huffpost.com

15-check dossier · scoreboard above, section details below

Get a pack →

Scanning…

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

resolving mx…

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

resolving dmarc…

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

tracing redirects…

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

inspecting web surface…

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.

huffpost.com

15-check dossier · scoreboard above, section details below

Get a pack →

A-

Audit-ready · 4 minor advisories

Aggregate grade across 15 checks. Auditors typically flag any High-severity finding.

Pass: 11
Warn: 4
Fail: 0

What an auditor would flag first

low
DMARC
p=quarantine — receivers send to spam
SOC 2 CC6.7ISO 27001 A.13.2.1
low
DKIM
1/6 DKIM selectors valid
SOC 2 CC6.7
low
Security headers
2 security header(s) missing
SOC 2 CC6.6ISO 27001 A.14.1.2

Need this as an artifact your auditor can verify?

Your huffpost.com scan flagged 4 low findings. A signed pack covers the apex plus up to 100 CT-discovered subdomains, Ed25519-signed and ISO-timestamped, delivered in 10–30 minutes.

Get a pack →See methodology See a sample$29

Scanning…

15-check summary

DNS recordsA/AAAA records present
MX5 MX record(s) present
SPF-all hardfail — strict policy
DMARCp=quarantine — receivers send to spam
DKIM1/6 DKIM selectors valid
TLS certificatecert valid for 186 days
Redirect chainHTTPS served correctly
Security headers2 security header(s) missing
CORSno CORS headers — cross-origin requests blocked by default
Web surfaceHTTPS surface reachable (robots ✓, sitemap ✗, title ✓)
MTA-STSnot applicable: no _mta-sts TXT record
TLS-RPTnot applicable: no TLSRPT record
DNSSECDNSSEC not configured — no DS or DNSKEY records found
WHOISdomain registered until 2028-03-10
Certificate Transparency25 subdomain(s) found in CT logs (11 wildcard cert(s))

dns

info

Open standalone →

A/AAAA records present

Why it matters: Without authoritative A or AAAA records on the apex, the domain is unreachable. Missing baseline DNS shows up in vendor reviews as evidence of unmanaged infrastructure (SOC 2 CC6.6).

A: ttl=300 151.101.130.114
ttl=300 151.101.2.114
ttl=300 151.101.194.114
ttl=300 151.101.66.114
AAAA: —
NS: ttl=172800 ns-1081.awsdns-07.org.
ttl=172800 ns-1616.awsdns-10.co.uk.
ttl=172800 ns-247.awsdns-30.com.
ttl=172800 ns-843.awsdns-41.net.
SOA: ttl=30 huffpost.com. awsdns-hostmaster.amazon.com. 1 28800 900 604800 60
CAA: ttl=3600 \# 39 00 05 69 6f 64 65 66 6d 61 69 6c 74 6f 3a 73 65 63 75 72 69 74 79 40 76 65 72 69 7a 6f 6e 6d 65 64 69 61 2e 63 6f 6d
\# 17 00 05 69 73 73 75 65 61 6d 61 7a 6f 6e 2e 63 6f 6d

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

5 MX record(s) present

Why it matters: MX records direct inbound mail. Misconfiguration silently breaks email delivery and lets attackers stand up parallel MX hosts for spoofing campaigns (ISO 27001 A.8.21).

pri=1 aspmx.l.google.com.
pri=5 alt1.aspmx.l.google.com.
pri=5 alt2.aspmx.l.google.com.
pri=10 alt3.aspmx.l.google.com.
pri=10 alt4.aspmx.l.google.com.

fetched 2026-05-23T11:35:32.809Z

mx

info

Open standalone →

resolving mx…

spf

info

Open standalone →

-all hardfail — strict policy

Why it matters: SPF tells receiving servers which hosts may send mail for the domain. Without it, any sender can forge the envelope-from — the primary mechanism behind business-email-compromise (SOC 2 CC6.7).

v=spf1 mx ip4:74.205.21.242 ip4:149.174.0.0/16 ip4:64.236.0.0/16 ip4:204.29.186.0/23 ip4:148.163.135.35/32 ip4:148.163.139.55/32 include:sendgrid.net include:_spf.google.com include:aspmx.sailthru.com include:amazonses.com -all

v=spf1
mx
ip4:74.205.21.242
ip4:149.174.0.0/16
ip4:64.236.0.0/16
ip4:204.29.186.0/23
ip4:148.163.135.35/32
ip4:148.163.139.55/32
include:sendgrid.net
include:_spf.google.com
include:aspmx.sailthru.com
include:amazonses.com
-all

fetched 2026-05-23T11:35:32.810Z

spf

info

Open standalone →

resolving spf…

dmarc

low

Open standalone →

p=quarantine — receivers send to spam

Why it matters: DMARC binds SPF and DKIM into an enforceable policy (quarantine or reject) and surfaces spoofing attempts via aggregate reports. `p=none` or absent means spoofing succeeds silently (SOC 2 CC6.7).

Recommendations

Upgrade to p=reject once your SPF and DKIM pass rates are consistently high

v=DMARC1; p=quarantine; pct=100; rua=mailto:rua@huffpost.com; ruf=mailto:ruf@huffpost.com;

v=: DMARC1
p=: quarantine
pct=: 100
rua=: mailto:rua@huffpost.com
ruf=: mailto:ruf@huffpost.com

fetched 2026-05-23T11:35:32.812Z

dmarc

info

Open standalone →

resolving dmarc…

dkim

low

Open standalone →

1/6 DKIM selectors valid

Why it matters: DKIM signs outbound mail so receivers can detect tampering. Missing selectors or rotated-away keys break DMARC alignment and let receivers downgrade trust (ISO 27001 A.8.24).

Recommendations

Check the missing selectors in your DNS provider and re-add any removed records

default:: —
google:: v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCit4CDZf8lOhOwPPRXrD5soHzkiocPoh5Dl4BbgX5l8DSuyiQsnuZoWR0oF6sFpGLZl1UC7hKFoo81sDtHIZZBSV1TpxTMqK2qAvIJDHNSstKzYnHQWgNSVEVCOeimRUhUFWS4uJ/3S3VXozxUfL8TnRb8FUFCy7nbDmVitLmw+QIDAQAB
k1:: —
selector1:: —
selector2:: —
mxvault:: —

fetched 2026-05-23T11:35:32.826Z

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

cert valid for 186 days

Why it matters: A valid current TLS certificate is the baseline for data in transit. Expiry, weak chain, or hostname mismatch break HTTPS and fail PCI 4.2.1 / SOC 2 CC6.1.

subject cn:: huffpost.com
issuer:: GlobalSign Atlas R3 DV TLS CA 2025 Q4 / GlobalSign nv-sa
valid:: Oct 24 16:44:22 2025 GMT → Nov 25 16:44:21 2026 GMT
authorized:: yes
sha256:: 1D:B9:08:76:92:88:8F:1A:E6:ED:3A:CB:FF:8B:BC:08:4C:D6:E8:4B:86:22:42:00:28:70:1B:31:43:DA:B3:35
sans: huffpost.com
*.huffpost.com
*.assets.huffingtonpost.com
*.assets.huffpost.com
*.huffingtonpost.ca
*.huffingtonpost.co.uk
*.huffingtonpost.com
*.huffingtonpost.com.au
*.huffingtonpost.jp
*.huffpost.co.uk
*.elections.huffpost.com
*.m.huffingtonpost.ca
*.m.huffingtonpost.co.uk
*.m.huffingtonpost.com.au
*.m.huffingtonpost.jp
*.m.huffpost.com
*.m.quebec.huffingtonpost.ca
*.mapi.huffpost.com
*.modulous.huffpost.com
*.quebec.huffingtonpost.ca
*.qa.huffingtonpost.com
*.staging.huffingtonpost.com
*.staging.mobile.huffpost.com
*.widgets.huffpost.com
*.www.huffingtonpost.ca
*.www.huffingtonpost.co.uk
*.www.huffingtonpost.com.au
*.www.huffingtonpost.jp
*.www.huffpost.com
*.www.quebec.huffingtonpost.ca
*.login.huffpost.com
*.preview.www.huffpost.com
huffingtonpost.co.uk
huffingtonpost.jp
huffingtonpost.ca
huffingtonpost.com.au

fetched 2026-05-23T11:35:32.727Z

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

HTTPS served correctly

Why it matters: Bare HTTP requests must redirect to HTTPS without dropping the user mid-chain. Plain-text fallback or open redirects fail PCI 4.2.1 and feed phishing chains (SOC 2 CC6.6).

final status: 200 · 2 hops

[301] https://huffpost.com/
[200] https://www.huffpost.com/

fetched 2026-05-23T11:35:33.053Z

redirects

info

Open standalone →

tracing redirects…

headers

low

Open standalone →

2 security header(s) missing

Why it matters: Security headers — HSTS, CSP, X-Frame-Options, Referrer-Policy — defend against XSS, clickjacking, and downgrade attacks. Absent headers map directly to OWASP ASVS V14 findings (ISO 27001 A.8.23).

Recommendations

Add response header — X-Frame-Options: DENY (or SAMEORIGIN if framing is intended)
Add permissions-policy response header

final url: https://www.huffpost.com/

security headers

strict-transport-security: max-age=31536000
content-security-policy: sandbox allow-forms allow-same-origin allow-scripts allow-popups allow-popups-to-escape-sandbox allow-presentation allow-top-navigation-by-user-activation; frame-ancestors 'self' *.huffpost.com *.huffingtonpost.com *.huffpost.net *.buzzfeed.com clients.opinary.com compass.pressekompass.net *.newsbreak.com *.newsbreakapp.com *.upday-content.com *.upday.com *.samsung-news.com; report-uri https://huffpost.report-uri.com/r/d/csp/enforce;
x-frame-options: —
x-content-type-options: nosniff
referrer-policy: no-referrer-when-downgrade
permissions-policy: —

other headers

accept-ranges: bytes
age: 14
cache-control: no-store, no-cache, must-revalidate
connection: keep-alive
content-encoding: gzip
content-length: 211403
content-type: text/html; charset=utf-8
date: Sat, 23 May 2026 11:35:33 GMT
document-policy: js-profiling
expires: 0
server: nginx
set-cookie: ccpa=true; expires=Sat, 06 Jun 2026 11:35:33 GMT; path=/; domain=www.huffpost.com;
timing-allow-origin: *
vary: Accept-Encoding
via: 1.1 varnish
x-cache: MISS, HIT
x-cache-hits: 0, 1
x-hp-page-version: 346940
x-hp-webp: false
x-powered-by: Express
x-request-id: 7780e3897c3ba2a69cca8663df0334cd
x-served-by: cache-iad-kiad7000083-IAD, cache-iad-kcgs7200112-IAD
x-timer: S1779536133.017687,VS0,VE4

fetched 2026-05-23T11:35:33.055Z

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

no CORS headers — cross-origin requests blocked by default

Why it matters: Overly permissive CORS (wildcard with credentials, or reflected origin) lets any origin read authenticated responses from this domain. OWASP A05 misconfiguration territory (NIST AC-4).

origin: https://drwho.me
method: GET
preflight status: 301

access-control-* headers

access-control-allow-origin: —
access-control-allow-methods: —
access-control-allow-headers: —
access-control-allow-credentials: —
access-control-max-age: —
access-control-expose-headers: —

no access-control-* headers returned — site does not advertise CORS to this origin

fetched 2026-05-23T11:35:32.835Z

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

HTTPS surface reachable (robots ✓, sitemap ✗, title ✓)

Why it matters: Public files — robots.txt, sitemap.xml, head meta — are what attackers see first during reconnaissance. Misadvertised paths, stale sitemaps, and verbose generators leak more than intended (ISO 27001 A.8.9).

robots.txt

present

# Cambria robots

User-agent: grapeshot
Disallow: /member
Disallow: /*?*err_code=404
Disallow: /search
Disallow: /search/?*

User-agent: *
Disallow: /*?*page=
Disallow: /member
Disallow: /*?*err_code=404
Disallow: /search
Disallow: /search/?*
Disallow: /mapi/v4/*/user/*
Disallow: /embed
Disallow: /*/webview
Disallow: /api

User-agent: Amazonbot
Disallow: /

User-agent: anthropic-ai
Disallow: /

User-agent: Applebot-Extended
Disallow: /

User-agent: Bytespider
Disallow: /

User-agent: CCBot
Disallow: /

User-agent: ChatGPT-User
Disallow: /

User-agent: Claude-Web
Disallow: /

User-agent: ClaudeBot
Disallow: /

User-agent: cohere-ai
Disallow: /

User-agent: Diffbot
Disallow: /

User-agent: DuckAssistBot
Disallow: /

User-agent: FacebookBot
Disallow: /

User-agent: GPTBot
Disallow: /

User-agent: Google-Extended
Disallow: /

User-agent: Googlebot
Allow: /
Disallow: /*?*err_code=404
Disallow: /search
Disallow: /search/?*

User-agent: magpie-crawler
Disallow: /

User-agent: meta-externalagent
Disallow: /

User-agent: Meta-ExternalFetcher
Disallow: /

User-agent: OAI-SearchBot
Disallow: /

User-agent: Perplexity-User
Disallow: /

User-agent: PerplexityBot
Disallow: /

User-agent: Timpibot
Disallow: /

User-agent: TurnitinBot
Disallow: /

User-agent: Ai2Bot-Dolma
Disallow: /

User-agent: Claude-SearchBot
Disallow: /

User-agent: Claude-User
Disallow: /

User-agent: omgilibot
Disallow: /

User-agent: TtoYouBot
Disallow: /

User-agent: WebGPTBot
Disallow: /

User-agent: Scope3/2.0 (scope3.com)
Allow: /$
Allow: /*
Disallow: /*?*page=
Disallow: /member
Disallow: /*?*err_code=404
Disallow: /search
Disallow: /search/?*
Disallow: /mapi/v4/*/user/*
Disallow: /embed
Disallow: /api

User-agent: AmazonAdBot
Allow: /$
Allow: /*
Disallow: /*?*page=
Disallow: /member
Disallow: /*?*err_code=404
Disallow: /search
Disallow: /search/?*
Disallow: /mapi/v4/*/user/*
Disallow: /embed
Disallow: /api

# archives
Sitemap: https://www.huffpost.com/static-assets/isolated/huffpostsitemapgeneratorjob-prod-public/us/sitemaps/sitemap-v1.xml
Sitemap: https://www.huffpost.com/static-assets/isolated/huffpostsitemapgeneratorjob-prod-public/us/sitemaps/sitemap-google-news.xml
Sitemap: https://www.huffpost.com/static-assets/isolated/huffpostsitemapgeneratorjob-prod-public/us/sitemaps/sitemap-google-video.xml
Sitemap: https://www.huffpost.com/static-assets/isolated/huffpostsitemapgeneratorjob-prod-public/us/sitemaps/sections.xml
Sitemap: https://www.huffpost.com/static-assets/isolated/huffpostsitemapgeneratorjob-prod-public/us/sitemaps/sitemap-top-sections.xml

sitemap.xml

absent

head

title: HuffPost - Breaking News, Politics, Entertainment & Opinion
description: Read the latest U.S. and world news, politics, entertainment, lifestyle and opinion pieces from HuffPost’s trusted team of journalists.

social

og:site_name: HuffPost
og:type: website
og:title: HuffPost - Breaking News, U.S. and World News
og:url: https://www.huffpost.com/
og:description: Read the latest U.S. and world news, politics, entertainment, lifestyle and opinion pieces from HuffPost’s trusted team of journalists.
og:image: https://img.huffingtonpost.com/asset/6876d9b316000014e542cf17.jpg
og:image:url: https://img.huffingtonpost.com/asset/6876d9b316000014e542cf17.jpg
og:app_id: 46744042133
twitter:description: Read the latest U.S. and world news, politics, entertainment, lifestyle and opinion pieces from HuffPost’s trusted team of journalists.
twitter:title: HuffPost - Breaking News, U.S. and World News
twitter:site: @HuffPost
twitter:image: https://img.huffingtonpost.com/asset/6876d9b316000014e542cf17.jpg

fetched 2026-05-23T11:35:33.105Z

web-surface

info

Open standalone →

inspecting web surface…

dnssec

low

Open standalone →

DNSSEC not configured — no DS or DNSKEY records found

Why it matters: DNSSEC cryptographically signs DNS responses, blocking cache-poisoning attacks. US federal civilian agencies are required to enable it under OMB M-22-09 (NIST SC-20).

Recommendations

Enable DNSSEC in your DNS provider's control panel and add the resulting DS record at your registrar

enabled: no
DS records: —
DNSKEY records: —

fetched 2026-05-23T11:35:32.850Z

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

not applicable: no _mta-sts TXT record

Why it matters: MTA-STS forces inbound SMTP to use TLS and refuse downgraded connections. Without it, an in-path attacker can strip TLS and read mail in plaintext (SOC 2 CC6.7).

no _mta-sts TXT record

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

not applicable: no TLSRPT record

Why it matters: TLS-RPT publishes a reporting address for SMTP-TLS failures. Without it, downgrade attacks on inbound mail go unnoticed (SOC 2 CC7.2).

no TLSRPT record

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

domain registered until 2028-03-10

Why it matters: Registrar and expiry tell auditors the domain is owned, current, and not about to lapse. An expired or about-to-expire domain fails business-continuity evidence (SOC 2 A1.2).

registrar: MarkMonitor Inc.
created: 2005-03-10T17:07:10Z
expires: 2028-03-10T16:07:10Z
statuses: ok https://icann.org/epp#ok

fetched 2026-05-23T11:35:33.179Z

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

25 subdomain(s) found in CT logs (11 wildcard cert(s))

Why it matters: Every certificate issued for this domain is published in Certificate Transparency logs — including subdomains you may have forgotten. Unknown subdomains in CT are pre-disclosed attack surface (ISO 27001 A.8.16).

source: certspotter
certificates seen: 38
subdomains in CT: 25 discovered (full list in Domain Audit Report)
wildcards: *.assets.huffpost.com, *.elections.huffpost.com, *.huffpost.com, *.login.huffpost.com, *.m.huffpost.com, *.mapi.huffpost.com, *.modulous.huffpost.com, *.preview.www.huffpost.com, *.staging.mobile.huffpost.com, *.widgets.huffpost.com, *.www.huffpost.com

fetched 2026-05-23T11:35:33.692Z

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.