cia.gov

15-check dossier · scoreboard above, section details below

Get a pack →

Scanning…

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

resolving mx…

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

resolving dmarc…

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

tracing redirects…

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

inspecting web surface…

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.

cia.gov

15-check dossier · scoreboard above, section details below

Get a pack →

A-

Audit-ready · 4 minor advisories

Aggregate grade across 15 checks. Auditors typically flag any High-severity finding.

Pass: 11
Warn: 4
Fail: 0

What an auditor would flag first

low
DMARC
p=quarantine — receivers send to spam
SOC 2 CC6.7ISO 27001 A.13.2.1
low
DKIM
no DKIM selectors found — likely not configured
SOC 2 CC6.7
low
TLS certificate
cert expires in 81 days
SOC 2 CC6.6ISO 27001 A.13.1.1

Need this as an artifact your auditor can verify?

Your cia.gov scan flagged 4 low findings. A signed pack covers the apex plus up to 100 CT-discovered subdomains, Ed25519-signed and ISO-timestamped, delivered in 10–30 minutes.

Get a pack →See methodology See a sample$29

Scanning…

15-check summary

DNS recordsA/AAAA records present
MX2 MX record(s) present
SPF-all hardfail — strict policy
DMARCp=quarantine — receivers send to spam
DKIMno DKIM selectors found — likely not configured
TLS certificatecert expires in 81 days
Redirect chainHTTPS served correctly
Security headers2 security header(s) missing
CORSno CORS headers — cross-origin requests blocked by default
Web surfaceHTTPS surface reachable (robots ✓, sitemap ✗, title ✗)
MTA-STSnot applicable: no _mta-sts TXT record
TLS-RPTnot applicable: no TLSRPT record
DNSSECDNSSEC enabled — DS records present and chain validated (AD flag)
WHOISdomain registered until 2026-09-09
Certificate Transparencycheck failed: crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

dns

info

Open standalone →

A/AAAA records present

Why it matters: Without authoritative A or AAAA records on the apex, the domain is unreachable. Missing baseline DNS shows up in vendor reviews as evidence of unmanaged infrastructure (SOC 2 CC6.6).

A: ttl=20 23.48.203.240
ttl=20 23.48.203.249
AAAA: ttl=20 2600:1408:c400:12::17cd:6b16
ttl=20 2600:1408:c400:12::17cd:6b18
NS: ttl=86400 a1-22.akam.net.
ttl=86400 a3-64.akam.net.
ttl=86400 a12-65.akam.net.
ttl=86400 a13-65.akam.net.
ttl=86400 a16-67.akam.net.
ttl=86400 a22-66.akam.net.
SOA: ttl=14400 a1-22.akam.net. monrpt.cia.gov. 2015111811 7200 3600 2419200 14400
CAA: ttl=1800 \# 36 00 05 69 6f 64 65 66 6d 61 69 6c 74 6f 3a 63 61 61 6e 6f 74 69 63 65 73 40 75 63 65 2e 63 69 61 2e 67 6f 76
ttl=1800 \# 19 00 05 69 73 73 75 65 64 69 67 69 63 65 72 74 2e 63 6f 6d
TXT: ttl=300 "v=spf1 mx -all"

fetched 2026-05-23T10:45:22.026Z

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

2 MX record(s) present

Why it matters: MX records direct inbound mail. Misconfiguration silently breaks email delivery and lets attackers stand up parallel MX hosts for spoofing campaigns (ISO 27001 A.8.21).

pri=10 mail3.cia.gov.
pri=10 mail4.cia.gov.

fetched 2026-05-23T10:45:22.028Z

mx

info

Open standalone →

resolving mx…

spf

info

Open standalone →

-all hardfail — strict policy

Why it matters: SPF tells receiving servers which hosts may send mail for the domain. Without it, any sender can forge the envelope-from — the primary mechanism behind business-email-compromise (SOC 2 CC6.7).

v=spf1 mx -all

v=spf1
mx
-all

fetched 2026-05-23T10:45:22.026Z

spf

info

Open standalone →

resolving spf…

dmarc

low

Open standalone →

p=quarantine — receivers send to spam

Why it matters: DMARC binds SPF and DKIM into an enforceable policy (quarantine or reject) and surfaces spoofing attempts via aggregate reports. `p=none` or absent means spoofing succeeds silently (SOC 2 CC6.7).

Recommendations

Upgrade to p=reject once your SPF and DKIM pass rates are consistently high

v=DMARC1; p=quarantine; sp=quarantine; pct=100; rua=mailto:demarcreports@uce.cia.gov; ruf=mailto:demarcfailures@uce.cia.gov; ri=86400; aspf=s; adkim=s; fo=1

v=: DMARC1
p=: quarantine
sp=: quarantine
pct=: 100
rua=: mailto:demarcreports@uce.cia.gov
ruf=: mailto:demarcfailures@uce.cia.gov
ri=: 86400
aspf=: s
adkim=: s
fo=: 1

fetched 2026-05-23T10:45:22.024Z

dmarc

info

Open standalone →

resolving dmarc…

dkim

low

Open standalone →

no DKIM selectors found — likely not configured

Why it matters: DKIM signs outbound mail so receivers can detect tampering. Missing selectors or rotated-away keys break DMARC alignment and let receivers downgrade trust (ISO 27001 A.8.24).

Recommendations

Enable DKIM signing in your mail provider and publish the provided TXT record
Common selectors: google._domainkey, selector1._domainkey (Microsoft), mail._domainkey

no DKIM record on probed selectors (default, google, k1, selector1, selector2, mxvault)

dkim

info

Open standalone →

probing dkim selectors…

tls

low

Open standalone →

cert expires in 81 days

Why it matters: A valid current TLS certificate is the baseline for data in transit. Expiry, weak chain, or hostname mismatch break HTTPS and fail PCI 4.2.1 / SOC 2 CC6.1.

Recommendations

Schedule certificate renewal — consider enabling auto-renewal

subject cn:: www.cia.gov
issuer:: DigiCert Global G3 TLS ECC SHA384 2020 CA1 / DigiCert Inc
valid:: Aug 13 00:00:00 2025 GMT → Aug 12 23:59:59 2026 GMT
authorized:: yes
sha256:: CA:BF:37:06:F4:E5:73:8D:27:9D:1F:AB:94:D5:CB:22:3C:BB:6E:C2:EF:08:46:A4:21:47:92:6B:EC:D8:CE:16
sans: www.cia.gov
cia.gov

fetched 2026-05-23T10:45:22.063Z

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

HTTPS served correctly

Why it matters: Bare HTTP requests must redirect to HTTPS without dropping the user mid-chain. Plain-text fallback or open redirects fail PCI 4.2.1 and feed phishing chains (SOC 2 CC6.6).

final status: 200 · 2 hops

[301] https://cia.gov/
[200] https://www.cia.gov/

fetched 2026-05-23T10:45:22.139Z

redirects

info

Open standalone →

tracing redirects…

headers

low

Open standalone →

2 security header(s) missing

Why it matters: Security headers — HSTS, CSP, X-Frame-Options, Referrer-Policy — defend against XSS, clickjacking, and downgrade attacks. Absent headers map directly to OWASP ASVS V14 findings (ISO 27001 A.8.23).

Recommendations

Add response header — Content-Security-Policy: default-src 'self' (tune per app)
Add permissions-policy response header

final url: https://www.cia.gov/

security headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
content-security-policy: —
x-frame-options: sameorigin
x-content-type-options: nosniff
referrer-policy: same-origin
permissions-policy: —

other headers

accept-ranges: bytes
connection: keep-alive
content-encoding: gzip
content-length: 60443
content-type: text/html
date: Sat, 23 May 2026 10:45:22 GMT
etag: "95a29483969940fc5a588b6d47cf8109:1779382525.483858"
id: 9/WeSHBhFNr87xmPg8rjo8B3/xhesZlI8Z+x+zPojB2OrRgWRxnnEr54HM5soqSZ
last-modified: Thu, 21 May 2026 16:55:25 GMT
session: NMZXJ/1BOePO4CWRBN+Tz8vBPPPDivFy8QMfIatpGvH+6yaII+d0smxlwW5u8PdEr/bgI7oKSYnScPuB/wz4GA==
set-cookie: _session_=251F3F80B299E183C15408A3AF59EEA2; path=/; domain=cia.gov; secure; HttpOnly
vary: Accept-Encoding
x-akamai-transformed: 9 60361 0 pmb=mNONE,1

fetched 2026-05-23T10:45:22.152Z

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

no CORS headers — cross-origin requests blocked by default

Why it matters: Overly permissive CORS (wildcard with credentials, or reflected origin) lets any origin read authenticated responses from this domain. OWASP A05 misconfiguration territory (NIST AC-4).

origin: https://drwho.me
method: GET
preflight status: 501

access-control-* headers

access-control-allow-origin: —
access-control-allow-methods: —
access-control-allow-headers: —
access-control-allow-credentials: —
access-control-max-age: —
access-control-expose-headers: —

no access-control-* headers returned — site does not advertise CORS to this origin

fetched 2026-05-23T10:45:22.099Z

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

HTTPS surface reachable (robots ✓, sitemap ✗, title ✗)

Why it matters: Public files — robots.txt, sitemap.xml, head meta — are what attackers see first during reconnaissance. Misadvertised paths, stale sitemaps, and verbose generators leak more than intended (ISO 27001 A.8.9).

robots.txt

present

User-agent: usasearch
Crawl-delay: 2

User-agent: Mediapartners-Google*
Disallow: /

User-agent: bingbot
Disallow: /

User-agent: msnbot
Disallow: /

User-agent: IsraBot
Disallow: /

User-agent: Orthogaffe
Disallow: /

User-agent: UbiCrawler
Disallow: /

User-agent: DOC
Disallow: /

User-agent: Zao
Disallow: /

User-agent: sitecheck.internetseer.com
Disallow: /

User-agent: Zealbot
Disallow: /

User-agent: MSIECrawler
Disallow: /

User-agent: SiteSnagger
Disallow: /

User-agent: WebStripper
Disallow: /

User-agent: WebCopier
Disallow: /

User-agent: Fetch
Disallow: /

User-agent: Offline Explorer
Disallow: /

User-agent: Teleport
Disallow: /

User-agent: TeleportPro
Disallow: /

User-agent: WebZIP
Disallow: /

User-agent: linko
Disallow: /

User-agent: HTTrack
Disallow: /

User-agent: Microsoft.URL.Control
Disallow: /

User-agent: Xenu
Disallow: /

User-agent: larbin
Disallow: /

User-agent: libwww
Disallow: /

User-agent: ZyBORG
Disallow: /

User-agent: Download Ninja
Disallow: /

User-agent: wget
Disallow: /

User-agent: grub-client
Disallow: /

User-agent: k2spider
Disallow: /

User-agent: NPBot
Disallow: /

User-agent: WebReaper
Disallow: /

User-agent: *
Disallow: /js/
Disallow: /preview/
Disallow: /*.js$
Disallow: /*.js.map$
Disallow: /*.json$
Disallow: /readingroom/search/
Disallow: /readingroom/advanced-search-view/
Disallow: /readingroom/request/
Crawl-delay: 10
Sitemap: https://www.cia.gov/sitemap/sitemap-0.xml
Sitemap: https://www.cia.gov/readingroom/sitemap.xml
Sitemap: https://www.cia.gov/the-world-factbook/sitemap/sitemap-0.xml
Host: https://www.cia.gov

sitemap.xml

absent

head

title: —
description: —

social

og:title
og:description
og:image
og:url
twitter:title
twitter:description
twitter:card

fetched 2026-05-23T10:45:22.352Z

web-surface

info

Open standalone →

inspecting web surface…

dnssec

info

Open standalone →

DNSSEC enabled — DS records present and chain validated (AD flag)

Why it matters: DNSSEC cryptographically signs DNS responses, blocking cache-poisoning attacks. US federal civilian agencies are required to enable it under OMB M-22-09 (NIST SC-20).

enabled: yes
DS records: 1015 RSASHA256 2 66b64ea16cd54eec14bdef2eca16e1bcc62a2dd7a95fe64a24cbaf2a7e411436, 25534 RSASHA256 2 4f6e9f886a649976127d3a4746108c2461e2d9198f1d24c869cfd9e91e2cf5b3, 48959 RSASHA256 2 deb2a237884ddcfd20bdff8e8fa81f4a4b7ed069e1e4e2ed79cae7707d1cfffc, 62599 RSASHA256 2 e51ae54018e41619f97076a56c969d10a71b4d0050dbf1e6ab8de2f8cf023ae5, DS ECDSAP256SHA256 2 3600 1779623122 1779443122 35496 gov. 2bdowCfXvb1b9TS13p/pl4WWO0lCBIv1PYUhdld5tSFwpsmpkCIp1ThL8yY2nZjRtZnKBo1jRm3rS5ieJm/BLw==
DNSKEY records: 4 key(s)

fetched 2026-05-23T10:45:22.035Z

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

not applicable: no _mta-sts TXT record

Why it matters: MTA-STS forces inbound SMTP to use TLS and refuse downgraded connections. Without it, an in-path attacker can strip TLS and read mail in plaintext (SOC 2 CC6.7).

no _mta-sts TXT record

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

not applicable: no TLSRPT record

Why it matters: TLS-RPT publishes a reporting address for SMTP-TLS failures. Without it, downgrade attacks on inbound mail go unnoticed (SOC 2 CC7.2).

no TLSRPT record

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

domain registered until 2026-09-09

Why it matters: Registrar and expiry tell auditors the domain is owned, current, and not about to lapse. An expired or about-to-expire domain fails business-continuity evidence (SOC 2 A1.2).

registrar: get.gov
created: 1998-06-26T13:50:31Z
expires: 2026-09-09T15:55:48Z
statuses: serverTransferProhibited https://icann.org/epp#serverTransferProhibited

fetched 2026-05-23T10:45:22.194Z

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

check failed: crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

Why it matters: Every certificate issued for this domain is published in Certificate Transparency logs — including subdomains you may have forgotten. Unknown subdomains in CT are pre-disclosed attack surface (ISO 27001 A.8.16).

crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.