ec.europa.eu

15-check dossier · scoreboard above, section details below

Get a pack →

Scanning…

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

resolving mx…

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

resolving dmarc…

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

tracing redirects…

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

inspecting web surface…

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.

ec.europa.eu

15-check dossier · scoreboard above, section details below

Get a pack →

A-

Audit-ready · 4 minor advisories

Aggregate grade across 15 checks. Auditors typically flag any High-severity finding.

Pass: 11
Warn: 4
Fail: 0

What an auditor would flag first

low
DKIM
2/6 DKIM selectors valid
SOC 2 CC6.7
low
TLS certificate
cert expires in 76 days
SOC 2 CC6.6ISO 27001 A.13.1.1
low
Security headers
3 security header(s) missing
SOC 2 CC6.6ISO 27001 A.14.1.2

Need this as an artifact your auditor can verify?

Your ec.europa.eu scan flagged 4 low findings. A signed pack covers the apex plus up to 100 CT-discovered subdomains, Ed25519-signed and ISO-timestamped, delivered in 10–30 minutes.

Get a pack →See methodology See a sample$29

Scanning…

15-check summary

DNS recordsA/AAAA records present
MX2 MX record(s) present
SPF-all hardfail — strict policy
DMARCp=reject — strict policy
DKIM2/6 DKIM selectors valid
TLS certificatecert expires in 76 days
Redirect chainHTTPS served correctly
Security headers3 security header(s) missing
CORSno CORS headers — cross-origin requests blocked by default
Web surfaceHTTPS surface reachable (robots ✓, sitemap ✓, title ✓)
MTA-STSnot applicable: no _mta-sts TXT record
TLS-RPTnot applicable: no TLSRPT record
DNSSECDNSSEC not configured — no DS or DNSKEY records found
WHOISnot applicable: whois returned no data and RDAP fallback unavailable (registry refused or unmapped TLD)
Certificate Transparencycheck failed: crt.sh: Error: crt.sh http 502; certspotter: Error: certspotter http 429

dns

info

Open standalone →

A/AAAA records present

Why it matters: Without authoritative A or AAAA records on the apex, the domain is unreachable. Missing baseline DNS shows up in vendor reviews as evidence of unmanaged infrastructure (SOC 2 CC6.6).

A: ttl=187 147.67.210.30
ttl=187 147.67.34.30
AAAA: ttl=300 2a01:7080:14:100::666:30
ttl=300 2a01:7080:24:100::666:30
NS: —
SOA: —
CAA: —
TXT: ttl=600 "MS=ms93839866"
ttl=600 "apple-domain-verification=0zqmupc9IJswQan3"
ttl=600 "DN6kiCaIRHg011SWPd/y5wK0nF1lAB0vxkimTgK6YHQ="
ttl=600 "anthropic-domain-verification-w18fn5=aCZHCSXAOr6mwQB6zAVj4LGSJ"
ttl=600 "yahoo-verification-key=mIbs1g4mUnS9N9xQpPywHyyQ462sU/5p7+ObnIeT6QE="
ttl=600 "google-site-verification=Hf3TsilSdPh4WhYu26eFxy_8pIrtGVdDgqbAdjbbAw8"
ttl=600 "google-site-verification=eyHX1dZlZS9ZXUW4486Y8_HpDHE1ubuzInqkzRjnVBE"
ttl=600 "globalsign-domain-verification=U-m3rn1OpP3XdBtI6G_e7kKw156XwchHbjmX3n0iKq"
ttl=600 "v=spf1 include:_spf.tech.ec.europa.eu include:_spf-jrc.tech.ec.europa.eu -all"
ttl=600 "cisco-ci-domain-verification=d9a4e5f569f0c36f811a4eb618d520d8d73a90beac438e9234a915465c56a2"
ttl=600 "cisco-ci-domain-verification=71375d94308e5d9c151ed03fb38e6e7c40081021ffaad12391a0797f3487236f"
ttl=600 "atlassian-domain-verification=CdVasMY4c9BTCt8IJvPUjKbyz8YkV095KyECi5dLyhg481LAhkwutfFJHSjULhnx"
ttl=600 "atlassian-domain-verification=Sn5ZgXoanhUhLAap/3tkBbsCa4Kag0SfkSMmpJX8piK6/NsGjt5l7QJZYiDlhYh7"

fetched 2026-05-23T10:45:08.474Z

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

2 MX record(s) present

Why it matters: MX records direct inbound mail. Misconfiguration silently breaks email delivery and lets attackers stand up parallel MX hosts for spoofing campaigns (ISO 27001 A.8.21).

pri=10 mxa-00244802.gslb.pphosted.com.
pri=10 mxb-00244802.gslb.pphosted.com.

fetched 2026-05-23T10:45:08.403Z

mx

info

Open standalone →

resolving mx…

spf

info

Open standalone →

-all hardfail — strict policy

Why it matters: SPF tells receiving servers which hosts may send mail for the domain. Without it, any sender can forge the envelope-from — the primary mechanism behind business-email-compromise (SOC 2 CC6.7).

v=spf1 include:_spf.tech.ec.europa.eu include:_spf-jrc.tech.ec.europa.eu -all

v=spf1
include:_spf.tech.ec.europa.eu
include:_spf-jrc.tech.ec.europa.eu
-all

fetched 2026-05-23T10:45:08.464Z

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

p=reject — strict policy

Why it matters: DMARC binds SPF and DKIM into an enforceable policy (quarantine or reject) and surfaces spoofing attempts via aggregate reports. `p=none` or absent means spoofing succeeds silently (SOC 2 CC6.7).

v=DMARC1; p=reject; rua=mailto:swtyii6t@ag.eu.dmarcadvisor.com; adkim=s; aspf=s

v=: DMARC1
p=: reject
rua=: mailto:swtyii6t@ag.eu.dmarcadvisor.com
adkim=: s
aspf=: s

fetched 2026-05-23T10:45:08.472Z

dmarc

info

Open standalone →

resolving dmarc…

dkim

low

Open standalone →

2/6 DKIM selectors valid

Why it matters: DKIM signs outbound mail so receivers can detect tampering. Missing selectors or rotated-away keys break DMARC alignment and let receivers downgrade trust (ISO 27001 A.8.24).

Recommendations

Check the missing selectors in your DNS provider and re-add any removed records

default:: —
google:: —
k1:: —
selector1:: v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDc/f0RHHBab4h8I+21ORmBu+5Xr5b7DcJy4rpxZvWLhlrHkSsAiT60mOGSe+vP9EVS/spNIQnqfaaSHJV00GlgC/LxI9tKSZrQYA/aiOMxYGWS1BTW1FaJ3Qi7prnXVj6F9oTxHQuQOlfgtkivvTlNSRTmXG0UYrV2HfPesxlILQIDAQAB; n=1024,1450241856,1466053056
selector2:: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuD+vmHLitsjYaCH9BTd8B0LS55BVhOyizi6QXPSEoV95YskxPx9zdUe26FcWijqmCbCHZPliCy1uMxUuEHRJOoU4JQpgG4d1uOZ18g94M2v4gpoNxUf26uVChb+/v8QCwmF+cEqSU1C0AvUwwhZIQ7hcOtt7hD8tzK7cVVUN6YQi+bQpnTwLbqcX6y0LbnMSJui/iusxPBZ6LgsxhFEMRto8mYdRCMvsj4G8oOvxYMh65Q43dzR7OeekQQ67B7b8vjz7UvtVdN2MajTAzKEejjEjJ588252iFYpAGNic5NP8aa6RKu+qXvFUDOTiNm+BW5yELXPSzpqEM8PdJnSChQIDAQAB;
mxvault:: —

fetched 2026-05-23T10:45:08.462Z

dkim

info

Open standalone →

probing dkim selectors…

tls

low

Open standalone →

cert expires in 76 days

Why it matters: A valid current TLS certificate is the baseline for data in transit. Expiry, weak chain, or hostname mismatch break HTTPS and fail PCI 4.2.1 / SOC 2 CC6.1.

Recommendations

Schedule certificate renewal — consider enabling auto-renewal

subject cn:: *.ec.europa.eu
issuer:: GlobalSign Atlas R3 OV TLS CA 2025 Q3 / GlobalSign nv-sa
valid:: Jul 31 13:10:56 2025 GMT → Aug 7 13:10:56 2026 GMT
authorized:: yes
sha256:: B9:9A:67:0E:49:59:E2:B7:22:14:B0:95:FD:7A:5B:AB:4D:3A:EB:7C:AF:04:A2:6F:B2:21:AE:86:B7:FD:60:74
sans: *.ec.europa.eu
ec.europa.eu

fetched 2026-05-23T10:45:08.525Z

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

HTTPS served correctly

Why it matters: Bare HTTP requests must redirect to HTTPS without dropping the user mid-chain. Plain-text fallback or open redirects fail PCI 4.2.1 and feed phishing chains (SOC 2 CC6.6).

final status: 200 · 2 hops

[301] https://ec.europa.eu/
[200] https://commission.europa.eu/select-language?destination=/node/1

fetched 2026-05-23T10:45:08.648Z

redirects

info

Open standalone →

tracing redirects…

headers

low

Open standalone →

3 security header(s) missing

Why it matters: Security headers — HSTS, CSP, X-Frame-Options, Referrer-Policy — defend against XSS, clickjacking, and downgrade attacks. Absent headers map directly to OWASP ASVS V14 findings (ISO 27001 A.8.23).

Recommendations

Add response header — Content-Security-Policy: default-src 'self' (tune per app)
Add response header — Referrer-Policy: strict-origin-when-cross-origin
Add permissions-policy response header

final url: https://commission.europa.eu/select-language?destination=/node/1

security headers

strict-transport-security: max-age=31536000; includeSubDomains; preload;
content-security-policy: —
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
referrer-policy: —
permissions-policy: —

other headers

accept-ranges: bytes
age: 252
cache-control: public, max-age=300, s-maxage=300
connection: keep-alive
content-encoding: gzip
content-language: en
content-length: 3333
content-type: text/html; charset=UTF-8
date: Sat, 23 May 2026 10:40:56 GMT
expires: Sun, 19 Nov 1978 05:00:00 GMT
vary: Accept-Encoding
via: 1.1 95ad9d4dc596fb803e3114c8dbdc4b60.cloudfront.net (CloudFront)
x-age: 9801
x-amz-cf-id: tWxLeElRuYK2alQ3Jj61Nibb8PBEbgsbnkDn6ij1oTxkju9JDDgPjQ==
x-amz-cf-pop: IAD61-P1
x-cache: Hit from cloudfront
x-fpfis: 416940359 305285057

fetched 2026-05-23T10:45:08.649Z

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

no CORS headers — cross-origin requests blocked by default

Why it matters: Overly permissive CORS (wildcard with credentials, or reflected origin) lets any origin read authenticated responses from this domain. OWASP A05 misconfiguration territory (NIST AC-4).

origin: https://drwho.me
method: GET
preflight status: 301

access-control-* headers

access-control-allow-origin: —
access-control-allow-methods: —
access-control-allow-headers: —
access-control-allow-credentials: —
access-control-max-age: —
access-control-expose-headers: —

no access-control-* headers returned — site does not advertise CORS to this origin

fetched 2026-05-23T10:45:08.674Z

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

HTTPS surface reachable (robots ✓, sitemap ✓, title ✓)

Why it matters: Public files — robots.txt, sitemap.xml, head meta — are what attackers see first during reconnaissance. Misadvertised paths, stale sitemaps, and verbose generators leak more than intended (ISO 27001 A.8.9).

robots.txt

present

#EC.EUROPA.EU ROBOTS.TXT

#BAIDUSPIDER
#Connect 22/02/2016 [IM0014473437]
User-agent: Baiduspider
Disallow: /eurostat/tgm/
Disallow: /europeaid/prag/

#TWITTERBOT
#Connect
User-agent: Twitterbot
Allow: /digital-single-market/en/files
Allow: /digital-single-market/files
Allow: /digital-single-market/sites/
Allow: /digital-single-market/en/sites/

#ALL AGENTS
User-agent: *
Disallow: /archives/
Disallow: /cgi-bin/
Disallow: /clima/ets/
Disallow: /clima/sites/registry/
Disallow: /commission_2010-2014/katainen/
Disallow: /creative-europe/404_en.htm
Disallow: /culture/404_en.htm
Disallow: /dgs/education_culture/404_en.htm
Disallow: /eclas/
Disallow: /education/404_en.htm
Disallow: /employment_social/anticipedia/xwiki/bin/attach/
Disallow: /employment_social/anticipedia/xwiki/bin/cancel/
Disallow: /employment_social/anticipedia/xwiki/bin/commentadd/
Disallow: /employment_social/anticipedia/xwiki/bin/delattachment/
Disallow: /employment_social/anticipedia/xwiki/bin/delete/
Disallow: /employment_social/anticipedia/xwiki/bin/dot/
Disallow: /employment_social/anticipedia/xwiki/bin/download/
Disallow: /employment_social/anticipedia/xwiki/bin/downloadrev/
Disallow: /employment_social/anticipedia/xwiki/bin/edit/
Disallow: /employment_social/anticipedia/xwiki/bin/export/
Disallow: /employment_social/anticipedia/xwiki/bin/inline/
Disallow: /employment_social/anticipedia/xwiki/bin/lifeblog/
Disallow: /employment_social/anticipedia/xwiki/bin/login/
Disallow: /employment_social/anticipedia/xwiki/bin/loginerror/
Disallow: /employment_social/anticipedia/xwiki/bin/logout/
Disallow: /employment_social/anticipedia/xwiki/bin/objectremove/
Disallow: /employment_social/anticipedia/xwiki/bin/pdf/
Disallow: /employment_social/anticipedia/xwiki/bin/preview/
Disallow: /employment_social/anticipedia/xwiki/bin/propadd/
Disallow: /employment_social/anticipedia/xwiki/bin/propdelete/
Disallow: /employment_social/anticipedia/xwiki/bin/propupdate/
Disallow: /employment_social/anticipedia/xwiki/bin/register/
Disallow: /employment_social/anticipedia/xwiki/bin/save/
Disallow: /employment_social/anticipedia/xwiki/bin/skin/
Disallow: /employment_social/anticipedia/xwiki/bin/status/
Disallow: /employment_social/anticipedia/xwiki/bin/upload/
Disallow: /employment_social/anticipedia/xwiki/bin/viewattachrev/
Disallow: /employment_social/anticipedia/xwiki/bin/viewrev/
Disallow: /employment_social/anticipedia/xwiki/bin/xmlrpc/
Disallow: /environment/ets/
Disallow: /erasmus-plus/404_en.htm
Disallow: /eurostat/SDMX/diss-web/rest/
Disallow: /fisheries/fleet/
Disallow: /languages/404_en.htm
Disallow: /research/participants/cofund/
Disallow: /sport/404_en.htm
Disallow: /taxation_customs/dds2/col/
Disallow: /taxation_customs/dds2/ebti/
Disallow: /taxation_customs/dds2/ecics/
Disallow: /taxation_customs/dds2/taric/
Disallow: /youth/404_en.htm
Disallow: /food/archive/
Disallow: /consumers/archive/
Disallow: /transparencyregister/public/staticPage/displayStaticPage.do
Disallow: /transparencyregister/public/consultation/search.do
Disallow: /transparencyregister/public/consultation/reportControllerPager.do
Disallow: /europeaid/companion/
Disallow: /transparencyregister/
Disallow: /transparencyinitiative/

#Clima, education, eurostat and others
Disallow: /eurostat/tgm/
Disallow: /clima/ets/
Disallow: /clima/sites/registry/
Disallow: /commission_2010-2014/katainen/
Disallow: /creative-europe/404_en.htm
Disallow: /culture/404_en.htm
Disallow: /dgs/education_culture/404_en.htm
Disallow: /eclas/
Disallow: /education/404_en.htm
Disallow: /youth/404_en.htm
Disallow: /environment/ets/
Disallow: /erasmus-plus/404_en.htm
Disallow: /eurostat/SDMX/diss-web/rest/
Disallow: /fisheries/fleet/
Disallow: /languages/404_en.htm
Disallow: /research/participants/cofund/
Disallow: /sport/404_en.htm

#Employment
Disallow: /employment_social/anticipedia/xwiki/bin/attach/
Disallow: /employment_social/anticipedia/xwiki/bin/cancel/
Disallow: /employment_social/anticipedia/xwiki/bin/commentadd/
Disallow: /employment_social/anticipedia/xwiki/bin/delattachment/
Disallow: /employment_social/anticipedia/xwiki/b

sitemap.xml

present — 4 url(s)

head

title: Language selection | European Commission
description: The official website of the European Commission, providing access to information about its political priorities, policies and services

social

og:determiner: auto
og:site_name: European Commission
og:type: website
og:url: https://commission.europa.eu/index_en
og:title: European Commission, official website
og:description: The official website of the European Commission, providing access to information about its political priorities, policies and services
og:image: https://commission.europa.eu/profiles/contrib/ewcms/modules/ewcms_seo/assets/images/ec-socialmedia-fallback.png
og:image:alt: European Commission
twitter:card: summary_large_image
twitter:description: The official website of the European Commission, providing access to information about its political priorities, policies and services
twitter:title: European Commission, official website
twitter:image: https://commission.europa.eu/profiles/contrib/ewcms/modules/ewcms_seo/assets/images/ec-socialmedia-fallback.png
twitter:image:alt: European Commission

fetched 2026-05-23T10:45:08.682Z

web-surface

info

Open standalone →

inspecting web surface…

dnssec

low

Open standalone →

DNSSEC not configured — no DS or DNSKEY records found

Why it matters: DNSSEC cryptographically signs DNS responses, blocking cache-poisoning attacks. US federal civilian agencies are required to enable it under OMB M-22-09 (NIST SC-20).

Recommendations

Enable DNSSEC in your DNS provider's control panel and add the resulting DS record at your registrar

enabled: no
DS records: —
DNSKEY records: —

fetched 2026-05-23T10:45:08.406Z

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

not applicable: no _mta-sts TXT record

Why it matters: MTA-STS forces inbound SMTP to use TLS and refuse downgraded connections. Without it, an in-path attacker can strip TLS and read mail in plaintext (SOC 2 CC6.7).

no _mta-sts TXT record

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

not applicable: no TLSRPT record

Why it matters: TLS-RPT publishes a reporting address for SMTP-TLS failures. Without it, downgrade attacks on inbound mail go unnoticed (SOC 2 CC7.2).

no TLSRPT record

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

not applicable: whois returned no data and RDAP fallback unavailable (registry refused or unmapped TLD)

Why it matters: Registrar and expiry tell auditors the domain is owned, current, and not about to lapse. An expired or about-to-expire domain fails business-continuity evidence (SOC 2 A1.2).

whois returned no data and RDAP fallback unavailable (registry refused or unmapped TLD)

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

check failed: crt.sh: Error: crt.sh http 502; certspotter: Error: certspotter http 429

Why it matters: Every certificate issued for this domain is published in Certificate Transparency logs — including subdomains you may have forgotten. Unknown subdomains in CT are pre-disclosed attack surface (ISO 27001 A.8.16).

crt.sh: Error: crt.sh http 502; certspotter: Error: certspotter http 429

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.