convertkit.com

15-check dossier · scoreboard above, section details below

Get a pack →

Scanning…

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

resolving mx…

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

resolving dmarc…

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

tracing redirects…

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

inspecting web surface…

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.

convertkit.com

15-check dossier · scoreboard above, section details below

Get a pack →

C+

6 items need attention

Aggregate grade across 15 checks. Auditors typically flag any High-severity finding.

Pass: 9
Warn: 6
Fail: 0

What an auditor would flag first

medium
SPF
~all softfail — receivers may still accept
SOC 2 CC6.7ISO 27001 A.13.2.1
medium
DMARC
p=none — monitoring only, no enforcement
SOC 2 CC6.7ISO 27001 A.13.2.1
medium
Redirect chain
redirects to different domain: kit.com
SOC 2 CC6.6

Need this as an artifact your auditor can verify?

Your convertkit.com scan flagged 3 medium and 3 low findings. A signed pack covers the apex plus up to 100 CT-discovered subdomains, Ed25519-signed and ISO-timestamped, delivered in 10–30 minutes.

Get a pack →See methodology See a sample$29

Scanning…

15-check summary

DNS recordsA/AAAA records present
MX5 MX record(s) present
SPF~all softfail — receivers may still accept
DMARCp=none — monitoring only, no enforcement
DKIM1/6 DKIM selectors valid
TLS certificatecert valid for 130 days
Redirect chainredirects to different domain: kit.com
Security headers1 security header(s) missing
CORSno CORS headers — cross-origin requests blocked by default
Web surfaceHTTPS surface reachable (robots ✓, sitemap ✗, title ✓)
MTA-STSnot applicable: no _mta-sts TXT record
TLS-RPTnot applicable: no TLSRPT record
DNSSECDNSSEC not configured — no DS or DNSKEY records found
WHOISdomain registered until 2028-01-16
Certificate Transparencycheck failed: crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

dns

info

Open standalone →

A/AAAA records present

Why it matters: Without authoritative A or AAAA records on the apex, the domain is unreachable. Missing baseline DNS shows up in vendor reviews as evidence of unmanaged infrastructure (SOC 2 CC6.6).

A: ttl=60 18.116.158.18
ttl=60 18.117.34.15
ttl=60 3.130.16.247
AAAA: —
NS: ttl=3600 ns-1488.awsdns-58.org.
ttl=3600 ns-1556.awsdns-02.co.uk.
ttl=3600 ns-243.awsdns-30.com.
ttl=3600 ns-888.awsdns-47.net.
SOA: ttl=60 ns-888.awsdns-47.net. awsdns-hostmaster.amazon.com. 1 7200 900 1209600 86400
CAA: —
TXT: ttl=3600 "160EC373CF"
ttl=3600 "google-site-verification=6hT4GjgUie2PuHdWRQ9bEILTTc8Ip2taB8RjjET5ZsQ"
ttl=3600 "google-site-verification=jwTxSksDGQy9auxbMfAsrKmpyYZ-qBds79K0wgMvUEI"
ttl=3600 "ps-cd-verification=39c5de2c-10c3-48aa-bea2-dab247a23847"
ttl=3600 "v=spf1 include:_spf.google.com include:5217515.spf04.hubspotemail.net ~all"
ttl=3600 "yahoo-verification-key=ZB70ocI/W39QlZP+yi5pf5W1K12WGHC0WMtDpERW61k="

fetched 2026-05-23T09:21:05.633Z

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

5 MX record(s) present

Why it matters: MX records direct inbound mail. Misconfiguration silently breaks email delivery and lets attackers stand up parallel MX hosts for spoofing campaigns (ISO 27001 A.8.21).

pri=1 aspmx.l.google.com.
pri=5 alt1.aspmx.l.google.com.
pri=5 alt2.aspmx.l.google.com.
pri=10 aspmx2.googlemail.com.
pri=10 aspmx3.googlemail.com.

fetched 2026-05-23T09:21:05.633Z

mx

info

Open standalone →

resolving mx…

spf

medium

Open standalone →

~all softfail — receivers may still accept

Why it matters: SPF tells receiving servers which hosts may send mail for the domain. Without it, any sender can forge the envelope-from — the primary mechanism behind business-email-compromise (SOC 2 CC6.7).

Recommendations

Move to -all (hardfail) once your mail flow is confirmed — softfail gives no real protection

v=spf1 include:_spf.google.com include:5217515.spf04.hubspotemail.net ~all

v=spf1
include:_spf.google.com
include:5217515.spf04.hubspotemail.net
~all

fetched 2026-05-23T09:21:05.634Z

spf

info

Open standalone →

resolving spf…

dmarc

medium

Open standalone →

p=none — monitoring only, no enforcement

Why it matters: DMARC binds SPF and DKIM into an enforceable policy (quarantine or reject) and surfaces spoofing attempts via aggregate reports. `p=none` or absent means spoofing succeeds silently (SOC 2 CC6.7).

Recommendations

Review rua= aggregate reports to confirm legitimate mail passes SPF/DKIM
Move to p=quarantine and then p=reject once mail flow is validated

v=DMARC1; p=none; pct=100; rua=mailto:e17d9217d95d4ad1b9419b0fd7c29afb@dmarc-reports.cloudflare.net,mailto:postmaster@convertkit.com;

v=: DMARC1
p=: none
pct=: 100
rua=: mailto:e17d9217d95d4ad1b9419b0fd7c29afb@dmarc-reports.cloudflare.net,mailto:postmaster@convertkit.com

fetched 2026-05-23T09:21:05.634Z

dmarc

info

Open standalone →

resolving dmarc…

dkim

low

Open standalone →

1/6 DKIM selectors valid

Why it matters: DKIM signs outbound mail so receivers can detect tampering. Missing selectors or rotated-away keys break DMARC alignment and let receivers downgrade trust (ISO 27001 A.8.24).

Recommendations

Check the missing selectors in your DNS provider and re-add any removed records

default:: —
google:: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwe4uCzri7LV+VxfMBg5yz7nMw0NSmt44YVp298RGwkO7WisPzDt/OD7/TXArjgG2KbfyxPZw0BsGB7K+uBPmzUoCCh3IQSpeTFS8Bw5Vld8pBbrVW6Z9oljYZui9xv2aT4fqOf+vYtnAg3kgUmRzb7O3CQnjhUf15CpL5LThkpKbZ/Bz29aYz/3tjegMy9K5l8rY+dShVT/senY4HmOKJnWFSrl47BSTMVuHyCqH3r6P3V7vEUeeF5hqXLEkfuzzo9aa7YLBozjh2YLRVx7DAuNMtQGkjG4GWsci6LhE87WQVNv4SW6HcKYnGzv2W1hGPqCGhSdpUed+/RfKseKVlwIDAQAB
k1:: —
selector1:: —
selector2:: —
mxvault:: —

fetched 2026-05-23T09:21:05.637Z

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

cert valid for 130 days

Why it matters: A valid current TLS certificate is the baseline for data in transit. Expiry, weak chain, or hostname mismatch break HTTPS and fail PCI 4.2.1 / SOC 2 CC6.1.

subject cn:: convertkit.com
issuer:: Amazon RSA 2048 M02 / Amazon
valid:: Sep 1 00:00:00 2025 GMT → Sep 30 23:59:59 2026 GMT
authorized:: yes
sha256:: 3B:B5:9B:E1:E3:B8:FD:38:04:45:59:6B:1E:A8:BC:3F:C8:D7:D1:F2:2D:97:BD:48:B2:AE:04:24:41:67:70:C9
sans: convertkit.com

fetched 2026-05-23T09:21:05.696Z

tls

info

Open standalone →

fetching tls cert…

redirects

medium

Open standalone →

redirects to different domain: kit.com

Why it matters: Bare HTTP requests must redirect to HTTPS without dropping the user mid-chain. Plain-text fallback or open redirects fail PCI 4.2.1 and feed phishing chains (SOC 2 CC6.6).

Recommendations

Verify this cross-domain redirect is intentional (e.g. domain migration or CDN)
Ensure the destination domain is owned and expected — unintended redirects can leak traffic

final status: 200 · 2 hops

[301] https://convertkit.com/
[200] https://kit.com/

fetched 2026-05-23T09:21:05.833Z

redirects

info

Open standalone →

tracing redirects…

headers

low

Open standalone →

1 security header(s) missing

Why it matters: Security headers — HSTS, CSP, X-Frame-Options, Referrer-Policy — defend against XSS, clickjacking, and downgrade attacks. Absent headers map directly to OWASP ASVS V14 findings (ISO 27001 A.8.23).

Recommendations

Add response header — Content-Security-Policy: default-src 'self' (tune per app)

final url: https://kit.com/

security headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
content-security-policy: —
x-frame-options: sameorigin
x-content-type-options: nosniff
referrer-policy: same-origin
permissions-policy: geolocation=*

other headers

access-control-allow-origin: *
age: 63817
cache-control: public, max-age=0, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: a002fd0acd0f1780-IAD
connection: keep-alive
content-disposition: inline
content-encoding: br
content-type: text/html; charset=utf-8
date: Sat, 23 May 2026 09:21:05 GMT
etag: W/"4137cfddf80317614242b833cfafc82b"
server: cloudflare
set-cookie: __cf_bm=7nARWALc.vEkZlQjqYfr9cTaJTdYhgz3RyTNApVVdIw-1779528065.7254333-1.0.1.1-bjx84Lhb5PgnaiDwMInT.RMm74cxf0vfC0FWZyiMlvjjhPg376Hvu8.LqZdzi6PXoOC.iSiaXsyESVaFNIkXTEv.te1AQbHu5OX.DXCtDtdZGG1N_TDWF7NHvg9uysBk; HttpOnly; SameSite=None; Secure; Path=/; Domain=kit.com; Expires=Sat, 23 May 2026 09:51:05 GMT
transfer-encoding: chunked
vary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch, accept-encoding
x-dns-prefetch-control: on
x-matched-path: /
x-vercel-cache: HIT
x-vercel-id: cle1:iad1::wq29v-1779528065733-a1d1f8977de4
x-xss-protection: 1; mode=block

fetched 2026-05-23T09:21:05.788Z

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

no CORS headers — cross-origin requests blocked by default

Why it matters: Overly permissive CORS (wildcard with credentials, or reflected origin) lets any origin read authenticated responses from this domain. OWASP A05 misconfiguration territory (NIST AC-4).

origin: https://drwho.me
method: GET
preflight status: 301

access-control-* headers

access-control-allow-origin: —
access-control-allow-methods: —
access-control-allow-headers: —
access-control-allow-credentials: —
access-control-max-age: —
access-control-expose-headers: —

no access-control-* headers returned — site does not advertise CORS to this origin

fetched 2026-05-23T09:21:05.703Z

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

HTTPS surface reachable (robots ✓, sitemap ✗, title ✓)

Why it matters: Public files — robots.txt, sitemap.xml, head meta — are what attackers see first during reconnaissance. Misadvertised paths, stale sitemaps, and verbose generators leak more than intended (ISO 27001 A.8.9).

robots.txt

present

User-agent: *
Disallow: /wp-admin/
Disallow: /wp-uploads/
Disallow: /wp-json/oembed

Sitemap: https://kit.com/sitemap_index.xml

#    Kit is hiring and
#    looking for talented people.
#
#    Learn more at:
#    kit.com/careers
#
#
#    %%%%%%%%%%%%%%%%%%%%%%%                                 %%%%    
#    %%%%%%%%%%%%%%%%%%%%%%%%                    %%%%%%%%%%%%%%%%%   
#    %%%%%%%%%%%%%%%%%%%%%%%%                %%%%%%%%%%%%%%%%%%%%%   
#    %%%%%%%%%%%%%%%%%%%%%%%%             %%%%%%%%%%%%%%%%%%%%%%%%   
#    %%%%%%%%%%%%%%%%%%%%%%%%           %%%%%%%%%%%%%%%%%%%%%%%%%%   
#    %%%%%%%%%%%%%%%%%%%%%%%%         %%%%%%%%%%%%%%%%%%%%%%%%%%%%   
#    %%%%%%%%%%%%%%%%%%%%%%%%       %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   
#    %%%%%%%%%%%%%%%%%%%%%%%%      %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   
#    %%%%%%%%%%%%%%%%%%%%%%%%     %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   
#    %%%%%%%%%%%%%%%%%%%%%%%%    %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   
#    %%%%%%%%%%%%%%%%%%%%%%%%   %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   
#    %%%%%%%%%%%%%%%%%%%%%%%%  %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   
#    %%%%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   
#    %%%%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   
#    %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%                      
#    %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%                 
#    %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%             
#    %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%           
#    %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%         
#    %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%       
#    %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%      
#    %%%%%%%%%%%%%%%%%%%%%%%%     %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%     
#    %%%%%%%%%%%%%%%%%%%%%%%%        %%%%%%%%%%%%%%%%%%%%%%%%%%%%    
#    %%%%%%%%%%%%%%%%%%%%%%%%          %%%%%%%%%%%%%%%%%%%%%%%%%%%   
#    %%%%%%%%%%%%%%%%%%%%%%%%            %%%%%%%%%%%%%%%%%%%%%%%%%   
#    %%%%%%%%%%%%%%%%%%%%%%%%             %%%%%%%%%%%%%%%%%%%%%%%%%  
#    %%%%%%%%%%%%%%%%%%%%%%%%             %%%%%%%%%%%%%%%%%%%%%%%%%% 
#    %%%%%%%%%%%%%%%%%%%%%%%%              %%%%%%%%%%%%%%%%%%%%%%%%% 
#    %%%%%%%%%%%%%%%%%%%%%%%%              %%%%%%%%%%%%%%%%%%%%%%%%% 
#    %%%%%%%%%%%%%%%%%%%%%%%%               %%%%%%%%%%%%%%%%%%%%%%%%%
#    %%%%%%%%%%%%%%%%%%%%%%%%               %%%%%%%%%%%%%%%%%%%%%%%%%
#    %%%%%%%%%%%%%%%%%%%%%%%%               %%%%%%%%%%%%%%%%%%%%%%%%%
#    %%%%%%%%%%%%%%%%%%%%%%%%               %%%%%%%%%%%%%%%%%%%%%%%%%
#    %%%%%%%%%%%%%%%%%%%%%%%%               %%%%%%%%%%%%%%%%%%%%%%%%%
#    %%%%%%%%%%%%%%%%%%%%%%%%               %%%%%%%%%%%%%%%%%%%%%%%%%

sitemap.xml

absent

head

title: Kit: Email Marketing Automation & Newsletter Growth Engine for Creators (formerly ConvertKit)
description: Kit (formerly ConvertKit) is the creator-first email marketing and newsletter platform. Grow your audience, automate campaigns, and sell without burnout.

social

og:locale: en_US
og:type: website
og:title: Kit: Email Marketing Automation & Newsletter Growth Engine for Creators (formerly ConvertKit)
og:description: Kit (formerly ConvertKit) is the creator-first email marketing and newsletter platform. Grow your audience, automate campaigns, and sell without burnout.
og:url: https://kit.com/
og:site_name: Kit
og:updated_time: 2026-04-23T11:21:47-07:00
og:image: https://media.kit.com/page/kit-email-marketing-that-automates-growth.jpg
og:image:secure_url: https://media.kit.com/page/kit-email-marketing-that-automates-growth.jpg
og:image:width: 1200
og:image:height: 630
og:image:alt: convertkit
og:image:type: image/jpeg
twitter:card: summary_large_image
twitter:title: Kit: Email Marketing Automation & Newsletter Growth Engine for Creators (formerly ConvertKit)
twitter:description: Kit (formerly ConvertKit) is the creator-first email marketing and newsletter platform. Grow your audience, automate campaigns, and sell without burnout.
twitter:site: @kit
twitter:creator: @kit

fetched 2026-05-23T09:21:05.853Z

web-surface

info

Open standalone →

inspecting web surface…

dnssec

low

Open standalone →

DNSSEC not configured — no DS or DNSKEY records found

Why it matters: DNSSEC cryptographically signs DNS responses, blocking cache-poisoning attacks. US federal civilian agencies are required to enable it under OMB M-22-09 (NIST SC-20).

Recommendations

Enable DNSSEC in your DNS provider's control panel and add the resulting DS record at your registrar

enabled: no
DS records: —
DNSKEY records: —

fetched 2026-05-23T09:21:05.639Z

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

not applicable: no _mta-sts TXT record

Why it matters: MTA-STS forces inbound SMTP to use TLS and refuse downgraded connections. Without it, an in-path attacker can strip TLS and read mail in plaintext (SOC 2 CC6.7).

no _mta-sts TXT record

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

not applicable: no TLSRPT record

Why it matters: TLS-RPT publishes a reporting address for SMTP-TLS failures. Without it, downgrade attacks on inbound mail go unnoticed (SOC 2 CC7.2).

no TLSRPT record

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

domain registered until 2028-01-16

Why it matters: Registrar and expiry tell auditors the domain is owned, current, and not about to lapse. An expired or about-to-expire domain fails business-continuity evidence (SOC 2 A1.2).

registrar: 1API GmbH
created: 2013-01-16T19:35:48Z
expires: 2028-01-16T19:35:48Z
statuses: clientTransferProhibited https://icann.org/epp#clientTransferProhibited

fetched 2026-05-23T09:21:05.982Z

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

check failed: crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

Why it matters: Every certificate issued for this domain is published in Certificate Transparency logs — including subdomains you may have forgotten. Unknown subdomains in CT are pre-disclosed attack surface (ISO 27001 A.8.16).

crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.