lefigaro.fr

15-check dossier · scoreboard above, section details below

Get a pack →

Scanning…

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

resolving mx…

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

resolving dmarc…

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

tracing redirects…

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

inspecting web surface…

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.

lefigaro.fr

15-check dossier · scoreboard above, section details below

Get a pack →

Mostly compliant · 4 items need attention

Aggregate grade across 15 checks. Auditors typically flag any High-severity finding.

Pass: 11
Warn: 4
Fail: 0

What an auditor would flag first

medium
SPF
~all softfail — receivers may still accept
SOC 2 CC6.7ISO 27001 A.13.2.1
medium
DMARC
p=none — monitoring only, no enforcement
SOC 2 CC6.7ISO 27001 A.13.2.1
low
DKIM
1/6 DKIM selectors valid
SOC 2 CC6.7

Need this as an artifact your auditor can verify?

Your lefigaro.fr scan flagged 2 medium and 2 low findings. A signed pack covers the apex plus up to 100 CT-discovered subdomains, Ed25519-signed and ISO-timestamped, delivered in 10–30 minutes.

Get a pack →See methodology See a sample$29

Scanning…

15-check summary

DNS recordsA/AAAA records present
MX4 MX record(s) present
SPF~all softfail — receivers may still accept
DMARCp=none — monitoring only, no enforcement
DKIM1/6 DKIM selectors valid
TLS certificatecert valid for 262 days
Redirect chainHTTPS served correctly
Security headers3 security header(s) missing
CORSno CORS headers — cross-origin requests blocked by default
Web surfaceHTTPS surface reachable (robots ✓, sitemap ✗, title ✓)
MTA-STSnot applicable: no _mta-sts TXT record
TLS-RPTnot applicable: no TLSRPT record
DNSSECDNSSEC not configured — no DS or DNSKEY records found
WHOISdomain registered until 2027-03-01
Certificate Transparencycheck failed: crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

dns

info

Open standalone →

A/AAAA records present

Why it matters: Without authoritative A or AAAA records on the apex, the domain is unreachable. Missing baseline DNS shows up in vendor reviews as evidence of unmanaged infrastructure (SOC 2 CC6.6).

A: ttl=20 23.48.203.108
ttl=20 23.48.203.106
AAAA: ttl=20 2600:1408:5400:35::17ca:e6c5
ttl=20 2600:1408:5400:35::17ca:e6d3
NS: ttl=1778 a8-65.akam.net.
ttl=1778 a3-64.akam.net.
ttl=1778 a16-64.akam.net.
ttl=1778 a2-67.akam.net.
ttl=1778 a1-194.akam.net.
ttl=1778 a5-67.akam.net.
SOA: ttl=3600 dns1.sdv.fr. hostmaster.sdv.fr. 2020065104 28800 7200 1209600 345600
CAA: —
TXT: ttl=60 "IBu3jMz7KVPJMR88ZwPpJc4iti4V4mv+DzZ2o7JbojV0rovo79zvnOokS5oWKzj+d3rT9OkajaWxMsetodoudQ=="
ttl=60 "google-site-verification=w2EanEF91PjxeKqcaaD5cuKEr5gGnz2jKrEjsr_Qj7s"
ttl=60 "google-site-verification=-1BUQoGXQ5jdOXhiIOL6leiNMv5xhsxroU7jgM1V6Ds"
ttl=60 "riot-domain-verification=8da5ec2aac2397693163a54c03e5d4c50d3f77bdb29f0c5f35b0a5657cd1"
ttl=60 "_globalsign-domain-verification=0TI971FUy4ENADzJfWkkaB6dNzYd4HLFiVroVdbzsX"
ttl=60 "1password-site-verification=SKPRTGAAOVCTBN46HNHMWOA32I"
ttl=60 "Sendinblue-code:d32083329f36113ef0a449260aa67ecf"
ttl=60 "extensis-domain-verification=c2452127-097b-49cb-a499-5a7790849a38"
ttl=60 "atlassian-domain-verification=zAtM28kjDB7AHlXxEWPBKHMhG7UuLD3HXHr29csvimhNkBEFqbgod6rbk36N5aIo"
ttl=60 "perplexity-ai-domain-verification-r0sv63=pNfjWuho4IP32c8gnTmzePNIw"
ttl=60 "adobe-idp-site-verification=7876e86b-4a20-4e31-92d6-1d75aeb8f194"
ttl=60 "v=spf1 ip4:213.41.17.153/32" " include:_spf1.lefigaro.fr" " include:areyounet.com include:mail.zendesk.com include:spf.mandrillapp.com include:spf.protection.outlook.com include:mx.ovh.com include:_spf.qualtrics.com include:spf.sendinblue.com ~all"
ttl=60 "pinterest-site-verification=bf6f31c7454cdafd752567f089505bd9"
ttl=60 "MS=ms69653602"
ttl=60 "jamf-site-verification=5faHEWWqbG9NcaiZIdMd4A"
ttl=60 "cisco-ci-domain-verification=18f31a70f948bbaa05b65ceb8801d6846519061786bf1a7df7df16fed6069d59"
ttl=60 "anthropic-domain-verification-4zyx2b=NgPJeWp1rwygTyu4FJonpDoaD"

fetched 2026-05-23T09:31:04.278Z

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

4 MX record(s) present

Why it matters: MX records direct inbound mail. Misconfiguration silently breaks email delivery and lets attackers stand up parallel MX hosts for spoofing campaigns (ISO 27001 A.8.21).

pri=10 mail1.groupefigaro.com.
pri=10 mail2.groupefigaro.com.
pri=50 rsmtp2.le-figaro.com.
pri=50 rsmtp1.le-figaro.com.

fetched 2026-05-23T09:31:04.275Z

mx

info

Open standalone →

resolving mx…

spf

medium

Open standalone →

~all softfail — receivers may still accept

Why it matters: SPF tells receiving servers which hosts may send mail for the domain. Without it, any sender can forge the envelope-from — the primary mechanism behind business-email-compromise (SOC 2 CC6.7).

Recommendations

Move to -all (hardfail) once your mail flow is confirmed — softfail gives no real protection

v=spf1 ip4:213.41.17.153/32 include:_spf1.lefigaro.fr include:areyounet.com include:mail.zendesk.com include:spf.mandrillapp.com include:spf.protection.outlook.com include:mx.ovh.com include:_spf.qualtrics.com include:spf.sendinblue.com ~all

v=spf1
ip4:213.41.17.153/32
include:_spf1.lefigaro.fr
include:areyounet.com
include:mail.zendesk.com
include:spf.mandrillapp.com
include:spf.protection.outlook.com
include:mx.ovh.com
include:_spf.qualtrics.com
include:spf.sendinblue.com
~all

fetched 2026-05-23T09:31:04.277Z

spf

info

Open standalone →

resolving spf…

dmarc

medium

Open standalone →

p=none — monitoring only, no enforcement

Why it matters: DMARC binds SPF and DKIM into an enforceable policy (quarantine or reject) and surfaces spoofing attempts via aggregate reports. `p=none` or absent means spoofing succeeds silently (SOC 2 CC6.7).

Recommendations

Review rua= aggregate reports to confirm legitimate mail passes SPF/DKIM
Move to p=quarantine and then p=reject once mail flow is validated

v=DMARC1; p=none; sp=none; rua=mailto:dmarcreports@ops.lefigaro.fr,mailto:dmarc_reports@lefigaro.fr!10m; ruf=mailto:dmarcreports@ops.lefigaro.fr,mailto:dmarc_reports@lefigaro.fr!10m; rf=afrf; pct=100; ri=86400; fo=1

v=: DMARC1
p=: none
sp=: none
rua=: mailto:dmarcreports@ops.lefigaro.fr,mailto:dmarc_reports@lefigaro.fr!10m
ruf=: mailto:dmarcreports@ops.lefigaro.fr,mailto:dmarc_reports@lefigaro.fr!10m
rf=: afrf
pct=: 100
ri=: 86400
fo=: 1

fetched 2026-05-23T09:31:04.276Z

dmarc

info

Open standalone →

resolving dmarc…

dkim

low

Open standalone →

1/6 DKIM selectors valid

Why it matters: DKIM signs outbound mail so receivers can detect tampering. Missing selectors or rotated-away keys break DMARC alignment and let receivers downgrade trust (ISO 27001 A.8.24).

Recommendations

Check the missing selectors in your DNS provider and re-add any removed records

default:: —
google:: —
k1:: —
selector1:: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA/Ok9GrQBw6Mqp5zwkaBhfYNeMoIVswiTVkVjLCsPW7unQBekgj2B6EsGAI2BFwjx+ekwG2I7N0a1IUQweP20DvkdLzEvxRd1Zhxjnx7RoUWb8Pb5ZbLVQrdFdHjW15WPqcNX/eavkMsNa2NZQzHBSpVwf34Z0P3j8rsuIsf8cnvS1t+GI3T+bqTfXXGZTFnf9QynpU/IQXQkPMt1/MFyX9+z2Wy7XdBjf9MCzhoaoRCAllmWlMTBi/PQuA1etKL6lX1Rayq7lFJIm+dTi98aOWr327FT+iDct8GImUbtH3GIxmEmn6GtX0vj4bx5bjnmleqtDlwshzdVcxagMNYRPQIDAQAB;
selector2:: —
mxvault:: —

fetched 2026-05-23T09:31:04.292Z

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

cert valid for 262 days

Why it matters: A valid current TLS certificate is the baseline for data in transit. Expiry, weak chain, or hostname mismatch break HTTPS and fail PCI 4.2.1 / SOC 2 CC6.1.

subject cn:: lefigaro.fr
issuer:: DigiCert Global G3 TLS ECC SHA384 2020 CA1 / DigiCert Inc
valid:: Feb 9 00:00:00 2026 GMT → Feb 9 23:59:59 2027 GMT
authorized:: yes
sha256:: 44:D4:76:6E:7C:02:E1:6C:95:EB:49:36:92:2D:5B:33:56:D2:32:F0:93:46:70:4A:EF:C9:F1:C8:23:E9:D6:15
sans: lefigaro.fr
*.avis-vin.lefigaro.fr
*.blog.lefigaro.fr
*.dev.gala.fr
*.dev.lefigaro.fr
*.dev.verso.lefigaro.fr
*.f1g.fr
*.figapp.lefigaro.fr
*.gala.fr
*.go.lefigaro.fr
*.lefig.net
*.lefigaro.dev
*.lefigaro.fr
*.leparticulier.fr
*.madame.lefigaro.fr
*.moncompte.lefigaro.fr
*.preprod.verso.lefigaro.fr
*.sante.lefigaro.fr
*.sport24.lefigaro.fr
*.stage.verso.lefigaro.fr
*.tvmag.lefigaro.fr
*.verso.lefigaro.fr
gala.fr
leparticulier.fr

fetched 2026-05-23T09:31:04.330Z

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

HTTPS served correctly

Why it matters: Bare HTTP requests must redirect to HTTPS without dropping the user mid-chain. Plain-text fallback or open redirects fail PCI 4.2.1 and feed phishing chains (SOC 2 CC6.6).

final status: 200 · 2 hops

[301] https://lefigaro.fr/
[200] https://www.lefigaro.fr/

fetched 2026-05-23T09:31:04.460Z

redirects

info

Open standalone →

tracing redirects…

headers

info

Open standalone →

3 security header(s) missing

Why it matters: Security headers — HSTS, CSP, X-Frame-Options, Referrer-Policy — defend against XSS, clickjacking, and downgrade attacks. Absent headers map directly to OWASP ASVS V14 findings (ISO 27001 A.8.23).

Recommendations

Add response header — X-Content-Type-Options: nosniff
Add response header — Referrer-Policy: strict-origin-when-cross-origin
Add permissions-policy response header

final url: https://www.lefigaro.fr/

security headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: upgrade-insecure-requests
x-frame-options: sameorigin
x-content-type-options: —
referrer-policy: —
permissions-policy: —

other headers

accept-ranges: bytes
access-control-allow-private-network: true
cache-control: max-age=0, no-cache, private
connection: keep-alive
content-encoding: gzip
content-length: 170224
content-type: text/html; charset=UTF-8
date: Sat, 23 May 2026 09:31:04 GMT
edge-cache-tag-truncated: 1
expires: Sat, 23 May 2026 09:31:04 GMT
link: <https://static.lefigaro.fr/figconsent/figconsent-v2-short-ttl.js>; rel="preload"; as="script",</build/modern/js/initial-vendors.06c23c6a7ac0a6ac.js>; rel="preload"; integrity="sha384-B2KJVdTO3HO/1WbcYnIqmIXyegl/1Q2VcJqP29KK4S12a9K4Hdh9wR15if1E116P"; as="script"; crossorigin="anonymous",</build/modern/js/initial-helpers.deed2ef2f2d0de13.js>; rel="preload"; integrity="sha384-bwmCnw3DGeXF4ndEyDgwPzmPf6UsU3ubcaYnqFsv5gvuZChTbVJQUftN4clRUoG5"; as="script"; crossorigin="anonymous",</build/modern/js/globals/handleFiganalytics.0d877b540b10a49a.js>; rel="preload"; integrity="sha384-tC8PfcPasdwNsSC2lP0vZOnDxfYWegAmFQ2MIiNMFEX4rrDwHGQ7pz8NoQDJXkvN"; as="script"; crossorigin="anonymous",<https://static.lefigaro.fr/figanalytics/figanalytics-short-ttl.js>; rel="preload"; as="script",<https://static.lefigaro.fr/common/fonts/SourceSansPro/sourcesanspro-semibold.woff2>; rel="preload"; as="font"; crossorigin="anonymous",<https://static.lefigaro.fr/common/fonts/SourceSansPro/sourcesanspro-regular.woff2>; rel="preload"; as="font"; crossorigin="anonymous",<https://static.lefigaro.fr/common/fonts/NotoSerif/notoserif-bold.woff2>; rel="preload"; as="font"; crossorigin="anonymous",<https://static.lefigaro.fr>; rel="preconnect",<https://i.f1g.fr>; rel="preconnect",<https://collector.appconsent.io>; rel="preconnect",<https://cdn.appconsent.io/tcf2-clear/current/core.bundle.js>; rel="preload"; as="script",<https://www.googletagmanager.com>; rel="dns-prefetch",<https://cdn.appconsent.io>; rel="dns-prefetch",<https://static.lefigaro.fr/header/js/figh-index.d43b025.js>; rel="preload"; as="script"
pragma: no-cache
vary: Accept-Encoding
x-left-ttl: 9
x-premium: 0
x-real-age: 93
x-shard-target: proxy1
x-xss-protection: 1; mode=block

fetched 2026-05-23T09:31:04.400Z

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

no CORS headers — cross-origin requests blocked by default

Why it matters: Overly permissive CORS (wildcard with credentials, or reflected origin) lets any origin read authenticated responses from this domain. OWASP A05 misconfiguration territory (NIST AC-4).

origin: https://drwho.me
method: GET
preflight status: 501

access-control-* headers

access-control-allow-origin: —
access-control-allow-methods: —
access-control-allow-headers: —
access-control-allow-credentials: —
access-control-max-age: —
access-control-expose-headers: —

no access-control-* headers returned — site does not advertise CORS to this origin

fetched 2026-05-23T09:31:04.386Z

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

HTTPS surface reachable (robots ✓, sitemap ✗, title ✓)

Why it matters: Public files — robots.txt, sitemap.xml, head meta — are what attackers see first during reconnaissance. Misadvertised paths, stale sitemaps, and verbose generators leak more than intended (ISO 27001 A.8.9).

robots.txt

present

# Toute utilisation de nos contenus protégés autre qu'un usage strictement individuel (incluant notamment l'entraînement des grands modèles de langage (LLM),
# l'entraînement des outils d'intelligence artificielle, la veille web ou le media monitoring) est conditionnée à la conclusion d'une licence d'utilisation
# avec la SOCIETE DU FIGARO. Nous vous invitons à cette fin à contacter syndication-service@lefigaro.fr.
#
# Toute utilisation non-autorisée de nos contenus protégés est constitutive d'une contrefaçon de droit d'auteur et/ou du droit de producteur
# de base de données et susceptible d'être poursuivie.
#
# Il est interdit de crawler notre site web en utilisant un agent d'utilisateur (user agent) volé qui ne correspond pas à votre identité.
# L'utilisation des robots d'indexation web ou d'autres méthodes automatiques de feuilletage ou de navigation sur ce site Web n'est pas autorisée.

User-agent: *
Disallow: /async/
Disallow: /*?noheader*
Disallow: /*?*&noheader*
Disallow: /*?sfdebug*
Disallow: /*?*&sfdebug*
Disallow: /brouillon/
Disallow: /proxy/
Disallow: /synsearch/
Disallow: /a-savoir-en-france/
Disallow: /vos-questions

#LLM
User-agent: ChatGPT-User
Allow: /voyages
Allow: /culture
Allow: /style
Allow: /bons-plans
Allow: /elections/resultats
Disallow: /

User-agent: Claude-SearchBot
Allow: /voyages
Allow: /bons-plans
Allow: /elections/resultats
Disallow: /

User-agent: Claude-Web
Allow: /voyages
Allow: /bons-plans
Allow: /elections/resultats
Disallow: /

User-agent: OAI-SearchBot
Allow: /voyages
Allow: /culture
Allow: /style
Allow: /bons-plans
Allow: /elections/resultats
Disallow: /

User-agent: Claude-User
Allow: /voyages
Allow: /bons-plans
Allow: /elections/resultats
Disallow: / 

User-agent: ChatGPT Agent
Allow: /voyages
Allow: /bons-plans
Allow: /elections/resultats
Disallow: / 

User-agent: GoogleAgent-Mariner
Allow: /voyages
Allow: /bons-plans
Allow: /elections/resultats
Disallow: / 

User-agent: Google-NotebookLM
Allow: /voyages
Allow: /bons-plans
Allow: /elections/resultats
Disallow: / 

User-agent: Google-CloudVertexBot
Allow: /voyages
Allow: /bons-plans
Allow: /elections/resultats
Disallow: / 

User-agent: MistralAI-User
Allow: /voyages
Allow: /bons-plans
Allow: /elections/resultats
Disallow: /

User-agent: Gemini-Deep-Research
Allow: /voyages
Allow: /bons-plans
Allow: /elections/resultats
Disallow: /

User-agent: CloudVertexBot
Disallow: /

User-agent: anthropic-ai
Disallow: /

User-agent: Bytespider
Disallow: /

User-agent: CCBot
Disallow: /

User-agent: ClaudeBot
Disallow: /

User-agent: cohere-ai
Disallow: /

User-agent: GPTBot
Disallow: /

User-agent: Google-Extended
Disallow: /

#Crawler
User-agent: Alexibot
Disallow: /

User-agent: AlvinetSpider
Disallow: /

User-agent: AmiSoftware
Disallow: /

User-agent: Antenne Hatena
Disallow: /

User-agent: ApocalXExplorerBot
Disallow: /

User-agent: Argus
Disallow: /

User-agent: Ask n read
Disallow: /

User-agent: asknread.com
Disallow: /

User-agent: asterias
Disallow: /

User-agent: BlowFish/1.0
Disallow: /

User-agent: BotALot
Disallow: /

User-agent: BuiltBotTough
Disallow: /

User-agent: Bullseye/1.0
Disallow: /

User-agent: BunnySlippers
Disallow: /

User-agent: Cegbfeieh
Disallow: /

User-agent: CheeseBot
Disallow: /

User-agent: ConveraCrawler
Disallow: /

User-agent: cosmos
Disallow: /

User-agent: Crescent
Disallow: /

User-agent: Crescent Internet ToolPak HTTP OLE Control v.1.0
Disallow: /

User-agent: cydralspider
Disallow: /

User-agent: DISCo Pump 3.1
Disallow: /

User-agent: DittoSpyder
Disallow: /

User-agent: EroCrawler
Disallow: /

User-agent: eureka
Disallow: /

User-agent: Explore
Disallow: /

User-agent: Fetch
Disallow: /

User-agent: Flamingo_SearchEngine
Disallow: /

User-agent: Foobot
Disallow: /

User-agent: gammaSpider
Disallow: /

User-agent: grub-client
Disallow: /

User-agent: hloader
Disallow: /

User-agent: httpl

sitemap.xml

absent

head

title: Le Figaro - Actualité en direct et informations en continu
description: —

social

no OpenGraph or Twitter meta tags found

fetched 2026-05-23T09:31:04.779Z

web-surface

info

Open standalone →

inspecting web surface…

dnssec

low

Open standalone →

DNSSEC not configured — no DS or DNSKEY records found

Why it matters: DNSSEC cryptographically signs DNS responses, blocking cache-poisoning attacks. US federal civilian agencies are required to enable it under OMB M-22-09 (NIST SC-20).

Recommendations

Enable DNSSEC in your DNS provider's control panel and add the resulting DS record at your registrar

enabled: no
DS records: —
DNSKEY records: —

fetched 2026-05-23T09:31:04.289Z

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

not applicable: no _mta-sts TXT record

Why it matters: MTA-STS forces inbound SMTP to use TLS and refuse downgraded connections. Without it, an in-path attacker can strip TLS and read mail in plaintext (SOC 2 CC6.7).

no _mta-sts TXT record

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

not applicable: no TLSRPT record

Why it matters: TLS-RPT publishes a reporting address for SMTP-TLS failures. Without it, downgrade attacks on inbound mail go unnoticed (SOC 2 CC7.2).

no TLSRPT record

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

domain registered until 2027-03-01

Why it matters: Registrar and expiry tell auditors the domain is owned, current, and not about to lapse. An expired or about-to-expire domain fails business-continuity evidence (SOC 2 A1.2).

registrar: NAMESHIELD
created: 1996-08-13T22:00:00Z
expires: 2027-03-01T10:09:30Z
statuses: clientTransferProhibited

fetched 2026-05-23T09:31:04.776Z

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

check failed: crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

Why it matters: Every certificate issued for this domain is published in Certificate Transparency logs — including subdomains you may have forgotten. Unknown subdomains in CT are pre-disclosed attack surface (ISO 27001 A.8.16).

crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.