mayoclinic.org

15-check dossier · scoreboard above, section details below

Get a pack →

Scanning…

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

resolving mx…

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

resolving dmarc…

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

tracing redirects…

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

inspecting web surface…

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.

mayoclinic.org

15-check dossier · scoreboard above, section details below

Get a pack →

Mostly compliant · 4 items need attention

Aggregate grade across 15 checks. Auditors typically flag any High-severity finding.

Pass: 11
Warn: 4
Fail: 0

What an auditor would flag first

medium
DMARC
p=none — monitoring only, no enforcement
SOC 2 CC6.7ISO 27001 A.13.2.1
medium
Security headers
5 security header(s) missing
SOC 2 CC6.6ISO 27001 A.14.1.2
low
DKIM
no DKIM selectors found — likely not configured
SOC 2 CC6.7

Need this as an artifact your auditor can verify?

Your mayoclinic.org scan flagged 2 medium and 2 low findings. A signed pack covers the apex plus up to 100 CT-discovered subdomains, Ed25519-signed and ISO-timestamped, delivered in 10–30 minutes.

Get a pack →See methodology See a sample$29

Scanning…

15-check summary

DNS recordsA/AAAA records present
MX4 MX record(s) present
SPF-all hardfail — strict policy
DMARCp=none — monitoring only, no enforcement
DKIMno DKIM selectors found — likely not configured
TLS certificatecert valid for 193 days
Redirect chainHTTPS served correctly
Security headers5 security header(s) missing
CORSno CORS headers — cross-origin requests blocked by default
Web surfaceHTTPS surface reachable (robots ✓, sitemap ✓, title ✓)
MTA-STSnot applicable: no _mta-sts TXT record
TLS-RPTnot applicable: no TLSRPT record
DNSSECDNSSEC not configured — no DS or DNSKEY records found
WHOISdomain registered until 2028-02-09
Certificate Transparencycheck failed: crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

dns

info

Open standalone →

A/AAAA records present

Why it matters: Without authoritative A or AAAA records on the apex, the domain is unreachable. Missing baseline DNS shows up in vendor reviews as evidence of unmanaged infrastructure (SOC 2 CC6.6).

A: ttl=792 129.176.1.88
AAAA: —
NS: ttl=10800 dns1.mayo.edu.
ttl=10800 a13-66.akam.net.
ttl=10800 a14-64.akam.net.
ttl=10800 a18-66.akam.net.
ttl=10800 a1-70.akam.net.
ttl=10800 a10-66.akam.net.
ttl=10800 dns2.mayo.edu.
ttl=10800 a3-66.akam.net.
SOA: ttl=10800 dns1.mayo.edu. noc.mayo.edu. 2779 10800 3600 2592000 900
CAA: —
TXT: ttl=10800 "apple-domain-verification=5FmDAtv2LsDzpMQJbHcPQadpnY8p1YJn5I5oM64bP_k"
ttl=10800 "apple-domain-verification=tB6bZOjVnxrGsvNAUCrbvu8w13vf8gisqEuRLcHvBHY"
ttl=10800 "google-site-verification=RTxl6bpOvfdYSWz8OvWzgQBH7z8MU19_g8HIm0_FvmM"
ttl=10800 "_uz5g1k3wp3my53wj46cfl46g6oxkp54"
ttl=10800 "google-site-verification=ICU8hJAwq3J2ACTSaBwdom6ULZp-485-2jcBAe3MdHY"
ttl=10800 "fastly-domain-delegation-b7wfficndvihh4xc7g4z-782253-2024-06-25"
ttl=10800 "google-site-verification=6vNtdz7ZLqfEYDC2BP1hJKrMY_7QtttXQiTykug1hYA"
ttl=10800 "google-site-verification=c_nY9XkweOjwanwbo_17mAeu3bcE4YM5ow3YLyr2F_Q"
ttl=10800 "v=spf1 mx include:_spf.mayo.edu include:_spf_msgfe_mcmo.mayo.edu -all"
ttl=10800 "google-site-verification=rSQpDFkAgTB3fF4YoIkO1jSJOs7JOlG8CZMzuQJNdxs"
ttl=10800 "facebook-domain-verification=hb879ie9x7og44v8xzca5ea8aywdbn"
ttl=10800 "ncy863bz54x4hbfx0kxpzms73067ls2p"
ttl=10800 "google-site-verification=JKKcK-DB3LxE-lKs2pZjLfa9o--85ahsbeOwD-LDNdY"
ttl=10800 "google-site-verification=4c_u2Bkm2Ukeurbn5E8KNOMWB8mZ13akrsKP4Pf9MLY"

fetched 2026-05-23T11:41:29.814Z

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

4 MX record(s) present

Why it matters: MX records direct inbound mail. Misconfiguration silently breaks email delivery and lets attackers stand up parallel MX hosts for spoofing campaigns (ISO 27001 A.8.21).

pri=10 mail5.mayo.edu.
pri=10 mail3.mayo.edu.
pri=10 mail4.mayo.edu.
pri=10 mail2.mayo.edu.

fetched 2026-05-23T11:41:29.817Z

mx

info

Open standalone →

resolving mx…

spf

info

Open standalone →

-all hardfail — strict policy

Why it matters: SPF tells receiving servers which hosts may send mail for the domain. Without it, any sender can forge the envelope-from — the primary mechanism behind business-email-compromise (SOC 2 CC6.7).

v=spf1 mx include:_spf.mayo.edu include:_spf_msgfe_mcmo.mayo.edu -all

v=spf1
mx
include:_spf.mayo.edu
include:_spf_msgfe_mcmo.mayo.edu
-all

fetched 2026-05-23T11:41:29.815Z

spf

info

Open standalone →

resolving spf…

dmarc

medium

Open standalone →

p=none — monitoring only, no enforcement

Why it matters: DMARC binds SPF and DKIM into an enforceable policy (quarantine or reject) and surfaces spoofing attempts via aggregate reports. `p=none` or absent means spoofing succeeds silently (SOC 2 CC6.7).

Recommendations

Review rua= aggregate reports to confirm legitimate mail passes SPF/DKIM
Move to p=quarantine and then p=reject once mail flow is validated

v=DMARC1; p=none; sp=reject; pct=100; rf=afrf; ri=86400; fo=1; aspf=s; adkim=s; ruf=mailto:dmarc-details@mayo.edu; rua=mailto:dmarc-summary@mayo.edu

v=: DMARC1
p=: none
sp=: reject
pct=: 100
rf=: afrf
ri=: 86400
fo=: 1
aspf=: s
adkim=: s
ruf=: mailto:dmarc-details@mayo.edu
rua=: mailto:dmarc-summary@mayo.edu

fetched 2026-05-23T11:41:29.818Z

dmarc

info

Open standalone →

resolving dmarc…

dkim

low

Open standalone →

no DKIM selectors found — likely not configured

Why it matters: DKIM signs outbound mail so receivers can detect tampering. Missing selectors or rotated-away keys break DMARC alignment and let receivers downgrade trust (ISO 27001 A.8.24).

Recommendations

Enable DKIM signing in your mail provider and publish the provided TXT record
Common selectors: google._domainkey, selector1._domainkey (Microsoft), mail._domainkey

no DKIM record on probed selectors (default, google, k1, selector1, selector2, mxvault)

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

cert valid for 193 days

Why it matters: A valid current TLS certificate is the baseline for data in transit. Expiry, weak chain, or hostname mismatch break HTTPS and fail PCI 4.2.1 / SOC 2 CC6.1.

subject cn:: mwredirects5.mayo.edu
issuer:: Sectigo Public Server Authentication CA OV R40 / Sectigo Limited
valid:: May 18 00:00:00 2026 GMT → Dec 2 23:59:59 2026 GMT
authorized:: yes
sha256:: E1:4A:A6:5B:A3:F5:52:AC:06:96:EC:6B:CF:0D:E8:3C:E2:ED:9B:CC:76:43:CE:48:FE:F3:AC:CD:44:9E:09:40
sans: mwredirects5.mayo.edu
*.edlink.mayo.edu
*.mayo.edu
*.mayoclinic.org
*.mayoclinicplatform.org
*.mayomedicallaboratories.com
*.testcatalog.org
arabic.mayoclinic.org
edlink.mayo.edu
mayo.edu
mayoclinic.com
mayoclinic.org
mayoclinichealthcare.co.uk
mayoclinichealthsystem.org
mayocliniclabs.com
mayoclinicplatform.org
mayoclinicproceedings.org
mayomedicallaboratories.com
store.mayoclinic.org
testcatalog.org
uscovidplasma.org
videotours.mayoclinic.org
www.ce.mayo.edu
www.executiveeducation.mayo.edu
www.healthyliving.mayoclinic.org
www.mayoclinic.com

fetched 2026-05-23T11:41:29.959Z

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

HTTPS served correctly

Why it matters: Bare HTTP requests must redirect to HTTPS without dropping the user mid-chain. Plain-text fallback or open redirects fail PCI 4.2.1 and feed phishing chains (SOC 2 CC6.6).

final status: 200 · 2 hops

[301] https://mayoclinic.org/
[200] https://www.mayoclinic.org/

fetched 2026-05-23T11:41:30.177Z

redirects

info

Open standalone →

tracing redirects…

headers

medium

Open standalone →

5 security header(s) missing

Why it matters: Security headers — HSTS, CSP, X-Frame-Options, Referrer-Policy — defend against XSS, clickjacking, and downgrade attacks. Absent headers map directly to OWASP ASVS V14 findings (ISO 27001 A.8.23).

Recommendations

Add response header — Strict-Transport-Security: max-age=15552000; includeSubDomains
Add response header — Content-Security-Policy: default-src 'self' (tune per app)
Add response header — X-Content-Type-Options: nosniff
Add response header — Referrer-Policy: strict-origin-when-cross-origin
Add permissions-policy response header

final url: https://www.mayoclinic.org/

security headers

strict-transport-security: —
content-security-policy: —
x-frame-options: SAMEORIGIN
x-content-type-options: —
referrer-policy: —
permissions-policy: —

other headers

access-control-allow-origin: *
cache-control: public, max-age=28231
connection: keep-alive, Transfer-Encoding
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Sat, 23 May 2026 11:41:30 GMT
etag: "dplcdr9krdsxjl"
expires: Sat, 23 May 2026 19:32:01 GMT
mayo-origin-source: gcp, gcp
server: Google Frontend
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1779536490002_399280523_2825846833_52_12273_5_14_-";dur=1
set-cookie: bm_sz=AD3D3E3F43907FC72F32847BEB84ECA4~YAAQi4nMF98L3ESeAQAAfe6jVB9MSBwXRD8j7Lml54+04VpxoP98PAlzxWQA319jmLOURCNPJT9k38Y1hf89vBSE+cB+ycVgwLAZ596mW12k/Rl5+6zoEWTBBB1VXLkCSZ9unxXKBIuPWLcimy2wmf6NN46Clagx4/FqE6lpP6bBpZT2MBOj5Zg7w/m9//V3BVix1H60zGGj2oraChioyGTE/ArdIx/qVN2dd+kSPaN1M+RAlmXS+yaj21xXVQI/8gvhNRUDfZSFpBMa4/Fawkaa7SDnHfY2bNqJ3Y6y6RyoWbl49qsIUx+eTji74WhsbbOy3SVODa4KfIZAbMav/oRXorP1/sqW6ItBmjxZ8jUAHL0=~3618886~3360307; Domain=.mayoclinic.org; Path=/; Expires=Sat, 23 May 2026 15:41:30 GMT; Max-Age=14400
transfer-encoding: chunked
vary: Accept-Encoding
x-akamai-transformed: 9 - 0 pmb=mRUM,2
x-cloud-trace-context: projects/ml-fpt-cdh-pub-app-p-811d/traces/92572a64e7c7841158b1d9f579100e25

fetched 2026-05-23T11:41:30.157Z

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

no CORS headers — cross-origin requests blocked by default

Why it matters: Overly permissive CORS (wildcard with credentials, or reflected origin) lets any origin read authenticated responses from this domain. OWASP A05 misconfiguration territory (NIST AC-4).

origin: https://drwho.me
method: GET
preflight status: 301

access-control-* headers

access-control-allow-origin: —
access-control-allow-methods: —
access-control-allow-headers: —
access-control-allow-credentials: —
access-control-max-age: —
access-control-expose-headers: —

no access-control-* headers returned — site does not advertise CORS to this origin

fetched 2026-05-23T11:41:30.000Z

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

HTTPS surface reachable (robots ✓, sitemap ✓, title ✓)

Why it matters: Public files — robots.txt, sitemap.xml, head meta — are what attackers see first during reconnaissance. Misadvertised paths, stale sitemaps, and verbose generators leak more than intended (ISO 27001 A.8.9).

robots.txt

present

User-agent: *
Allow:  /

Disallow: /edu/
Disallow: *.model.json
Disallow: /static/chunks/*
Disallow: /api/*

sitemap: https://www.mayoclinic.org/arabic_condition_consolidated_concepts.xml
sitemap: https://www.mayoclinic.org/arabic_organization_concepts.xml
sitemap: https://www.mayoclinic.org/arabic_patient_consumer_faq.xml
sitemap: https://www.mayoclinic.org/arabic_patient_consumer_recipe.xml
sitemap: https://www.mayoclinic.org/arabic_patient_consumer_video.xml
sitemap: https://www.mayoclinic.org/arabic_patient_consumer_web.xml
sitemap: https://www.mayoclinic.org/arabic_procedure_concepts.xml
sitemap: https://www.mayoclinic.org/chinese_condition_consolidated_concepts.xml
sitemap: https://www.mayoclinic.org/chinese_organization_concepts.xml
sitemap: https://www.mayoclinic.org/chinese_patient_consumer_faq.xml
sitemap: https://www.mayoclinic.org/chinese_patient_consumer_recipe.xml
sitemap: https://www.mayoclinic.org/chinese_patient_consumer_video.xml
sitemap: https://www.mayoclinic.org/chinese_patient_consumer_web.xml
sitemap: https://www.mayoclinic.org/chinese_procedure_concepts.xml
sitemap: https://www.mayoclinic.org/condition_consolidated_concepts.xml
sitemap: https://www.mayoclinic.org/london.xml
sitemap: https://www.mayoclinic.org/organization_concepts.xml
sitemap: https://www.mayoclinic.org/patient_consumer_biography.xml
sitemap: https://www.mayoclinic.org/patient_consumer_drug.xml
sitemap: https://www.mayoclinic.org/patient_consumer_faq.xml
sitemap: https://www.mayoclinic.org/patient_consumer_recipe.xml
sitemap: https://www.mayoclinic.org/symptoms_all.xml
sitemap: https://www.mayoclinic.org/patient_consumer_video.xml
sitemap: https://www.mayoclinic.org/patient_consumer_web.xml
sitemap: https://www.mayoclinic.org/procedure_concepts.xml
sitemap: https://www.mayoclinic.org/spanish_condition_consolidated_concepts.xml
sitemap: https://www.mayoclinic.org/spanish_organization_concepts.xml
sitemap: https://www.mayoclinic.org/spanish_patient_consumer_faq.xml
sitemap: https://www.mayoclinic.org/spanish_patient_consumer_recipe.xml
sitemap: https://www.mayoclinic.org/spanish_patient_consumer_video.xml
sitemap: https://www.mayoclinic.org/spanish_patient_consumer_web.xml
sitemap: https://www.mayoclinic.org/spanish_procedure_concepts.xml

sitemap.xml

present — 0 url(s)

head

title: The world's best hospital - Mayo Clinic
description: Mayo Clinic is the No. 1 hospital in the world., with campuses in Arizona, Florida, and Minnesota

social

og:title: The world's best hospital
og:url: https://www.mayoclinic.org
og:image: https://www.mayoclinic.org/-/media/Web/GBS/Shared/Images/SocialMedia-Metadata/MC_TwitterCard_120x120.jpg
og:type: article
og:site_name: Mayo Clinic

fetched 2026-05-23T11:41:30.200Z

web-surface

info

Open standalone →

inspecting web surface…

dnssec

low

Open standalone →

DNSSEC not configured — no DS or DNSKEY records found

Why it matters: DNSSEC cryptographically signs DNS responses, blocking cache-poisoning attacks. US federal civilian agencies are required to enable it under OMB M-22-09 (NIST SC-20).

Recommendations

Enable DNSSEC in your DNS provider's control panel and add the resulting DS record at your registrar

enabled: no
DS records: —
DNSKEY records: —

fetched 2026-05-23T11:41:29.823Z

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

not applicable: no _mta-sts TXT record

Why it matters: MTA-STS forces inbound SMTP to use TLS and refuse downgraded connections. Without it, an in-path attacker can strip TLS and read mail in plaintext (SOC 2 CC6.7).

no _mta-sts TXT record

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

not applicable: no TLSRPT record

Why it matters: TLS-RPT publishes a reporting address for SMTP-TLS failures. Without it, downgrade attacks on inbound mail go unnoticed (SOC 2 CC7.2).

no TLSRPT record

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

domain registered until 2028-02-09

Why it matters: Registrar and expiry tell auditors the domain is owned, current, and not about to lapse. An expired or about-to-expire domain fails business-continuity evidence (SOC 2 A1.2).

registrar: CSC Corporate Domains, Inc.
created: 1997-02-08T05:00:00Z
expires: 2028-02-09T05:00:00Z
statuses: serverDeleteProhibited https://icann.org/epp#serverDeleteProhibited, clientTransferProhibited https://icann.org/epp#clientTransferProhibited, serverTransferProhibited https://icann.org/epp#serverTransferProhibited, serverUpdateProhibited https://icann.org/epp#serverUpdateProhibited

fetched 2026-05-23T11:41:29.996Z

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

check failed: crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

Why it matters: Every certificate issued for this domain is published in Certificate Transparency logs — including subdomains you may have forgotten. Unknown subdomains in CT are pre-disclosed attack surface (ISO 27001 A.8.16).

crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.