fsf.org

15-check dossier · scoreboard above, section details below

Get a pack →

Scanning…

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

resolving mx…

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

resolving dmarc…

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

tracing redirects…

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

inspecting web surface…

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.

fsf.org

15-check dossier · scoreboard above, section details below

Get a pack →

Mostly compliant · 6 items need attention

Aggregate grade across 15 checks. Auditors typically flag any High-severity finding.

Pass: 9
Warn: 6
Fail: 0

What an auditor would flag first

medium
DMARC
p=none — monitoring only, no enforcement
SOC 2 CC6.7ISO 27001 A.13.2.1
medium
Security headers
5 security header(s) missing
SOC 2 CC6.6ISO 27001 A.14.1.2
low
SPF
SPF present but all-qualifier unrecognised
SOC 2 CC6.7ISO 27001 A.13.2.1

Need this as an artifact your auditor can verify?

Your fsf.org scan flagged 2 medium and 4 low findings. A signed pack covers the apex plus up to 100 CT-discovered subdomains, Ed25519-signed and ISO-timestamped, delivered in 10–30 minutes.

Get a pack →See methodology See a sample$29

Scanning…

15-check summary

DNS recordsA/AAAA records present
MX1 MX record(s) present
SPFSPF present but all-qualifier unrecognised
DMARCp=none — monitoring only, no enforcement
DKIMno DKIM selectors found — likely not configured
TLS certificatecert expires in 49 days
Redirect chainHTTPS served correctly
Security headers5 security header(s) missing
CORSno CORS headers — cross-origin requests blocked by default
Web surfaceHTTPS surface reachable (robots ✓, sitemap ✓, title ✓)
MTA-STSnot applicable: no _mta-sts TXT record
TLS-RPTnot applicable: no TLSRPT record
DNSSECDNSKEY published but no DS delegation — DNSSEC not enforced by parent
WHOISdomain registered until 2027-02-02
Certificate Transparencycheck failed: crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

dns

info

Open standalone →

A/AAAA records present

Why it matters: Without authoritative A or AAAA records on the apex, the domain is unreachable. Missing baseline DNS shows up in vendor reviews as evidence of unmanaged infrastructure (SOC 2 CC6.6).

A: ttl=180 209.51.188.174
AAAA: ttl=180 2001:470:142:4::a
NS: ttl=180 ns1.gnu.org.
ttl=180 ns2.gnu.org.
ttl=180 ns4.gnu.org.
SOA: ttl=180 ns1.gnu.org. hostmaster.gnu.org. 2941144484 3600 300 3600000 3600
CAA: ttl=180 \# 22 00 05 69 73 73 75 65 6c 65 74 73 65 6e 63 72 79 70 74 2e 6f 72 67
ttl=180 \# 26 00 09 69 73 73 75 65 77 69 6c 64 6c 65 74 73 65 6e 63 72 79 70 74 2e 6f 72 67
TXT: ttl=180 "libera-asq123s"
ttl=180 "v=spf1 redirect=gnu.org"

fetched 2026-05-23T09:23:37.543Z

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

1 MX record(s) present

Why it matters: MX records direct inbound mail. Misconfiguration silently breaks email delivery and lets attackers stand up parallel MX hosts for spoofing campaigns (ISO 27001 A.8.21).

pri=10 mail.fsf.org.

fetched 2026-05-23T09:23:37.385Z

mx

info

Open standalone →

resolving mx…

spf

low

Open standalone →

SPF present but all-qualifier unrecognised

Why it matters: SPF tells receiving servers which hosts may send mail for the domain. Without it, any sender can forge the envelope-from — the primary mechanism behind business-email-compromise (SOC 2 CC6.7).

v=spf1 redirect=gnu.org

v=spf1
redirect=gnu.org

fetched 2026-05-23T09:23:37.352Z

spf

info

Open standalone →

resolving spf…

dmarc

medium

Open standalone →

p=none — monitoring only, no enforcement

Why it matters: DMARC binds SPF and DKIM into an enforceable policy (quarantine or reject) and surfaces spoofing attempts via aggregate reports. `p=none` or absent means spoofing succeeds silently (SOC 2 CC6.7).

Recommendations

Review rua= aggregate reports to confirm legitimate mail passes SPF/DKIM
Move to p=quarantine and then p=reject once mail flow is validated

v=DMARC1; p=none; rua=mailto:dmarc-rua@fsf.org

v=: DMARC1
p=: none
rua=: mailto:dmarc-rua@fsf.org

fetched 2026-05-23T09:23:37.379Z

dmarc

info

Open standalone →

resolving dmarc…

dkim

low

Open standalone →

no DKIM selectors found — likely not configured

Why it matters: DKIM signs outbound mail so receivers can detect tampering. Missing selectors or rotated-away keys break DMARC alignment and let receivers downgrade trust (ISO 27001 A.8.24).

Recommendations

Enable DKIM signing in your mail provider and publish the provided TXT record
Common selectors: google._domainkey, selector1._domainkey (Microsoft), mail._domainkey

no DKIM record on probed selectors (default, google, k1, selector1, selector2, mxvault)

dkim

info

Open standalone →

probing dkim selectors…

tls

low

Open standalone →

cert expires in 49 days

Why it matters: A valid current TLS certificate is the baseline for data in transit. Expiry, weak chain, or hostname mismatch break HTTPS and fail PCI 4.2.1 / SOC 2 CC6.1.

Recommendations

Schedule certificate renewal — consider enabling auto-renewal

subject cn:: *.fsf.org
issuer:: R13 / Let's Encrypt
valid:: Apr 12 19:06:29 2026 GMT → Jul 11 19:06:28 2026 GMT
authorized:: yes
sha256:: F3:6D:6A:3A:A9:6D:17:60:D6:4C:D4:54:2E:16:CD:62:8F:94:14:3E:B2:36:85:93:33:9D:C0:3B:3C:42:88:EB
sans: *.fsf.org
*.member.fsf.org
*.members.fsf.org
*.office.fsf.org
fsf.org

fetched 2026-05-23T09:23:37.574Z

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

HTTPS served correctly

Why it matters: Bare HTTP requests must redirect to HTTPS without dropping the user mid-chain. Plain-text fallback or open redirects fail PCI 4.2.1 and feed phishing chains (SOC 2 CC6.6).

final status: 200 · 2 hops

[301] https://fsf.org/
[200] https://www.fsf.org/

fetched 2026-05-23T09:23:37.785Z

redirects

info

Open standalone →

tracing redirects…

headers

medium

Open standalone →

5 security header(s) missing

Why it matters: Security headers — HSTS, CSP, X-Frame-Options, Referrer-Policy — defend against XSS, clickjacking, and downgrade attacks. Absent headers map directly to OWASP ASVS V14 findings (ISO 27001 A.8.23).

Recommendations

Add response header — Strict-Transport-Security: max-age=15552000; includeSubDomains
Add response header — Content-Security-Policy: default-src 'self' (tune per app)
Add response header — X-Frame-Options: DENY (or SAMEORIGIN if framing is intended)
Add response header — Referrer-Policy: strict-origin-when-cross-origin
Add permissions-policy response header

final url: https://www.fsf.org/

security headers

strict-transport-security: —
content-security-policy: —
x-frame-options: —
x-content-type-options: nosniff
referrer-policy: —
permissions-policy: —

other headers

age: 37
cache-control: max-age=0, s-maxage=86400, must-revalidate
connection: keep-alive
content-language: en
content-length: 59200
content-type: text/html;charset=utf-8
date: Sat, 23 May 2026 09:23:00 GMT
expires: Wed, 25 May 2016 09:23:00 GMT
last-modified: Fri, 26 Jul 2013 22:50:28 GMT
server: nginx
via: 1.0 www.fsf.org (squid/3.1.19)
x-cache: HIT from www.fsf.org
x-cache-lookup: HIT from www.fsf.org:3128
x-cache-operation: plone.app.caching.moderateCaching
x-cache-rule: plone.content.feed
x-xss-protection: 1; mode=block

fetched 2026-05-23T09:23:37.777Z

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

no CORS headers — cross-origin requests blocked by default

Why it matters: Overly permissive CORS (wildcard with credentials, or reflected origin) lets any origin read authenticated responses from this domain. OWASP A05 misconfiguration territory (NIST AC-4).

origin: https://drwho.me
method: GET
preflight status: 301

access-control-* headers

access-control-allow-origin: —
access-control-allow-methods: —
access-control-allow-headers: —
access-control-allow-credentials: —
access-control-max-age: —
access-control-expose-headers: —

no access-control-* headers returned — site does not advertise CORS to this origin

fetched 2026-05-23T09:23:37.578Z

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

HTTPS surface reachable (robots ✓, sitemap ✓, title ✓)

Why it matters: Public files — robots.txt, sitemap.xml, head meta — are what attackers see first during reconnaissance. Misadvertised paths, stale sitemaps, and verbose generators leak more than intended (ISO 27001 A.8.9).

robots.txt

present

# robots.txt for https://www.fsf.org/

User-agent: *
Crawl-delay: 10
Disallow: /.git/
Disallow: /?set_language
Disallow: /@@search
Disallow: /associate/forum/
Disallow: /norobotsnorhumansshouldevervisithispage/
Disallow: /search
Disallow: /search_rss
Disallow: /share
Disallow: /software/
Disallow: /software/winboard/whats_new/
Sitemap: https://www.fsf.org/sitemap.xml

# Majestic - SEO
User-agent: MJ12bot
Disallow: /

# DataForSeo - SEO
User-agent: DataForSeoBot
Disallow: /

# webmeup - SEO
User-agent: BLEXBot
Disallow: /

# Ahrefs - SEO
User-agent: AhrefsBot
Disallow: /

# babbar - SEO
User-agent: barkrowler
Disallow: /

# Screamingfrog - SEO
User-agent: Screaming Frog SEO Spider
Disallow: /

# Seozoom - SEO
User-Agent: ZoomBot
Disallow: /

# Brandwatch - SEO
User-agent: magpie-crawler
Disallow: /

# Begin Moz - SEO
# Not to be confused with Mozilla.
User-agent: DotBot
Disallow: /

User-agent: rogerbot
Disallow: /
# End Moz - SEO

# Begin Semrush - SEO
User-agent: SemrushBot
Disallow: /

User-agent: SiteAuditBot
Disallow: /

User-agent: SemrushBot-BA
Disallow: /

User-agent: SemrushBot-SI
Disallow: /

User-agent: SemrushBot-SWA
Disallow: /

User-agent: SplitSignalBot
Disallow: /

User-agent: SemrushBot-OCOB
Disallow: /
# End Semrush - SEO

# cognitiveSEO - SEO
User-agent: JamesBOT
Disallow: /

# oncrawl - SEO
User-agent: Oncrawl
Disallow: /

# BEGIN Awario - Marketing
User-agent: AwarioRssBot
Disallow: /

User-agent: AwarioSmartBot
Disallow: /

User-agent: AwarioBot
Disallow: /
# END Awario - Marketing

# SERPSTAT - SEO
User-agent: serpstatbot
Disallow: /

# website-datenbank.de - Search engine?
User-agent: netEstate NE Crawler
Disallow: /

# Ignores Crawl-delay and does not help us.
User-Agent: panscient.com
Disallow: /

# Latvian Academic Integrity - Plagiarism
User-agent: AcademicBotRTU
Disallow: /

# TurnItIn - Plagiarism
User-agent: TurnitinBot
Disallow: /

# CheckMarkNetwork - Trademark
User-agent: CheckMarkNetwork
Disallow: /

# SEOkicks - SEO
User-agent: SEOkicks
Disallow: /

# Timpi NFT
User-Agent: Timpibot
Disallow: /

# Seobility - SEO
User-agent: Seobility
Disallow: /

# BigSight - Sec
User-agent: BitSightBot

# Meltwater - SEO
User-agent: linkfluence
Disallow: /

# adbeat - Ads
User-agent: adbeat_bot
Disallow: /

# BrandVerity - Ads
User-agent: BrandVerity
Disallow: /

# peer39 - Ads
User-agent: peer39_crawler
Disallow: /

# Pipl - Spy
User-agent: PiplBot
Disallow: /

# Scrapy - Reckless scraper https://github.com/scrapy/scrapy/issues/6597
User-agent: Scrapy
Disallow: /

# BubiNG crawls too fast.
User-agent: BUbiNG
Disallow: /

# undici can be configured to crawl too fast.
User-agent: undici
Disallow: /

# Does not listen to wildcard Disallows.
User-agent: YisouSpider
Disallow: /

# ceramic - Ignores Crawl-delay
User-agent: TerraCotta
Disallow: /

# HaloScan SEO
User-agent: HaloBot
Disallow: /

# seranking.com SEO
User-agent: SERankingBacklinksBot
Disallow: /

sitemap.xml

present — 212 url(s)

head

title: Front Page — Free Software Foundation — working together for free software
description: —

social

no OpenGraph or Twitter meta tags found

fetched 2026-05-23T09:23:37.814Z

web-surface

info

Open standalone →

inspecting web surface…

dnssec

low

Open standalone →

DNSKEY published but no DS delegation — DNSSEC not enforced by parent

Why it matters: DNSSEC cryptographically signs DNS responses, blocking cache-poisoning attacks. US federal civilian agencies are required to enable it under OMB M-22-09 (NIST SC-20).

Recommendations

Submit the DS record to your domain registrar to complete the DNSSEC delegation chain

enabled: no
DS records: —
DNSKEY records: 4 key(s)

fetched 2026-05-23T09:23:37.470Z

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

not applicable: no _mta-sts TXT record

Why it matters: MTA-STS forces inbound SMTP to use TLS and refuse downgraded connections. Without it, an in-path attacker can strip TLS and read mail in plaintext (SOC 2 CC6.7).

no _mta-sts TXT record

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

not applicable: no TLSRPT record

Why it matters: TLS-RPT publishes a reporting address for SMTP-TLS failures. Without it, downgrade attacks on inbound mail go unnoticed (SOC 2 CC7.2).

no TLSRPT record

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

domain registered until 2027-02-02

Why it matters: Registrar and expiry tell auditors the domain is owned, current, and not about to lapse. An expired or about-to-expire domain fails business-continuity evidence (SOC 2 A1.2).

registrar: Gandi SAS
created: 1991-02-01T05:00:00Z
expires: 2027-02-02T05:00:00Z
statuses: clientTransferProhibited https://icann.org/epp#clientTransferProhibited

fetched 2026-05-23T09:23:37.821Z

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

check failed: crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

Why it matters: Every certificate issued for this domain is published in Certificate Transparency logs — including subdomains you may have forgotten. Unknown subdomains in CT are pre-disclosed attack surface (ISO 27001 A.8.16).

crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.