corriere.it

15-check dossier · scoreboard above, section details below

Get a pack →

Scanning…

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

resolving mx…

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

resolving dmarc…

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

tracing redirects…

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

inspecting web surface…

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.

corriere.it

15-check dossier · scoreboard above, section details below

Get a pack →

Mostly compliant · 6 items need attention

Aggregate grade across 15 checks. Auditors typically flag any High-severity finding.

Pass: 9
Warn: 6
Fail: 0

What an auditor would flag first

medium
DMARC
p=none — monitoring only, no enforcement
SOC 2 CC6.7ISO 27001 A.13.2.1
medium
Security headers
4 security header(s) missing
SOC 2 CC6.6ISO 27001 A.14.1.2
low
DKIM
1/6 DKIM selectors valid
SOC 2 CC6.7

Need this as an artifact your auditor can verify?

Your corriere.it scan flagged 2 medium and 4 low findings. A signed pack covers the apex plus up to 100 CT-discovered subdomains, Ed25519-signed and ISO-timestamped, delivered in 10–30 minutes.

Get a pack →See methodology See a sample$29

Scanning…

15-check summary

DNS recordsA/AAAA records present
MX2 MX record(s) present
SPF-all hardfail — strict policy
DMARCp=none — monitoring only, no enforcement
DKIM1/6 DKIM selectors valid
TLS certificatecert expires in 31 days
Redirect chainHTTPS served correctly
Security headers4 security header(s) missing
CORSno CORS headers — cross-origin requests blocked by default
Web surfaceHTTPS surface reachable (robots ✓, sitemap ✗, title ✓)
MTA-STSnot applicable: no _mta-sts TXT record
TLS-RPTnot applicable: no TLSRPT record
DNSSECDNSSEC not configured — no DS or DNSKEY records found
WHOISdomain expires in 73 days — renew soon
Certificate Transparencycheck failed: crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

dns

info

Open standalone →

A/AAAA records present

Why it matters: Without authoritative A or AAAA records on the apex, the domain is unreachable. Missing baseline DNS shows up in vendor reviews as evidence of unmanaged infrastructure (SOC 2 CC6.6).

A: ttl=600 185.53.36.36
AAAA: —
NS: ttl=86400 dnsgeo6.tuonomeregistrar.net.
ttl=86400 dnsgeo5.tuonomeregistrar.com.
ttl=86400 dnsgeo8.tuonomeregistrar.info.
ttl=86400 dnsgeo7.tuonomeregistrar.org.
SOA: ttl=3600 dnsgeo5.tuonomeregistrar.com. staff.tuonomegroup.com. 2026051907 86400 7200 2592000 900
CAA: —
TXT: ttl=600 "google-site-verification=oE0bL4d_XmKfFwXhpjzCiWOhO5kNQqLcE-CKzAKXfYs"
ttl=600 "v=spf1 include:spf.protection.outlook.com -all"
ttl=600 "google-site-verification=moBBsn9HkSgSAbSHHHrgdZk_c7z-hDmqanfl_Pa0ui4"
ttl=600 "SL2snnsPpkx1mM9Mti3lU5dcxETHSZN415qzo7fRBjobeM1zebyQ05IFywdzambSZtYsSPuD6Ya1DAQKwkPEKQ=="
ttl=600 "facebook-domain-verification=iok3ta02xlt4n8g3n1hvvuad158kwx"
ttl=600 "zHBBrDlWN08/X5MgUBzDdrmDA/C4bpQNoO7OaxcwfgTOjUyAS+fL4i6/E3EmiH0BPUxitHmAtuvUS8OOcZokmQ=="
ttl=600 "MS=ms77859102"
ttl=600 "MS=ms87128782"
ttl=600 "facebook-domain-verification=3q6f9ywsu3al2y1ysmfwungpf1tpwx"
ttl=600 "google-site-verification=xCBz5rWEzVt_IqZSztU9clLZMjYKSjAKjqsBgUcTrUk"
ttl=600 "_globalsign-domain-verification=VPemhDee0EKRXi0IPzeSUrn849jHevrjIaTeDYOTZ4"
ttl=600 "facebook-domain-verification=hltsyg1kt8q4ljf7m460qv96i5gru5"

fetched 2026-05-23T09:35:36.802Z

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

2 MX record(s) present

Why it matters: MX records direct inbound mail. Misconfiguration silently breaks email delivery and lets attackers stand up parallel MX hosts for spoofing campaigns (ISO 27001 A.8.21).

pri=0 mxa-005a2501.gslb.pphosted.com.
pri=0 mxb-005a2501.gslb.pphosted.com.

fetched 2026-05-23T09:35:36.586Z

mx

info

Open standalone →

resolving mx…

spf

info

Open standalone →

-all hardfail — strict policy

Why it matters: SPF tells receiving servers which hosts may send mail for the domain. Without it, any sender can forge the envelope-from — the primary mechanism behind business-email-compromise (SOC 2 CC6.7).

v=spf1 include:spf.protection.outlook.com -all

v=spf1
include:spf.protection.outlook.com
-all

fetched 2026-05-23T09:35:36.588Z

spf

info

Open standalone →

resolving spf…

dmarc

medium

Open standalone →

p=none — monitoring only, no enforcement

Why it matters: DMARC binds SPF and DKIM into an enforceable policy (quarantine or reject) and surfaces spoofing attempts via aggregate reports. `p=none` or absent means spoofing succeeds silently (SOC 2 CC6.7).

Recommendations

Review rua= aggregate reports to confirm legitimate mail passes SPF/DKIM
Move to p=quarantine and then p=reject once mail flow is validated

v=DMARC1; p=none; fo=1; rua=mailto:dmarc_rua@emaildefense.proofpoint.com; ruf=mailto:dmarc_ruf@emaildefense.proofpoint.com

v=: DMARC1
p=: none
fo=: 1
rua=: mailto:dmarc_rua@emaildefense.proofpoint.com
ruf=: mailto:dmarc_ruf@emaildefense.proofpoint.com

fetched 2026-05-23T09:35:36.589Z

dmarc

info

Open standalone →

resolving dmarc…

dkim

low

Open standalone →

1/6 DKIM selectors valid

Why it matters: DKIM signs outbound mail so receivers can detect tampering. Missing selectors or rotated-away keys break DMARC alignment and let receivers downgrade trust (ISO 27001 A.8.24).

Recommendations

Check the missing selectors in your DNS provider and re-add any removed records

default:: —
google:: —
k1:: —
selector1:: v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC51vPtDmywitUSMt3SgBm4dHfqA9IDuVVcEmSpa0JYx/+BCnaOHnVJHTNXaqLKjGulOGcvF1YIDPqWuMV8mlKHXjJdZBGdwzyHAeVtQvCznc8pmUXjM2tsp/0T7aOlV9THtmdMZygxFiCscG+vbNsQcVuAIEJZOUGG9ve1fYE8TwIDAQAB; n=1024,1455832094,1471556894
selector2:: —
mxvault:: —

fetched 2026-05-23T09:35:36.611Z

dkim

info

Open standalone →

probing dkim selectors…

tls

low

Open standalone →

cert expires in 31 days

Why it matters: A valid current TLS certificate is the baseline for data in transit. Expiry, weak chain, or hostname mismatch break HTTPS and fail PCI 4.2.1 / SOC 2 CC6.1.

Recommendations

Schedule certificate renewal — consider enabling auto-renewal

subject cn:: corriere.it
issuer:: R12 / Let's Encrypt
valid:: Mar 26 04:17:09 2026 GMT → Jun 24 04:17:08 2026 GMT
authorized:: yes
sha256:: 3E:4C:8B:1C:1C:31:79:21:1F:79:D7:FD:0A:F9:4B:88:B5:CD:EC:E4:A6:D7:75:F5:18:4A:D1:06:F3:14:8F:6A
sans: *.corriere.it
corriere.it

fetched 2026-05-23T09:35:36.848Z

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

HTTPS served correctly

Why it matters: Bare HTTP requests must redirect to HTTPS without dropping the user mid-chain. Plain-text fallback or open redirects fail PCI 4.2.1 and feed phishing chains (SOC 2 CC6.6).

final status: 200 · 2 hops

[301] https://corriere.it/
[200] https://www.corriere.it/

fetched 2026-05-23T09:35:37.103Z

redirects

info

Open standalone →

tracing redirects…

headers

medium

Open standalone →

4 security header(s) missing

Why it matters: Security headers — HSTS, CSP, X-Frame-Options, Referrer-Policy — defend against XSS, clickjacking, and downgrade attacks. Absent headers map directly to OWASP ASVS V14 findings (ISO 27001 A.8.23).

Recommendations

Add response header — Strict-Transport-Security: max-age=15552000; includeSubDomains
Add response header — Content-Security-Policy: default-src 'self' (tune per app)
Add response header — X-Frame-Options: DENY (or SAMEORIGIN if framing is intended)
Add response header — X-Content-Type-Options: nosniff

final url: https://www.corriere.it/

security headers

strict-transport-security: —
content-security-policy: —
x-frame-options: —
x-content-type-options: —
referrer-policy: no-referrer-when-downgrade
permissions-policy: unload=()

other headers

accept-ranges: bytes
age: 4
cache-control: max-age=2, public, s-maxage=5
connection: keep-alive
content-encoding: gzip
content-length: 222048
content-type: text/html; charset=UTF-8
date: Sat, 23 May 2026 09:35:37 GMT
vary: Accept-Encoding
via: 1.1 varnish, 1.1 varnish
x-cache: MISS, HIT, HIT
x-cache-hits: 0, 11, 1
x-served-by: cache-ams2100146-AMS, cache-ams21059-AMS, cache-iad-kcgs7200153-IAD
x-timer: S1779528937.084059,VS0,VE5
x-unique-id: 697c7ef8-99ca-4901-adbb-b5ef5b5d097b, 0294f147-215c-4840-8997-07ad530de812

fetched 2026-05-23T09:35:37.094Z

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

no CORS headers — cross-origin requests blocked by default

Why it matters: Overly permissive CORS (wildcard with credentials, or reflected origin) lets any origin read authenticated responses from this domain. OWASP A05 misconfiguration territory (NIST AC-4).

origin: https://drwho.me
method: GET
preflight status: 301

access-control-* headers

access-control-allow-origin: —
access-control-allow-methods: —
access-control-allow-headers: —
access-control-allow-credentials: —
access-control-max-age: —
access-control-expose-headers: —

no access-control-* headers returned — site does not advertise CORS to this origin

fetched 2026-05-23T09:35:36.947Z

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

HTTPS surface reachable (robots ✓, sitemap ✗, title ✓)

Why it matters: Public files — robots.txt, sitemap.xml, head meta — are what attackers see first during reconnaissance. Misadvertised paths, stale sitemaps, and verbose generators leak more than intended (ISO 27001 A.8.9).

robots.txt

present

# Inizio Bot Exclusion Protocol
User-agent: GPTBot
Disallow: /
User-agent: CCBot
Disallow: /
User-agent: anthropic-ai
Disallow: /
User-agent: AmazonAdBot
Allow: /
User-agent: Google-CloudVertexBot
Disallow: /
User-agent: AppleBot
Disallow: /
User-agent: Google-Extended
Disallow: /
User-agent: Applebot-Extended
Disallow: /
User-agent: ClaudeBot
Disallow: /
User-agent: Amazonbot
Disallow: /
User-agent: Meta-ExternalAgent
Disallow: /
User-agent: PetalBot
Disallow: /
User-agent: Yandex
Disallow: / # prohibits crawling for the entire site
# Fine Bot Exclusion Protocol

User-agent: *
Disallow: *{{data.c.link_offerId}}


Disallow: *(none)
Disallow: *?RedirectUrl
Disallow: /privacy.shtml 
Disallow: /abbonati.Suspended/
Disallow: /corcommunitynew/accesso/LogOut.do
Disallow: /indexMethodeProve.shtml
Disallow: /apw.js
Disallow: /salute/cardiologia/sintomi-infartosintomi-infarto
Disallow: /salute/cardiologia/sintomi-infartoheart-attack-symptoms
Disallow: /salute/cardiologia/sintomi-infartosÃntomas-ataque-cardÃaco
Disallow: /salute/cardiologia/sintomi-infartosymptomes-infarctus
Disallow: /salute/cardiologia/sintomi-infartoÑÐ¸Ð¼Ð¿Ñ‚Ð¾Ð¼Ñ‹-Ð¸Ð½Ñ„Ð°Ñ€ÐºÑ‚Ð°
Disallow: /salute/cardiologia/sintomi-infartoå¿ƒè‚Œæ¢—å¡žç—‡çŠ¶
Disallow: /salute/cardiologia/sintomi-infartoØ·Ø¨ Ø§Ù„Ù‚Ù„Ø¨
Disallow: /salute/cardiologia/sintomi-infartosimptome-de-atac-de-cord
Disallow: /salute/sportello_cancro/jsp/*
Disallow: /corrierecalcio/app/formazione/
Disallow: /preview/
Disallow: /dwc-xalok/
Disallow: /ssi/
Disallow: /tools/
Disallow: /linked_webroots/
Disallow: /english/includes_methode/
Disallow: /includes_methode/
Disallow: /community-corriere/
Disallow: /widget/
Disallow: /dwc/
Disallow: /digital-edition/
Disallow: /correlati/
Disallow: /cinema/icortissimi-ended/
Disallow: /ZCestino/
Disallow: /prova/
Disallow: /test/
Disallow: /landing/wrapped-2023/
Disallow: /test_mf/
Disallow: /piano-511/
Disallow: /b2b/
Disallow: /_template/
Disallow: /_docs/
Disallow: /_temp/
Disallow: /cf/
Disallow: /servizi/
Disallow: /salute/dizionario/dizionarioSearch.jsp
Disallow: /sportello-cancro/dizionario/
Disallow: /dilatua/proRecensione.do
Disallow: /newsletter/nl_economia.html
# vecchia ultima ora
Disallow: /ultima_ora/
#Dizionario della Salute 
Disallow: /salute/dizionario/dizionarioSearch.jsp 
Disallow: /salute/dizionario/pages/results.jsp
Disallow: /cronache/speciali/2010/maturita/test-universita.shtml
Disallow: /smallApp/tellafriend/
Disallow: /*_print.html$
Disallow: /*.xml
Disallow: /account/ 
Allow: /account/login$ 
Disallow: /account/login? 
Disallow: /gallery/*/vuoto.shtml
Disallow: *pwcmp=
Disallow: *reader_id=
Disallow: /cruciverba_old/
Allow:    /salute/il-medico-risponde/sitemap.xml
Allow:    /salute/il-medico-risponde/news/sitemap.xml
Allow: 	  /salute/sitemap-dizionario-corriere-salute.xml
Allow:    /dynamic-sitemap/sitemap-last-100/*.xml
Allow:    /dynamic-feed/*.xml
Allow: 	  /cook*sitemap*.xml
Allow:    /guida-autovelox-e-codice-della-strada/sitemap.xml
Allow:    /radio/$
Allow:    /radio/index.shtml
Allow:    /servizi/$
Allow:    /ultima_ora/agrnews.jsp
Allow:    /showcase/*.xml
Allow:    /economia/chiedi-esperto/sitemap.xml
Allow:    /economia/chiedi-esperto/news/sitemap.xml
Allow:    /sette/speciale-presidenziali-usa-2024-harris-contro-trump/rss/*.xml
Allow:    /dynamic-sitemap/corriere/video/lezioni*sitemap*.xml


# item
Disallow: /corrierepedia
Disallow: /firme/pierluigi-battista_80
Disallow: /cook/ricette/ricerca
Disallow: /CorriereAppNews/
Disallow: /corrierepoint/
Disallow: /index_mobile_tst_hp_mob_b.shtml
Disallow: /*app_v2
Disallow: /*app_v1
Allow: /sitemap*.xml
# Allow: /notizie-ultima-ora/rss_col.xml
Allow: /rss/*.xml
Allow: /salute/sitemap-dizionario.xml
Allow: /rss/ultimora.xml
# Allow: /rss/homepage.xml
Allow: /feed-hp/homepage-restyle-2025.xml
# Allow: /notizie-ultima-ora/sitemap-news.xml
#richiesta da Ruggiero BG27112011
Allow: /editorspicks/
Allow: /oroscopo/sitemap.xml
Allow: /sport/risultati-live/sitemap.xml
Allow: /elezioni/*.xml
Disallow: /*?q=
Disallow: /*?f=
Disallow: /*?s=
Disallow: /*?searchType=
Disallow: /*articleurl=
Dis

sitemap.xml

absent

head

title: Corriere della Sera: News e Ultime notizie in tempo reale da Italia e Mondo
description: —

social

no OpenGraph or Twitter meta tags found

fetched 2026-05-23T09:35:37.253Z

web-surface

info

Open standalone →

inspecting web surface…

dnssec

low

Open standalone →

DNSSEC not configured — no DS or DNSKEY records found

Why it matters: DNSSEC cryptographically signs DNS responses, blocking cache-poisoning attacks. US federal civilian agencies are required to enable it under OMB M-22-09 (NIST SC-20).

Recommendations

Enable DNSSEC in your DNS provider's control panel and add the resulting DS record at your registrar

enabled: no
DS records: —
DNSKEY records: —

fetched 2026-05-23T09:35:36.590Z

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

not applicable: no _mta-sts TXT record

Why it matters: MTA-STS forces inbound SMTP to use TLS and refuse downgraded connections. Without it, an in-path attacker can strip TLS and read mail in plaintext (SOC 2 CC6.7).

no _mta-sts TXT record

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

not applicable: no TLSRPT record

Why it matters: TLS-RPT publishes a reporting address for SMTP-TLS failures. Without it, downgrade attacks on inbound mail go unnoticed (SOC 2 CC7.2).

no TLSRPT record

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

low

Open standalone →

domain expires in 73 days — renew soon

Why it matters: Registrar and expiry tell auditors the domain is owned, current, and not about to lapse. An expired or about-to-expire domain fails business-continuity evidence (SOC 2 A1.2).

Recommendations

Enable auto-renewal at your registrar to avoid accidental expiry

registrar: Tuonome Registrar S.r.l. TUONOMEREGISTRAR-REG
created: 1996-01-29 00:00:00
expires: 2026-08-05
statuses: ok

fetched 2026-05-23T09:35:36.894Z

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

check failed: crt.sh: Error: crt.sh http 404; certspotter: Error: certspotter http 429

Why it matters: Every certificate issued for this domain is published in Certificate Transparency logs — including subdomains you may have forgotten. Unknown subdomains in CT are pre-disclosed attack surface (ISO 27001 A.8.16).

crt.sh: Error: crt.sh http 404; certspotter: Error: certspotter http 429

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.