expressvpn.com

15-check dossier · scoreboard above, section details below

Get a pack →

Scanning…

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

resolving mx…

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

resolving dmarc…

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

tracing redirects…

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

inspecting web surface…

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.

expressvpn.com

15-check dossier · scoreboard above, section details below

Get a pack →

1 high-severity finding · 5 items need attention in total

Aggregate grade across 15 checks. Auditors typically flag any High-severity finding.

Pass: 10
Warn: 4
Fail: 1

What an auditor would flag first

high
SPF
no SPF record — phishing risk
SOC 2 CC6.7ISO 27001 A.13.2.1
low
DMARC
p=quarantine — receivers send to spam
SOC 2 CC6.7ISO 27001 A.13.2.1
low
DKIM
no DKIM selectors found — likely not configured
SOC 2 CC6.7

Need this as an artifact your auditor can verify?

Your expressvpn.com scan flagged 1 high and 4 low findings. A signed pack covers the apex plus up to 100 CT-discovered subdomains, Ed25519-signed and ISO-timestamped, delivered in 10–30 minutes.

Get a pack →See methodology See a sample$29

Scanning…

15-check summary

DNS recordsA/AAAA records present
MX5 MX record(s) present
SPFno SPF record — phishing risk
DMARCp=quarantine — receivers send to spam
DKIMno DKIM selectors found — likely not configured
TLS certificatecert valid for 142 days
Redirect chainHTTPS served correctly
Security headers2 security header(s) missing
CORSno CORS headers — cross-origin requests blocked by default
Web surfaceHTTPS surface reachable (robots ✓, sitemap ✗, title ✓)
MTA-STSnot applicable: no _mta-sts TXT record
TLS-RPTnot applicable: no TLSRPT record
DNSSECDNSSEC not configured — no DS or DNSKEY records found
WHOISdomain registered until 2029-09-21
Certificate Transparencycheck failed: crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

dns

info

Open standalone →

A/AAAA records present

Why it matters: Without authoritative A or AAAA records on the apex, the domain is unreachable. Missing baseline DNS shows up in vendor reviews as evidence of unmanaged infrastructure (SOC 2 CC6.6).

A: ttl=60 13.226.238.4
ttl=60 13.226.238.125
ttl=60 13.226.238.116
ttl=60 13.226.238.97
AAAA: —
NS: ttl=171459 ns-1198.awsdns-21.org.
ttl=171459 ns-1588.awsdns-06.co.uk.
ttl=171459 ns-373.awsdns-46.com.
ttl=171459 ns-910.awsdns-49.net.
SOA: ttl=900 ns-373.awsdns-46.com. awsdns-hostmaster.amazon.com. 1 7200 900 1209600 86400
CAA: ttl=300 \# 17 00 05 69 73 73 75 65 61 6d 61 7a 6f 6e 2e 63 6f 6d
ttl=300 \# 20 00 05 69 73 73 75 65 61 6d 61 7a 6f 6e 61 77 73 2e 63 6f 6d
ttl=300 \# 22 00 05 69 73 73 75 65 61 6d 61 7a 6f 6e 74 72 75 73 74 2e 63 6f 6d
ttl=300 \# 19 00 05 69 73 73 75 65 61 77 73 74 72 75 73 74 2e 63 6f 6d
ttl=300 \# 17 00 05 69 73 73 75 65 63 6f 6d 6f 64 6f 2e 63 6f 6d
ttl=300 \# 19 00 05 69 73 73 75 65 63 6f 6d 6f 64 6f 63 61 2e 63 6f 6d
ttl=300 \# 18 00 05 69 73 73 75 65 67 6f 64 61 64 64 79 2e 63 6f 6d
ttl=300 \# 41 00 05 69 73 73 75 65 70 6b 69 2e 67 6f 6f 67 3b 20 63 61 6e 73 69 67 6e 68 74 74 70 65 78 63 68 61 6e 67 65 73 3d 79 65 73
ttl=300 \# 21 00 09 69 73 73 75 65 77 69 6c 64 61 6d 61 7a 6f 6e 2e 63 6f 6d
ttl=300 \# 24 00 09 69 73 73 75 65 77 69 6c 64 61 6d 61 7a 6f 6e 61 77 73 2e 63 6f 6d
ttl=300 \# 26 00 09 69 73 73 75 65 77 69 6c 64 61 6d 61 7a 6f 6e 74 72 75 73 74 2e 63 6f 6d
ttl=300 \# 23 00 09 69 73 73 75 65 77 69 6c 64 61 77 73 74 72 75 73 74 2e 63 6f 6d
ttl=300 \# 45 00 09 69 73 73 75 65 77 69 6c 64 70 6b 69 2e 67 6f 6f 67 3b 20 63 61 6e 73 69 67 6e 68 74 74 70 65 78 63 68 61 6e 67 65 73 3d 79 65 73
TXT: ttl=300 "1s7j2dj658h9v9vap9mv83ppjd"
ttl=300 "ahrefs-site-verification_42735181f791498cb245b2f6716ab10ec9792d71d2c1cac28563917281a41108"
ttl=300 "atlassian-domain-verification=AsiGSJlMQ6GNhZSMVSyt+gEq2IClyv/rDtsdXhzMmSZIiDuo0RRTWrhkye/IRN9D"
ttl=300 "qsv8s0j2tkqt0dces3jms1ctcb"

fetched 2026-05-23T09:26:09.699Z

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

5 MX record(s) present

Why it matters: MX records direct inbound mail. Misconfiguration silently breaks email delivery and lets attackers stand up parallel MX hosts for spoofing campaigns (ISO 27001 A.8.21).

pri=1 aspmx.l.google.com.
pri=5 alt1.aspmx.l.google.com.
pri=5 alt2.aspmx.l.google.com.
pri=10 aspmx2.googlemail.com.
pri=10 aspmx3.googlemail.com.

fetched 2026-05-23T09:26:09.566Z

mx

info

Open standalone →

resolving mx…

spf

high

Open standalone →

no SPF record — phishing risk

Why it matters: SPF tells receiving servers which hosts may send mail for the domain. Without it, any sender can forge the envelope-from — the primary mechanism behind business-email-compromise (SOC 2 CC6.7).

Recommendations

Publish a TXT record: v=spf1 include:<your-provider> -all
Example for Google Workspace: v=spf1 include:_spf.google.com -all

no SPF record

spf

info

Open standalone →

resolving spf…

dmarc

low

Open standalone →

p=quarantine — receivers send to spam

Why it matters: DMARC binds SPF and DKIM into an enforceable policy (quarantine or reject) and surfaces spoofing attempts via aggregate reports. `p=none` or absent means spoofing succeeds silently (SOC 2 CC6.7).

Recommendations

Upgrade to p=reject once your SPF and DKIM pass rates are consistently high

v=DMARC1; p=quarantine; rua=mailto:re+jwljp6xhmy8@dmarc.postmarkapp.com,mailto:postmaster@expressvpn.com;

v=: DMARC1
p=: quarantine
rua=: mailto:re+jwljp6xhmy8@dmarc.postmarkapp.com,mailto:postmaster@expressvpn.com

fetched 2026-05-23T09:26:09.706Z

dmarc

info

Open standalone →

resolving dmarc…

dkim

low

Open standalone →

no DKIM selectors found — likely not configured

Why it matters: DKIM signs outbound mail so receivers can detect tampering. Missing selectors or rotated-away keys break DMARC alignment and let receivers downgrade trust (ISO 27001 A.8.24).

Recommendations

Enable DKIM signing in your mail provider and publish the provided TXT record
Common selectors: google._domainkey, selector1._domainkey (Microsoft), mail._domainkey

no DKIM record on probed selectors (default, google, k1, selector1, selector2, mxvault)

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

cert valid for 142 days

Why it matters: A valid current TLS certificate is the baseline for data in transit. Expiry, weak chain, or hostname mismatch break HTTPS and fail PCI 4.2.1 / SOC 2 CC6.1.

subject cn:: expressvpn.com
issuer:: Amazon RSA 2048 M01 / Amazon
valid:: Sep 13 00:00:00 2025 GMT → Oct 12 23:59:59 2026 GMT
authorized:: yes
sha256:: 86:67:48:25:E5:E1:2E:7A:A9:75:49:37:E2:D7:29:39:C3:42:95:AF:1D:82:3B:8D:BB:73:F7:5E:9C:43:15:1D
sans: expressvpn.com
www.expressvpn.com

fetched 2026-05-23T09:26:09.490Z

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

HTTPS served correctly

Why it matters: Bare HTTP requests must redirect to HTTPS without dropping the user mid-chain. Plain-text fallback or open redirects fail PCI 4.2.1 and feed phishing chains (SOC 2 CC6.6).

final status: 200 · 2 hops

[301] https://expressvpn.com/
[200] https://www.expressvpn.com/

fetched 2026-05-23T09:26:09.717Z

redirects

info

Open standalone →

tracing redirects…

headers

low

Open standalone →

2 security header(s) missing

Why it matters: Security headers — HSTS, CSP, X-Frame-Options, Referrer-Policy — defend against XSS, clickjacking, and downgrade attacks. Absent headers map directly to OWASP ASVS V14 findings (ISO 27001 A.8.23).

Recommendations

Add response header — Content-Security-Policy: default-src 'self' (tune per app)
Add permissions-policy response header

final url: https://www.expressvpn.com/

security headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: —
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
referrer-policy: no-referrer-when-downgrade
permissions-policy: —

other headers

age: 6786
cache-control: max-age=3600, stale-while-revalidate, stale-if-error
connection: keep-alive
content-encoding: gzip
content-type: text/html
date: Sat, 23 May 2026 07:33:04 GMT
etag: W/"97ee356d75992cc7abf4cdf51e05c571"
last-modified: Thu, 21 May 2026 10:37:54 GMT
server: AmazonS3
set-cookie: xvldflags=%7B%22homepage%22%3A%22%2Fhomepage-value-control%22%7D; Path=/; Secure; SameSite=Lax; Max-Age=31536000; Domain=.expressvpn.com
transfer-encoding: chunked
vary: Accept-Encoding
via: 1.1 e268ddb03ed9480c5c602c27323a81ea.cloudfront.net (CloudFront), 1.1 db8c74a249442b107d8358be4371339e.cloudfront.net (CloudFront)
x-amz-cf-id: EYJbw93fK0noqdJMtBwJVYh3h5ivpRpHQ-oBkyxlwUGnMVUN71sOLQ==
x-amz-cf-pop: IAD12-P1, IAD12-P4
x-cache: Miss from cloudfront
x-xss-protection: 1; mode=block

fetched 2026-05-23T09:26:09.704Z

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

no CORS headers — cross-origin requests blocked by default

Why it matters: Overly permissive CORS (wildcard with credentials, or reflected origin) lets any origin read authenticated responses from this domain. OWASP A05 misconfiguration territory (NIST AC-4).

origin: https://drwho.me
method: GET
preflight status: 403

access-control-* headers

access-control-allow-origin: —
access-control-allow-methods: —
access-control-allow-headers: —
access-control-allow-credentials: —
access-control-max-age: —
access-control-expose-headers: —

no access-control-* headers returned — site does not advertise CORS to this origin

fetched 2026-05-23T09:26:09.571Z

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

HTTPS surface reachable (robots ✓, sitemap ✗, title ✓)

Why it matters: Public files — robots.txt, sitemap.xml, head meta — are what attackers see first during reconnaissance. Misadvertised paths, stale sitemaps, and verbose generators leak more than intended (ISO 27001 A.8.9).

robots.txt

present

User-agent: *
Disallow: /blog/tag/
Disallow: /blog/?s=*
Disallow: /*/blog/?s=*
Disallow: /support/?s=*
Disallow: /*/support/?s=*
Disallow: /feed/
Disallow: /clients/
Disallow: /*?*offer=*
Disallow: /*&offer=*
Disallow: /*?*s=*
Disallow: /*&s=*
Disallow: /*?*serial_number=*
Disallow: /*&serial_number=*
Disallow: /*?*locale=*
Disallow: /*&locale=*
Disallow: /*?*msclkid=*
Disallow: /*&msclkid=*
Disallow: /*?*gad_source=*
Disallow: /*&gad_source=*
Disallow: /*?*xwsid=*
Disallow: /*&xwsid=*
Disallow: /wp-ws/themes/expressvpn/track/
Disallow: /_new/
User-agent: Googlebot
Disallow: /blog/tag/
Disallow: /blog/?s=*
Disallow: /*/blog/?s=*
Disallow: /support/?s=*
Disallow: /*/support/?s=*
Disallow: /feed/
Disallow: /clients/
Disallow: /*?*offer=*
Disallow: /*&offer=*
Disallow: /*?*s=*
Disallow: /*&s=*
Disallow: /*?*serial_number=*
Disallow: /*&serial_number=*
Disallow: /*?*locale=*
Disallow: /*&locale=*
Disallow: /*?*msclkid=*
Disallow: /*&msclkid=*
Disallow: /*?*gad_source=*
Disallow: /*&gad_source=*
Disallow: /*?*xwsid=*
Disallow: /*&xwsid=*
Disallow: /wp-ws/themes/expressvpn/track/
User-agent: Yeti
Allow: /
User-agent: Naverbot
Allow: /
User-agent: ia_archiver
Disallow: /
Sitemap: https://www.expressvpn.com/sitemap_index_en.xml
Sitemap: https://www.expressvpn.com/de/sitemap_index_de.xml
Sitemap: https://www.expressvpn.com/es/sitemap_index_es.xml
Sitemap: https://www.expressvpn.com/pt/sitemap_index_pt.xml
Sitemap: https://www.expressvpn.com/fr/sitemap_index_fr.xml
Sitemap: https://www.expressvpn.com/it/sitemap_index_it.xml
Sitemap: https://www.expressvpn.com/pl/sitemap_index_pl.xml
Sitemap: https://www.expressvpn.com/ro/sitemap_index_ro.xml
Sitemap: https://www.expressvpn.com/ru/sitemap_index_ru.xml
Sitemap: https://www.expressvpn.com/nl/sitemap_index_nl.xml
Sitemap: https://www.expressvpn.com/jp/sitemap_index_jp.xml
Sitemap: https://www.expressvpn.com/kr/sitemap_index_kr.xml
Sitemap: https://www.expressvpn.com/se/sitemap_index_se.xml
Sitemap: https://www.expressvpn.com/tr/sitemap_index_tr.xml
Sitemap: https://www.expressvpn.com/dk/sitemap_index_dk.xml
Sitemap: https://www.expressvpn.com/th/sitemap_index_th.xml
Sitemap: https://www.expressvpn.com/ar/sitemap_index_ar.xml
Sitemap: https://www.expressvpn.com/no/sitemap_index_no.xml
Sitemap: https://www.expressvpn.com/hu/sitemap_index_hu.xml
Sitemap: https://www.expressvpn.com/cs/sitemap_index_cs.xml
Sitemap: https://www.expressvpn.com/fi/sitemap_index_fi.xml
Sitemap: https://www.expressvpn.com/id/sitemap_index_id.xml
Sitemap: https://www.expressvpn.com/vn/sitemap_index_vn.xml
Sitemap: https://www.expressvpn.com/ua/sitemap_index_ua.xml

sitemap.xml

absent

head

title: ExpressVPN: Best VPN Service for Speed & Privacy in 2026
description: —

social

no OpenGraph or Twitter meta tags found

fetched 2026-05-23T09:26:10.414Z

web-surface

info

Open standalone →

inspecting web surface…

dnssec

low

Open standalone →

DNSSEC not configured — no DS or DNSKEY records found

Why it matters: DNSSEC cryptographically signs DNS responses, blocking cache-poisoning attacks. US federal civilian agencies are required to enable it under OMB M-22-09 (NIST SC-20).

Recommendations

Enable DNSSEC in your DNS provider's control panel and add the resulting DS record at your registrar

enabled: no
DS records: —
DNSKEY records: —

fetched 2026-05-23T09:26:09.716Z

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

not applicable: no _mta-sts TXT record

Why it matters: MTA-STS forces inbound SMTP to use TLS and refuse downgraded connections. Without it, an in-path attacker can strip TLS and read mail in plaintext (SOC 2 CC6.7).

no _mta-sts TXT record

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

not applicable: no TLSRPT record

Why it matters: TLS-RPT publishes a reporting address for SMTP-TLS failures. Without it, downgrade attacks on inbound mail go unnoticed (SOC 2 CC7.2).

no TLSRPT record

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

domain registered until 2029-09-21

Why it matters: Registrar and expiry tell auditors the domain is owned, current, and not about to lapse. An expired or about-to-expire domain fails business-continuity evidence (SOC 2 A1.2).

registrar: SafeNames Ltd.
created: 2008-09-21T23:14:12Z
expires: 2029-09-21T23:14:12Z
statuses: clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited, clientTransferProhibited https://icann.org/epp#clientTransferProhibited, clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited, serverDeleteProhibited https://icann.org/epp#serverDeleteProhibited, serverTransferProhibited https://icann.org/epp#serverTransferProhibited, serverUpdateProhibited https://icann.org/epp#serverUpdateProhibited

fetched 2026-05-23T09:26:10.059Z

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

check failed: crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

Why it matters: Every certificate issued for this domain is published in Certificate Transparency logs — including subdomains you may have forgotten. Unknown subdomains in CT are pre-disclosed attack surface (ISO 27001 A.8.16).

crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.