registry Services Co., Ltd.
created: 1995-07-29T04:00:00Z
expires: 2026-07-28T04:00:00Z
statuses: ok https://icann.org/epp#ok

fetched 2026-05-23T10:33:56.894Z

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

check failed: crt.sh: Error: crt.sh http 502; certspotter: Error: certspotter http 429

Why it matters: Every certificate issued for this domain is published in Certificate Transparency logs — including subdomains you may have forgotten. Unknown subdomains in CT are pre-disclosed attack surface (ISO 27001 A.8.16).

crt.sh: Error: crt.sh http 502; certspotter: Error: certspotter http 429

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.