Why it matters: MX records direct inbound mail. Misconfiguration silently breaks email delivery and lets attackers stand up parallel MX hosts for spoofing campaigns (ISO 27001 A.8.21).
Why it matters: DMARC binds SPF and DKIM into an enforceable policy (quarantine or reject) and surfaces spoofing attempts via aggregate reports. `p=none` or absent means spoofing succeeds silently (SOC 2 CC6.7).
Why it matters: SPF tells receiving servers which hosts may send mail for the domain. Without it, any sender can forge the envelope-from — the primary mechanism behind business-email-compromise (SOC 2 CC6.7).
Why it matters: DKIM signs outbound mail so receivers can detect tampering. Missing selectors or rotated-away keys break DMARC alignment and let receivers downgrade trust (ISO 27001 A.8.24).
Recommendations
Check the missing selectors in your DNS provider and re-add any removed records
DNSSEC not configured — no DS or DNSKEY records found
Why it matters: DNSSEC cryptographically signs DNS responses, blocking cache-poisoning attacks. US federal civilian agencies are required to enable it under OMB M-22-09 (NIST SC-20).
Recommendations
Enable DNSSEC in your DNS provider's control panel and add the resulting DS record at your registrar
Why it matters: MTA-STS forces inbound SMTP to use TLS and refuse downgraded connections. Without it, an in-path attacker can strip TLS and read mail in plaintext (SOC 2 CC6.7).
Why it matters: Without authoritative A or AAAA records on the apex, the domain is unreachable. Missing baseline DNS shows up in vendor reviews as evidence of unmanaged infrastructure (SOC 2 CC6.6).
Why it matters: A valid current TLS certificate is the baseline for data in transit. Expiry, weak chain, or hostname mismatch break HTTPS and fail PCI 4.2.1 / SOC 2 CC6.1.
no CORS headers — cross-origin requests blocked by default
Why it matters: Overly permissive CORS (wildcard with credentials, or reflected origin) lets any origin read authenticated responses from this domain. OWASP A05 misconfiguration territory (NIST AC-4).
origin
https://drwho.me
method
GET
preflight status
302
access-control-* headers
access-control-allow-origin
—
access-control-allow-methods
—
access-control-allow-headers
—
access-control-allow-credentials
—
access-control-max-age
—
access-control-expose-headers
—
no access-control-* headers returned — site does not advertise CORS to this origin
Why it matters: Bare HTTP requests must redirect to HTTPS without dropping the user mid-chain. Plain-text fallback or open redirects fail PCI 4.2.1 and feed phishing chains (SOC 2 CC6.6).
HTTPS surface reachable (robots ✓, sitemap ✗, title ✓)
Why it matters: Public files — robots.txt, sitemap.xml, head meta — are what attackers see first during reconnaissance. Misadvertised paths, stale sitemaps, and verbose generators leak more than intended (ISO 27001 A.8.9).
robots.txt
present
#
#
# :$$$
# $II :III
# III :III
# :III
# +ZZ+ ?ZZ~ +ZZZI :III ?I+ IZZ7 +ZZI IZZ~
# .7IIIIII ~IIIIIIII $II 7IIIIIIIII7 :IIIIIIIII$ IIIIIIIII7 7IIIIIII 77IIIIIII
# ZIII. : ZIII III $II 7II IIII :III III7 I III: 7II. ZII, III.
# III III III $II 7II III :III III= III III II: III
# +III ZII, III $II 7II III :III III .Z$7IIIII ,III7 $II +Z$III
# 7II+ $II 7II $II 7II III :III III ZIIII~ III ?IIIII $IIIIIIIIII:
# ~III III= III $II 7II III :III III ZII III IIII III
# III III ,III $II 7II III :III 7II 7II III III III
# .III7 :$ ~III? ZIII $II 7II III :III $III =III III Z$ ~7III III7 7$
# IIIIII IIIIIII? $II 7II III :IIIIIIIII ,IIIIIIIIII IIIIIIII. IIIIIIII
#
# Bitcoin Made Easy - Coinbase is the simplest way to buy, use, and accept Bitcoin.
#
# https://www.coinbase.com/careers
#
User-Agent: facebookexternalhit
Allow: /
User-Agent: Twitterbot
Allow: /
User-Agent: LinkedInBot
Allow: /
User-Agent: WhatsApp
Allow: /
User-agent: Slackbot
Allow: /
User-agent: Discordbot
Allow: /
User-agent: AdsBot-Google
Allow: /
User-agent: AdsBot-Google-Mobile
Allow: /
User-Agent: *
Disallow: /oauth/
Disallow: /*/oauth/
Disallow: /signup-interstitial
Disallow: /*/signup-interstitial
Disallow: /join/
Disallow: /*/join/
Disallow: /spot/*
Disallow: /*/spot/*
Disallow: /advanced-trade/spot/
Disallow: /*/advanced-trade/spot/
Disallow: /converter/*/*?currencyPage*
Disallow: /*/converter/*/*?currencyPage*
Disallow: /price/*?locale*
Disallow: /*/price/*?locale*
Disallow: /partner/
Disallow: /*/partner/
Disallow: /lp/
Disallow: /*/lp/
Disallow: /*/cookie-preferences
Disallow: /*/*/cookie-preferences
Disallow: /cookie-preferences
Disallow: /*/cookie-preferences
Allow: /.well-known/
Sitemap: https://www.coinbase.com/sitemap-converter-index.xml
Sitemap: https://www.coinbase.com/sitemap-derivatives-index.xml
Sitemap: https://www.coinbase.com/sitemap-prediction-markets-index.xml
Sitemap: https://www.coinbase.com/sitemap-equities-index.xml
Sitemap: https://www.coinbase.com/sitemap-how-to-buy-index.xml
Sitemap: https://www.coinbase.com/sitemap-prices-index.xml
Sitemap: https://www.coinbase.com/sitemap-price-prediction-index.xml
Sitemap: https://www.coinbase.com/sitemap-staking-index.xml
Sitemap: https://www.coinbase.com/sitemap-careers.xml
Sitemap: https://www.coinbase.com/sitemap-learn.xml
Sitemap: https://www.coinbase.com/sitemap-bytes.xml
Sitemap: https://www.coinbase.com/sitemap-institutional.xml
Sitemap: https://www.coinbase.com/sitemap-blog.xml
Sitemap: https://www.coinbase.com/sitemap-marketing.xml
Sitemap: https://www.coinbase.com/sitemap-advanced.xml
Why it matters: Registrar and expiry tell auditors the domain is owned, current, and not about to lapse. An expired or about-to-expire domain fails business-continuity evidence (SOC 2 A1.2).
Recommendations
Enable auto-renewal at your registrar to avoid accidental expiry
Aggregate grade across 15 checks. Auditors typically flag any High-severity finding.
Pass
11
Warn
4
Fail
0
What an auditor would flag first
low
DKIM
1/6 DKIM selectors valid
SOC 2 CC6.7
low
TLS certificate
cert expires in 83 days
SOC 2 CC6.6ISO 27001 A.13.1.1
low
DNSSEC
DNSSEC not configured — no DS or DNSKEY records found
SOC 2 CC6.6ISO 27001 A.13.1.1
Need this as an artifact your auditor can verify?
Your coinbase.com scan flagged 4 low findings. A signed pack covers the apex plus up to 100 CT-discovered subdomains, Ed25519-signed and ISO-timestamped, delivered in 10–30 minutes.
check failed: crt.sh: AbortError: This operation was aborted; certspotter: Error: certspotter http 429
Why it matters: Every certificate issued for this domain is published in Certificate Transparency logs — including subdomains you may have forgotten. Unknown subdomains in CT are pre-disclosed attack surface (ISO 27001 A.8.16).
crt.sh: AbortError: This operation was aborted; certspotter: Error: certspotter http 429