fortune.com

15-check dossier · scoreboard above, section details below

Get a pack →

Scanning…

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

resolving mx…

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

resolving dmarc…

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

tracing redirects…

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

inspecting web surface…

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.

fortune.com

15-check dossier · scoreboard above, section details below

Get a pack →

Mostly compliant · 3 items need attention

Aggregate grade across 15 checks. Auditors typically flag any High-severity finding.

Pass: 12
Warn: 3
Fail: 0

What an auditor would flag first

medium
Security headers
6 security header(s) missing
SOC 2 CC6.6ISO 27001 A.14.1.2
low
DKIM
1/6 DKIM selectors valid
SOC 2 CC6.7
low
DNSSEC
DNSSEC not configured — no DS or DNSKEY records found
SOC 2 CC6.6ISO 27001 A.13.1.1

Need this as an artifact your auditor can verify?

Your fortune.com scan flagged 1 medium and 2 low findings. A signed pack covers the apex plus up to 100 CT-discovered subdomains, Ed25519-signed and ISO-timestamped, delivered in 10–30 minutes.

Get a pack →See methodology See a sample$29

Scanning…

15-check summary

DNS recordsA/AAAA records present
MX2 MX record(s) present
SPF-all hardfail — strict policy
DMARCp=reject — strict policy
DKIM1/6 DKIM selectors valid
TLS certificatecert valid for 148 days
Redirect chainHTTPS served correctly
Security headers6 security header(s) missing
CORSno CORS headers — cross-origin requests blocked by default
Web surfaceHTTPS surface reachable (robots ✓, sitemap ✗, title ✓)
MTA-STSnot applicable: no _mta-sts TXT record
TLS-RPTnot applicable: no TLSRPT record
DNSSECDNSSEC not configured — no DS or DNSKEY records found
WHOISdomain registered until 2027-06-01
Certificate Transparencycheck failed: crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

dns

info

Open standalone →

A/AAAA records present

Why it matters: Without authoritative A or AAAA records on the apex, the domain is unreachable. Missing baseline DNS shows up in vendor reviews as evidence of unmanaged infrastructure (SOC 2 CC6.6).

A: ttl=60 3.171.76.116
ttl=60 3.171.76.33
ttl=60 3.171.76.24
ttl=60 3.171.76.64
AAAA: —
NS: ttl=172800 ns-1273.awsdns-31.org.
ttl=172800 ns-1776.awsdns-30.co.uk.
ttl=172800 ns-473.awsdns-59.com.
ttl=172800 ns-585.awsdns-09.net.
SOA: ttl=900 ns-1776.awsdns-30.co.uk. domain-tech.fortune.com. 1 7200 900 1209600 86400
CAA: —
TXT: ttl=60 "Ascend-verification: Ascend"
ttl=60 "Impact-Site-Verification:0c4f4006-7db7-4de7-9c44-503127ca3f9e"
ttl=60 "SFMC-JiepT-Epei0pauMWlutTEcXAkH36RHPy_akuGq6_"
ttl=60 "VC2Efb0Jw/2RSd0fAx8bSur7kItw2rx8qmebPBj6JXc85N15QNNJzVXbEWtYQOhx/URT+5cO9pftaAk2uJjQ5g=="
ttl=60 "ZOOM_verify_ZyoZwZc9Rh68_YlIB-BdMA"
ttl=60 "ZOOM_verify_iffDNQhYTg27k7QbosbZNw"
ttl=60 "ahrefs-site-verification_39b7e330ce14a24f554844884afa983721dc1c7328bb26feafa0b65ba2963ce9"
ttl=60 "amazonses:IQCA6/RQqRNFamd8b0B67TH+dlb5TDEwkAE3dboWVrU="
ttl=60 "apple-domain-verification=bKXfT4YAsXCSgpnW"
ttl=60 "asv=f9c05fe631e98c8d2627f4f00c753fc2"
ttl=60 "dailymotion-domain-verification=dm1alpcqf0ue7et04"
ttl=60 "docusign=f9ccfb90-94da-430c-959d-f77a82544b33"
ttl=60 "facebook-domain-verification=0tlg42c3k3mjni3br69f0ie5w8cpc4"
ttl=60 "fastly-domain-delegation-boccjnwotuv4zxnk7kqv-717620-2023-11-27"
ttl=60 "google-site-verification=SHoIkDSKeEM0OGZn4ygaiPM_dqcD2LVh04B0UlI_0o4"
ttl=60 "google-site-verification=SUX8rIMrer1l8vTfMlzxIedkV-gR3OBibmRa94Mm5OA"
ttl=60 "google-site-verification=WKaOZMtHsJtOGjCM1nsRqvp8I5IT5Op5xMsxPkLHpiE"
ttl=60 "google-site-verification=Z-YtF2omTVXKTWpZ9vRdF9NgvA9HAAwxcNC8QklDW4E"
ttl=60 "google-site-verification=fHwXyE_lBAiQwNJ9ADCGbTeD8VX54S3dtpgGKVh7uFI"
ttl=60 "google-site-verification=f_V4t4DUaxlKA019zi3sVF2W0RUHOcGlVu_6Ke-li8E"
ttl=60 "google-site-verification=sl0jr1GuIT3iPNaGxMEU-WYqCP0BvX5Wtacc1R1zrp0"
ttl=60 "google-site-verification=ucHyBAb2tRNq6zkSR75YRZcLM0yUr4iLRpelVPsx0ho"
ttl=60 "google-site-verification=z-iPq9kuzp7lH98teXV2uo0XJJBEHMnZdlRAGReq9zQ"
ttl=60 "jamf-site-verification=qdHOPVge2KvX9qyM4DBpzg"
ttl=60 "ppe-50ab64024af90630109a"
ttl=60 "teamviewer-sso-verification=911838b426524510bdaba4dfab7c82a7"
ttl=60 "v=spf1 include:_spf.mlsend.com include:spf.protection.outlook.com include:email.prnewswire.com include:_spf.salesforce.com include:u826348.wl.sendgrid.net include:spf.braintreegateway.com a:dispatch-us.ppe-hosted.com " "mx ip4:54.236.128.150 ip4:54.236.109.30 ip4:54.236.128.150 ip4:54.236.109.30 ip4:40.76.81.49 ip4:204.14.234.64/28 ip4:204.14.232.64/28 ip4:182.50.78.64/28 ip4:96.43.144.64/31 ip4:96.43.148.64/31 -all"
ttl=60 "yahoo-verification-key=bhHCbUW9MiLbKejjBsO2rCZiGvHqNTHs1sdvie1iY60="

fetched 2026-05-23T09:22:50.955Z

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

2 MX record(s) present

Why it matters: MX records direct inbound mail. Misconfiguration silently breaks email delivery and lets attackers stand up parallel MX hosts for spoofing campaigns (ISO 27001 A.8.21).

pri=10 mx1-us1.ppe-hosted.com.
pri=20 mx2-us1.ppe-hosted.com.

fetched 2026-05-23T09:22:50.956Z

mx

info

Open standalone →

resolving mx…

spf

info

Open standalone →

-all hardfail — strict policy

Why it matters: SPF tells receiving servers which hosts may send mail for the domain. Without it, any sender can forge the envelope-from — the primary mechanism behind business-email-compromise (SOC 2 CC6.7).

v=spf1 include:_spf.mlsend.com include:spf.protection.outlook.com include:email.prnewswire.com include:_spf.salesforce.com include:u826348.wl.sendgrid.net include:spf.braintreegateway.com a:dispatch-us.ppe-hosted.com mx ip4:54.236.128.150 ip4:54.236.109.30 ip4:54.236.128.150 ip4:54.236.109.30 ip4:40.76.81.49 ip4:204.14.234.64/28 ip4:204.14.232.64/28 ip4:182.50.78.64/28 ip4:96.43.144.64/31 ip4:96.43.148.64/31 -all

v=spf1
include:_spf.mlsend.com
include:spf.protection.outlook.com
include:email.prnewswire.com
include:_spf.salesforce.com
include:u826348.wl.sendgrid.net
include:spf.braintreegateway.com
a:dispatch-us.ppe-hosted.com
mx
ip4:54.236.128.150
ip4:54.236.109.30
ip4:54.236.128.150
ip4:54.236.109.30
ip4:40.76.81.49
ip4:204.14.234.64/28
ip4:204.14.232.64/28
ip4:182.50.78.64/28
ip4:96.43.144.64/31
ip4:96.43.148.64/31
-all

fetched 2026-05-23T09:22:50.951Z

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

p=reject — strict policy

Why it matters: DMARC binds SPF and DKIM into an enforceable policy (quarantine or reject) and surfaces spoofing attempts via aggregate reports. `p=none` or absent means spoofing succeeds silently (SOC 2 CC6.7).

v=DMARC1; p=reject; rua=mailto:dmarc_agg@dmarc.250ok.net,mailto:dmarc_rua@emaildefense.proofpoint.com; ruf=mailto:dmarc_fr@dmarc.250ok.net,mailto:dmarc-afrf@dragonflyft.com, mailto:dmarc_ruf@emaildefense.proofpoint.com; fo=1; pct=100; rf=afrf

v=: DMARC1
p=: reject
rua=: mailto:dmarc_agg@dmarc.250ok.net,mailto:dmarc_rua@emaildefense.proofpoint.com
ruf=: mailto:dmarc_fr@dmarc.250ok.net,mailto:dmarc-afrf@dragonflyft.com, mailto:dmarc_ruf@emaildefense.proofpoint.com
fo=: 1
pct=: 100
rf=: afrf

fetched 2026-05-23T09:22:50.949Z

dmarc

info

Open standalone →

resolving dmarc…

dkim

low

Open standalone →

1/6 DKIM selectors valid

Why it matters: DKIM signs outbound mail so receivers can detect tampering. Missing selectors or rotated-away keys break DMARC alignment and let receivers downgrade trust (ISO 27001 A.8.24).

Recommendations

Check the missing selectors in your DNS provider and re-add any removed records

default:: —
google:: —
k1:: —
selector1:: v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDLWPTJjiR4k1DM/aUM9UG6CeV/vBFv+F8Us2qdIwmZDnrnkE1Q/2FBT9Ls0iCwJRADRFGEjDBd80+4IyKnX6RtzkcrE+OOIis584ozpbhpR3OQtnmSjuPi3Ld1aNH8YQJlB7sTmnda0Ha6/8qBs1Q+k0ooNIUXXH2Jz0xonBpD2QIDAQAB;
selector2:: —
mxvault:: —

fetched 2026-05-23T09:22:51.312Z

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

cert valid for 148 days

Why it matters: A valid current TLS certificate is the baseline for data in transit. Expiry, weak chain, or hostname mismatch break HTTPS and fail PCI 4.2.1 / SOC 2 CC6.1.

subject cn:: fortune.com
issuer:: Amazon RSA 2048 M04 / Amazon
valid:: Sep 19 00:00:00 2025 GMT → Oct 18 23:59:59 2026 GMT
authorized:: yes
sha256:: B9:71:8B:01:E3:53:5E:10:EC:07:27:F7:4B:0F:1B:43:5D:AB:E6:80:CF:28:3F:43:80:C8:CC:49:C6:C3:F7:76
sans: fortune.com
fortuneconferences.com
*.fortuneconferences.com
*.fortune.com

fetched 2026-05-23T09:22:50.987Z

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

HTTPS served correctly

Why it matters: Bare HTTP requests must redirect to HTTPS without dropping the user mid-chain. Plain-text fallback or open redirects fail PCI 4.2.1 and feed phishing chains (SOC 2 CC6.6).

final status: 200 · 1 hop

[200] https://fortune.com/

fetched 2026-05-23T09:22:51.011Z

redirects

info

Open standalone →

tracing redirects…

headers

medium

Open standalone →

6 security header(s) missing

Why it matters: Security headers — HSTS, CSP, X-Frame-Options, Referrer-Policy — defend against XSS, clickjacking, and downgrade attacks. Absent headers map directly to OWASP ASVS V14 findings (ISO 27001 A.8.23).

Recommendations

Add response header — Strict-Transport-Security: max-age=15552000; includeSubDomains
Add response header — Content-Security-Policy: default-src 'self' (tune per app)
Add response header — X-Frame-Options: DENY (or SAMEORIGIN if framing is intended)
Add response header — X-Content-Type-Options: nosniff
Add response header — Referrer-Policy: strict-origin-when-cross-origin
Add permissions-policy response header

final url: https://fortune.com/

security headers

strict-transport-security: —
content-security-policy: —
x-frame-options: —
x-content-type-options: —
referrer-policy: —
permissions-policy: —

other headers

access-control-allow-origin: *
age: 40
cache-control: s-maxage=600, stale-while-revalidate=31535400
connection: keep-alive
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Sat, 23 May 2026 09:22:10 GMT
etag: "55uj69vdrbgjl9"
server: nginx
transfer-encoding: chunked
vary: Accept-Encoding
via: 1.1 2b66eab7f27c182ef8aa24b0c1440e9a.cloudfront.net (CloudFront)
x-amz-cf-id: MaZqszvfTbVYNwMb5UXgWgVQVgJNcgjG3sO8ULed96VG5IHs6FKrMg==
x-amz-cf-pop: IAD89-P4
x-cache: Hit from cloudfront
x-nextjs-cache: HIT
x-nextjs-prerender: 1
x-nextjs-stale-time: 300
x-powered-by: Next.js

fetched 2026-05-23T09:22:51.013Z

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

no CORS headers — cross-origin requests blocked by default

Why it matters: Overly permissive CORS (wildcard with credentials, or reflected origin) lets any origin read authenticated responses from this domain. OWASP A05 misconfiguration territory (NIST AC-4).

origin: https://drwho.me
method: GET
preflight status: 403

access-control-* headers

access-control-allow-origin: —
access-control-allow-methods: —
access-control-allow-headers: —
access-control-allow-credentials: —
access-control-max-age: —
access-control-expose-headers: —

no access-control-* headers returned — site does not advertise CORS to this origin

fetched 2026-05-23T09:22:51.012Z

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

HTTPS surface reachable (robots ✓, sitemap ✗, title ✓)

Why it matters: Public files — robots.txt, sitemap.xml, head meta — are what attackers see first during reconnaissance. Misadvertised paths, stale sitemaps, and verbose generators leak more than intended (ISO 27001 A.8.9).

robots.txt

present

User-agent: *
Disallow: /wp-admin/
Allow: /wp-admin/admin-ajax.php
Disallow: /search/*
Disallow: /sponsored/
Disallow: /newsletter/
Allow: */feed/*/articles.xml
Allow: /feed/sitema*
Disallow: /wp-login.php
Disallow: /wp-signup.php
Disallow: /press-this.php
Disallow: /remote-login.php
Disallow: /activate/
Disallow: /cgi-bin/
Disallow: /mshots/v1/
Disallow: /next/
Disallow: /public.api/*
Disallow: /preview/*
Disallow: /advanced-search/*
Disallow: /genai-analytics/*
Disallow: /comscore-json/*
Disallow: /api/*
Disallow: /*.webarchive$


User-agent: Googlebot
User-agent: LinkedInBot
Disallow: /search/*
Disallow: /sponsored/
Disallow: /newsletter/
Allow: */feed/*/articles.xml
Allow: /feed/sitema*
Disallow: /wp-login.php
Disallow: /wp-signup.php
Disallow: /press-this.php
Disallow: /remote-login.php
Disallow: /activate/
Disallow: /cgi-bin/
Disallow: /mshots/v1/
Disallow: /next/
Disallow: /public.api/*
Disallow: /advanced-search/*
Disallow: /preview/*
Disallow: /genai-analytics/*
Disallow: /comscore-json/*
Disallow: /api/*
Disallow: /*.webarchive$

User-agent: CCBot
Disallow: /

User-agent: Google-Extended
Disallow: /

User-agent: ia_archiver
Disallow: /

User-Agent: omgili
Disallow: /

User-Agent: omgilibot
Disallow: /

# Google SiteMaps
Sitemap: https://fortune.com/sitemap_index.xml
Sitemap: https://fortune.com/education/sitemap_index.xml
Sitemap: https://fortune.com/company/sitemap_index.xml
Sitemap: https://fortune.com/ranking/sitemap.xml
Sitemap: https://fortune.com/author/sitemap_index.xml
Sitemap: https://fortune.com/about.xml
Sitemap: https://fortune.com/feed/googlenews/articles.xml
Sitemap: https://fortune.com/videos/sitemap.xml
Sitemap: https://fortune.com/press-releases/sitemap_index.xml

sitemap.xml

absent

head

title: Fortune - Fortune 500 Daily & Breaking Business News
description: Unrivaled access, premier storytelling, and the best of business since 1930.

social

og:title: FORTUNE | Fortune
og:description: Unrivaled access, premier storytelling, and the best of business since 1930.
og:url: https://fortune.com/
og:site_name: Fortune
og:image: https://fortune.com/img-assets/wp-content/uploads/2020/01/Digital-Card4.jpg?resize=1200,600
og:image:height: 600
og:image:width: 1200
og:type: website
twitter:card: summary_large_image
twitter:site: @Fortune
twitter:title: FORTUNE | Fortune
twitter:description: Unrivaled access, premier storytelling, and the best of business since 1930.
twitter:image: https://fortune.com/img-assets/wp-content/uploads/2020/01/Digital-Card4.jpg?resize=1200,600
twitter:image:alt: Fortune - Fortune 500 Daily & Breaking Business News

fetched 2026-05-23T09:22:51.040Z

web-surface

info

Open standalone →

inspecting web surface…

dnssec

low

Open standalone →

DNSSEC not configured — no DS or DNSKEY records found

Why it matters: DNSSEC cryptographically signs DNS responses, blocking cache-poisoning attacks. US federal civilian agencies are required to enable it under OMB M-22-09 (NIST SC-20).

Recommendations

Enable DNSSEC in your DNS provider's control panel and add the resulting DS record at your registrar

enabled: no
DS records: —
DNSKEY records: —

fetched 2026-05-23T09:22:50.954Z

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

not applicable: no _mta-sts TXT record

Why it matters: MTA-STS forces inbound SMTP to use TLS and refuse downgraded connections. Without it, an in-path attacker can strip TLS and read mail in plaintext (SOC 2 CC6.7).

no _mta-sts TXT record

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

not applicable: no TLSRPT record

Why it matters: TLS-RPT publishes a reporting address for SMTP-TLS failures. Without it, downgrade attacks on inbound mail go unnoticed (SOC 2 CC7.2).

no TLSRPT record

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

domain registered until 2027-06-01

Why it matters: Registrar and expiry tell auditors the domain is owned, current, and not about to lapse. An expired or about-to-expire domain fails business-continuity evidence (SOC 2 A1.2).

registrar: MarkMonitor Inc.
created: 1994-06-02T04:00:00Z
expires: 2027-06-01T04:00:00Z
statuses: clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited, clientTransferProhibited https://icann.org/epp#clientTransferProhibited, clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited

fetched 2026-05-23T09:22:51.309Z

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

check failed: crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

Why it matters: Every certificate issued for this domain is published in Certificate Transparency logs — including subdomains you may have forgotten. Unknown subdomains in CT are pre-disclosed attack surface (ISO 27001 A.8.16).

crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.