flickr.com

15-check dossier · scoreboard above, section details below

Get a pack →

Scanning…

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

resolving mx…

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

resolving dmarc…

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

tracing redirects…

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

inspecting web surface…

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.

flickr.com

15-check dossier · scoreboard above, section details below

Get a pack →

Mostly compliant · 5 items need attention

Aggregate grade across 15 checks. Auditors typically flag any High-severity finding.

Pass: 10
Warn: 5
Fail: 0

What an auditor would flag first

medium
SPF
~all softfail — receivers may still accept
SOC 2 CC6.7ISO 27001 A.13.2.1
medium
Security headers
3 security header(s) missing
SOC 2 CC6.6ISO 27001 A.14.1.2
low
DKIM
1/6 DKIM selectors valid
SOC 2 CC6.7

Need this as an artifact your auditor can verify?

Your flickr.com scan flagged 2 medium and 3 low findings. A signed pack covers the apex plus up to 100 CT-discovered subdomains, Ed25519-signed and ISO-timestamped, delivered in 10–30 minutes.

Get a pack →See methodology See a sample$29

Scanning…

15-check summary

DNS recordsA/AAAA records present
MX5 MX record(s) present
SPF~all softfail — receivers may still accept
DMARCp=reject — strict policy
DKIM1/6 DKIM selectors valid
TLS certificatecert valid for 224 days
Redirect chainHTTPS served correctly
Security headers3 security header(s) missing
CORSCORS allows all origins (wildcard)
Web surfaceHTTPS surface reachable (robots ✓, sitemap ✗, title ✓)
MTA-STSnot applicable: no _mta-sts TXT record
TLS-RPTnot applicable: no TLSRPT record
DNSSECDNSSEC not configured — no DS or DNSKEY records found
WHOISdomain registered until 2026-11-22
Certificate Transparencycheck failed: crt.sh: AbortError: This operation was aborted; certspotter: Error: certspotter http 429

dns

info

Open standalone →

A/AAAA records present

Why it matters: Without authoritative A or AAAA records on the apex, the domain is unreachable. Missing baseline DNS shows up in vendor reviews as evidence of unmanaged infrastructure (SOC 2 CC6.6).

A: ttl=60 3.171.38.81
ttl=60 3.171.38.25
ttl=60 3.171.38.106
ttl=60 3.171.38.108
AAAA: —
NS: ttl=151 ns-1244.awsdns-27.org.
ttl=151 ns-1683.awsdns-18.co.uk.
ttl=151 ns-421.awsdns-52.com.
ttl=151 ns-573.awsdns-07.net.
SOA: ttl=900 ns-573.awsdns-07.net. awsdns-hostmaster.amazon.com. 1 7200 900 1209600 86400
CAA: ttl=300 \# 36 00 05 69 6f 64 65 66 6d 61 69 6c 74 6f 3a 68 6f 73 74 6d 61 73 74 65 72 40 73 6d 75 67 6d 75 67 2e 63 6f 6d
ttl=300 \# 17 00 05 69 73 73 75 65 61 6d 61 7a 6f 6e 2e 63 6f 6d
ttl=300 \# 19 00 05 69 73 73 75 65 64 69 67 69 63 65 72 74 2e 63 6f 6d
ttl=300 \# 21 00 05 69 73 73 75 65 67 6c 6f 62 61 6c 73 69 67 6e 2e 63 6f 6d
ttl=300 \# 22 00 05 69 73 73 75 65 6c 65 74 73 65 6e 63 72 79 70 74 2e 6f 72 67
TXT: ttl=3600 "amazonses:fs+dlhaoumf7/MsQOuSQGEmmZp21qPyTRBMyZZJcVIE="
ttl=3600 "google-site-verification=AfO5QqWdCBeh3GDipxTHvznM6-xyiY1LEtqaveo139Q"
ttl=3600 "google-site-verification=vifcpDc9v6AtY07tcbYo2qsDIJBhCSbK-_t31zCRWtQ"
ttl=3600 "stripe-verification=5f464c3049fdff3a66c89326e235aa36184f9c2cfcd34081f4c26abf7f31840c"
ttl=3600 "v=spf1 include:_spf.flickr_com._d.easydmarc.pro ~all"

fetched 2026-05-23T09:20:03.193Z

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

5 MX record(s) present

Why it matters: MX records direct inbound mail. Misconfiguration silently breaks email delivery and lets attackers stand up parallel MX hosts for spoofing campaigns (ISO 27001 A.8.21).

pri=10 aspmx.l.google.com.
pri=20 alt1.aspmx.l.google.com.
pri=30 alt2.aspmx.l.google.com.
pri=40 aspmx2.googlemail.com.
pri=50 aspmx3.googlemail.com.

fetched 2026-05-23T09:20:03.194Z

mx

info

Open standalone →

resolving mx…

spf

medium

Open standalone →

~all softfail — receivers may still accept

Why it matters: SPF tells receiving servers which hosts may send mail for the domain. Without it, any sender can forge the envelope-from — the primary mechanism behind business-email-compromise (SOC 2 CC6.7).

Recommendations

Move to -all (hardfail) once your mail flow is confirmed — softfail gives no real protection

v=spf1 include:_spf.flickr_com._d.easydmarc.pro ~all

v=spf1
include:_spf.flickr_com._d.easydmarc.pro
~all

fetched 2026-05-23T09:20:03.193Z

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

p=reject — strict policy

Why it matters: DMARC binds SPF and DKIM into an enforceable policy (quarantine or reject) and surfaces spoofing attempts via aggregate reports. `p=none` or absent means spoofing succeeds silently (SOC 2 CC6.7).

v=DMARC1;p=reject;pct=100;rua=mailto:c707497ded@rua.easydmarc.us;ruf=mailto:c707497ded@ruf.easydmarc.us;ri=86400;fo=1;

v=: DMARC1
p=: reject
pct=: 100
rua=: mailto:c707497ded@rua.easydmarc.us
ruf=: mailto:c707497ded@ruf.easydmarc.us
ri=: 86400
fo=: 1

fetched 2026-05-23T09:20:03.194Z

dmarc

info

Open standalone →

resolving dmarc…

dkim

low

Open standalone →

1/6 DKIM selectors valid

Why it matters: DKIM signs outbound mail so receivers can detect tampering. Missing selectors or rotated-away keys break DMARC alignment and let receivers downgrade trust (ISO 27001 A.8.24).

Recommendations

Check the missing selectors in your DNS provider and re-add any removed records

default:: —
google:: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAl3BCTlBST0GBBkJvanJz6pwi7/xkMwXnek/e8qMvM1lROCBFK4oTwGQfmBzmxG6priFts36iB1zHBhfmYxp0t8VkqZ8KdAE8gax78WIl5glhoWunKU5zYMF9L0zSDTuxEFguSjOiRzZECWVDQQr5YA/cxVpor5EZthVPJaMuzeWP5trVO0Gh+RwzYWRVzRGIW2VGl8KLKRAzLHdANRL7c8VoaFto1PXHyp7UgECeTDDiC0+zt8aBXZ8u2IWzbPwYGSW6NKCVWPD/TDv9D5QjXEZZo2f6wV2ZR9epBPRZ5DisnlGsh24ntDLWrKPvRzivukXZwRHjF2Tzzu5GVYXe7wIDAQAB
k1:: —
selector1:: —
selector2:: —
mxvault:: —

fetched 2026-05-23T09:20:03.209Z

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

cert valid for 224 days

Why it matters: A valid current TLS certificate is the baseline for data in transit. Expiry, weak chain, or hostname mismatch break HTTPS and fail PCI 4.2.1 / SOC 2 CC6.1.

subject cn:: flickr.com
issuer:: Amazon RSA 2048 M01 / Amazon
valid:: Dec 5 00:00:00 2025 GMT → Jan 2 23:59:59 2027 GMT
authorized:: yes
sha256:: F6:55:73:84:FD:98:CD:CB:F5:A9:58:F7:41:31:74:20:65:C1:F7:DF:1A:E6:6F:7C:68:29:50:C1:38:B3:6E:38
sans: flickr.com
*.flickr.com
flic.kr

fetched 2026-05-23T09:20:03.237Z

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

HTTPS served correctly

Why it matters: Bare HTTP requests must redirect to HTTPS without dropping the user mid-chain. Plain-text fallback or open redirects fail PCI 4.2.1 and feed phishing chains (SOC 2 CC6.6).

final status: 200 · 1 hop

[200] https://flickr.com/

fetched 2026-05-23T09:20:03.266Z

redirects

info

Open standalone →

tracing redirects…

headers

medium

Open standalone →

3 security header(s) missing

Why it matters: Security headers — HSTS, CSP, X-Frame-Options, Referrer-Policy — defend against XSS, clickjacking, and downgrade attacks. Absent headers map directly to OWASP ASVS V14 findings (ISO 27001 A.8.23).

Recommendations

Add response header — Strict-Transport-Security: max-age=15552000; includeSubDomains
Add response header — Content-Security-Policy: default-src 'self' (tune per app)
Add permissions-policy response header

final url: https://flickr.com/

security headers

strict-transport-security: —
content-security-policy: —
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
referrer-policy: same-origin
permissions-policy: —

other headers

cache-control: no-cache, max-age=0, must-revalidate, no-store
connection: keep-alive
content-encoding: gzip
content-type: text/html
cross-origin-opener-policy: same-origin-allow-popups
date: Sat, 23 May 2026 09:20:03 GMT
last-modified: Mon, 04 May 2026 14:33:41 GMT
pragma: no-cache
transfer-encoding: chunked
vary: Accept-Encoding
via: 1.1 769335ba1b0b8b72b720b3358de32b58.cloudfront.net (CloudFront)
x-amz-cf-id: jWhQu9jOQ7R4coqo3IDylfLqJYn1sNJNAMSx8hDhKVaJRfnCPV5iRQ==
x-amz-cf-pop: IAD61-P7
x-cache: Miss from cloudfront
x-xss-protection: 1; mode=block

fetched 2026-05-23T09:20:03.277Z

headers

info

Open standalone →

fetching headers…

cors

low

Open standalone →

CORS allows all origins (wildcard)

Why it matters: Overly permissive CORS (wildcard with credentials, or reflected origin) lets any origin read authenticated responses from this domain. OWASP A05 misconfiguration territory (NIST AC-4).

Recommendations

Restrict Access-Control-Allow-Origin to specific trusted origins if this API is not fully public

origin: https://drwho.me
method: GET
preflight status: 204

access-control-* headers

access-control-allow-origin: *
access-control-allow-methods: GET
access-control-allow-headers: —
access-control-allow-credentials: —
access-control-max-age: 3000
access-control-expose-headers: —

fetched 2026-05-23T09:20:03.266Z

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

HTTPS surface reachable (robots ✓, sitemap ✗, title ✓)

Why it matters: Public files — robots.txt, sitemap.xml, head meta — are what attackers see first during reconnaissance. Misadvertised paths, stale sitemaps, and verbose generators leak more than intended (ISO 27001 A.8.9).

robots.txt

present

User-agent: Adsbot-Google
User-agent: Alexabot
User-agent: AppleBot
User-agent: archive.org_bot
User-agent: Assaybot
User-agent: baiduspider
User-agent: bitlybot
User-agent: bingbot
User-agent: BingPreview
User-agent: coccocbot
User-agent: Discordbot
User-agent: DuckDuckBot
User-agent: facebookexternalhit
User-agent: Google-Site-Verification
User-agent: Google-Sitemaps
User-agent: Googlebot
User-agent: Googlebot-Image
User-agent: Googlebot-Mobile
User-agent: Googlebot-News
User-agent: Googlebot-Video
User-agent: gsa-crawler
User-Agent: HatenaBlog-bot
User-agent: ia_archiver
User-agent: Mediapartners-Google
User-agent: msnbot
User-agent: NAVER
User-agent: PetalBot
User-agent: Pingdom
User-agent: Pinterest
User-agent: redditbot
User-agent: Slackbot
User-agent: Slurp
User-agent: snapchat
User-agent: Twitterbot
User-agent: wp.com
User-agent: Yandex
User-agent: YandexImages
User-agent: YandexVideoParser
User-agent: Yeti
User-agent: ZoomBot
Disallow: /gp/
Disallow: /report_abuse.gne
Disallow: /abuse
Disallow: /images/*
Disallow: /apps/*
Disallow: /tools/demos/*
Disallow: /search
Disallow: /services/oauth
Disallow: /groups/10millionphotos/
Disallow: /photos/youpy/
Disallow: /photos/i_love_u_get_away_from_me/
Disallow: /faves-i_love_u_get_away_from_me/
Disallow: /photos/gbachelie/
Disallow: /photos/archivesact/6011019532/nearby/
Disallow: /yss_fragment.gne
Disallow: /photos/tags/*/page*
Disallow: /photos/*/lightbox/
Disallow: /groups/*/lightbox/
Disallow: /explore/*/lightbox/

User-agent: magpie-crawler
Disallow: /

User-agent: *
Disallow: /

Sitemap: https://www.flickr.com/sitemap/index/users/sitemap-index-users-00000000.xml.gz
Sitemap: https://www.flickr.com/sitemap/index/tags/sitemap-index-tags-00000000.xml.gz
Sitemap: https://www.flickr.com/sitemap/index/sets/sitemap-index-sets-00000000.xml.gz
Sitemap: https://www.flickr.com/sitemap/index/photos/sitemap-index-photos-00000000.xml.gz
Sitemap: https://www.flickr.com/sitemap/index/groups/sitemap-index-groups-00000000.xml.gz

sitemap.xml

absent

head

title: Flickr | The best place to be a photographer online.
description: The nicest place on the internet is here for you: inspiration, community, creativity, art, passion, and a heaping scoop of weirdness await you. Join for free.

social

og:type: website

fetched 2026-05-23T09:20:03.374Z

web-surface

info

Open standalone →

inspecting web surface…

dnssec

low

Open standalone →

DNSSEC not configured — no DS or DNSKEY records found

Why it matters: DNSSEC cryptographically signs DNS responses, blocking cache-poisoning attacks. US federal civilian agencies are required to enable it under OMB M-22-09 (NIST SC-20).

Recommendations

Enable DNSSEC in your DNS provider's control panel and add the resulting DS record at your registrar

enabled: no
DS records: —
DNSKEY records: —

fetched 2026-05-23T09:20:03.209Z

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

not applicable: no _mta-sts TXT record

Why it matters: MTA-STS forces inbound SMTP to use TLS and refuse downgraded connections. Without it, an in-path attacker can strip TLS and read mail in plaintext (SOC 2 CC6.7).

no _mta-sts TXT record

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

not applicable: no TLSRPT record

Why it matters: TLS-RPT publishes a reporting address for SMTP-TLS failures. Without it, downgrade attacks on inbound mail go unnoticed (SOC 2 CC7.2).

no TLSRPT record

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

domain registered until 2026-11-22

Why it matters: Registrar and expiry tell auditors the domain is owned, current, and not about to lapse. An expired or about-to-expire domain fails business-continuity evidence (SOC 2 A1.2).

registrar: GoDaddy Corporate Domains, LLC
created: 2003-11-22T07:49:51Z
expires: 2026-11-22T07:49:51Z
statuses: clientTransferProhibited https://icann.org/epp#clientTransferProhibited, serverDeleteProhibited https://icann.org/epp#serverDeleteProhibited, serverTransferProhibited https://icann.org/epp#serverTransferProhibited, serverUpdateProhibited https://icann.org/epp#serverUpdateProhibited

fetched 2026-05-23T09:20:03.349Z

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

check failed: crt.sh: AbortError: This operation was aborted; certspotter: Error: certspotter http 429

Why it matters: Every certificate issued for this domain is published in Certificate Transparency logs — including subdomains you may have forgotten. Unknown subdomains in CT are pre-disclosed attack surface (ISO 27001 A.8.16).

crt.sh: AbortError: This operation was aborted; certspotter: Error: certspotter http 429

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.