medicalnewstoday.com

15-check dossier · scoreboard above, section details below

Get a pack →

Scanning…

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

resolving mx…

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

resolving dmarc…

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

tracing redirects…

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

inspecting web surface…

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.

medicalnewstoday.com

15-check dossier · scoreboard above, section details below

Get a pack →

A-

Audit-ready · 3 minor advisories

Aggregate grade across 15 checks. Auditors typically flag any High-severity finding.

Pass: 12
Warn: 3
Fail: 0

What an auditor would flag first

low
DKIM
1/6 DKIM selectors valid
SOC 2 CC6.7
low
Security headers
5 security header(s) missing
SOC 2 CC6.6ISO 27001 A.14.1.2
low
DNSSEC
DNSSEC not configured — no DS or DNSKEY records found
SOC 2 CC6.6ISO 27001 A.13.1.1

Need this as an artifact your auditor can verify?

Your medicalnewstoday.com scan flagged 3 low findings. A signed pack covers the apex plus up to 100 CT-discovered subdomains, Ed25519-signed and ISO-timestamped, delivered in 10–30 minutes.

Get a pack →See methodology See a sample$29

Scanning…

15-check summary

DNS recordsA/AAAA records present
MX1 MX record(s) present
SPF-all hardfail — strict policy
DMARCp=reject — strict policy
DKIM1/6 DKIM selectors valid
TLS certificatecert valid for 148 days
Redirect chainHTTPS served correctly
Security headers5 security header(s) missing
CORSno CORS headers — cross-origin requests blocked by default
Web surfaceHTTPS surface reachable (robots ✓, sitemap ✓, title ✓)
MTA-STSnot applicable: no _mta-sts TXT record
TLS-RPTnot applicable: no TLSRPT record
DNSSECDNSSEC not configured — no DS or DNSKEY records found
WHOISdomain registered until 2026-11-05
Certificate Transparencycheck failed: crt.sh: Error: crt.sh http 502; certspotter: Error: certspotter http 429

dns

info

Open standalone →

A/AAAA records present

Why it matters: Without authoritative A or AAAA records on the apex, the domain is unreachable. Missing baseline DNS shows up in vendor reviews as evidence of unmanaged infrastructure (SOC 2 CC6.6).

A: ttl=60 3.167.69.117
ttl=60 3.167.69.18
ttl=60 3.167.69.106
ttl=60 3.167.69.76
AAAA: —
NS: ttl=168945 ns-1089.awsdns-08.org.
ttl=168945 ns-145.awsdns-18.com.
ttl=168945 ns-1618.awsdns-10.co.uk.
ttl=168945 ns-939.awsdns-53.net.
SOA: ttl=900 ns-1089.awsdns-08.org. awsdns-hostmaster.amazon.com. 1 7200 900 1209600 86400
CAA: —
TXT: ttl=300 "MS=ms46353610"
ttl=300 "MS=ms66481913"
ttl=300 "_globalsign-domain-verification=gxDZTHFxmg56fm5vMzUelQcu7UZSnIYHxvoZHAUJYR"
ttl=300 "c85b6dabed7846b1e154ab13034b2144.medicalnewstoday.com"
ttl=300 "faohc8qu5e3lr7skckic2cvjfn"
ttl=300 "google-site-verification=1Xn1W1GJxe6Pjgh8zKj59_pmRycNsp-oRjAa_g_TPrI"
ttl=300 "google-site-verification=7kYX9RrRzjWH0qSRLx0JRx-fFWA5t55RFlrpUc5k9cc"
ttl=300 "google-site-verification=MDpghCeMQngwoJjCqwsd23fpEXxfROvOjEGdOFnQA84"
ttl=300 "google-site-verification=XwAJ8gS4ghfdIeug_ChZ83cRvm5_5CuC_pdS_74KFmw"
ttl=300 "google-site-verification=mLovNHxFZkuB78n27bVJj1nTociFUrzz_X0G_bwmwXY"
ttl=300 "google-site-verification=uxsvzvOCGqJ3k1UwCYrg2znY3xsCbBVBjXA1IqxpM0M"
ttl=300 "google-site-verification=zDcdVQX19UcJF3au4Y9dufYQ21FmMiWrpw_ItoOOf5Q"
ttl=300 "v=spf1 include:_spf.google.com include:aspmx.sailthru.com include:spf.protection.outlook.com -all"

fetched 2026-05-23T09:41:25.762Z

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

1 MX record(s) present

Why it matters: MX records direct inbound mail. Misconfiguration silently breaks email delivery and lets attackers stand up parallel MX hosts for spoofing campaigns (ISO 27001 A.8.21).

pri=1 medicalnewstoday-com.mail.protection.outlook.com.

fetched 2026-05-23T09:41:25.661Z

mx

info

Open standalone →

resolving mx…

spf

info

Open standalone →

-all hardfail — strict policy

Why it matters: SPF tells receiving servers which hosts may send mail for the domain. Without it, any sender can forge the envelope-from — the primary mechanism behind business-email-compromise (SOC 2 CC6.7).

v=spf1 include:_spf.google.com include:aspmx.sailthru.com include:spf.protection.outlook.com -all

v=spf1
include:_spf.google.com
include:aspmx.sailthru.com
include:spf.protection.outlook.com
-all

fetched 2026-05-23T09:41:25.661Z

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

p=reject — strict policy

Why it matters: DMARC binds SPF and DKIM into an enforceable policy (quarantine or reject) and surfaces spoofing attempts via aggregate reports. `p=none` or absent means spoofing succeeds silently (SOC 2 CC6.7).

v=DMARC1; p=reject; rua=mailto:ne5tw8jz@ag.us.dmarcian.com; ruf=mailto:ne5tw8jz@fr.us.dmarcian.com;

v=: DMARC1
p=: reject
rua=: mailto:ne5tw8jz@ag.us.dmarcian.com
ruf=: mailto:ne5tw8jz@fr.us.dmarcian.com

fetched 2026-05-23T09:41:25.662Z

dmarc

info

Open standalone →

resolving dmarc…

dkim

low

Open standalone →

1/6 DKIM selectors valid

Why it matters: DKIM signs outbound mail so receivers can detect tampering. Missing selectors or rotated-away keys break DMARC alignment and let receivers downgrade trust (ISO 27001 A.8.24).

Recommendations

Check the missing selectors in your DNS provider and re-add any removed records

default:: —
google:: —
k1:: —
selector1:: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA5+aGNVvBOsKvgW3ujOoOwrufffT10xY8hOwCvAa1uJ1wzOXDS6zNR0kBYeMOPJ+lLsMSAqP6TrIy0Hd2rrVVAs9bP/EqYpFV+vRFXerjUdUjCwt+ZDiTd1ShgvD8QOEXJizYoRiN5WBvu9cEmQyNP8CuKMNP3Gap9I6Ruxh4b5hGwMGXNJMPvxkwGqpxynoeRcKHsMPUg8myyHoh3ahEkeg5TSqBO7G7nDL232rjlc4JST9K1fV2PbOUcTmyrKlfqhuszMRiFulnHL8cws3M7zzxZCpm2SVRr4TsXwTrU7uPadyT3C8XownEgndEIITEGKwh6k5bacZzwTNgVdPrUQIDAQAB;
selector2:: —
mxvault:: —

fetched 2026-05-23T09:41:25.799Z

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

cert valid for 148 days

Why it matters: A valid current TLS certificate is the baseline for data in transit. Expiry, weak chain, or hostname mismatch break HTTPS and fail PCI 4.2.1 / SOC 2 CC6.1.

subject cn:: *.medicalnewstoday.com
issuer:: Amazon RSA 2048 M01 / Amazon
valid:: Sep 20 00:00:00 2025 GMT → Oct 18 23:59:59 2026 GMT
authorized:: yes
sha256:: 6E:D5:43:CE:DA:8D:8E:16:15:C2:CC:3B:38:AF:9E:DF:28:43:A5:B5:DF:31:4A:B2:FB:54:E0:EE:F1:46:AA:9B
sans: *.medicalnewstoday.com
medicalnewstoday.com

fetched 2026-05-23T09:41:25.586Z

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

HTTPS served correctly

Why it matters: Bare HTTP requests must redirect to HTTPS without dropping the user mid-chain. Plain-text fallback or open redirects fail PCI 4.2.1 and feed phishing chains (SOC 2 CC6.6).

final status: 200 · 2 hops

[301] https://medicalnewstoday.com/
[200] https://www.medicalnewstoday.com/

fetched 2026-05-23T09:41:26.032Z

redirects

info

Open standalone →

tracing redirects…

headers

low

Open standalone →

5 security header(s) missing

Why it matters: Security headers — HSTS, CSP, X-Frame-Options, Referrer-Policy — defend against XSS, clickjacking, and downgrade attacks. Absent headers map directly to OWASP ASVS V14 findings (ISO 27001 A.8.23).

Recommendations

Add response header — Content-Security-Policy: default-src 'self' (tune per app)
Add response header — X-Frame-Options: DENY (or SAMEORIGIN if framing is intended)
Add response header — X-Content-Type-Options: nosniff
Add response header — Referrer-Policy: strict-origin-when-cross-origin
Add permissions-policy response header

final url: https://www.medicalnewstoday.com/

security headers

strict-transport-security: max-age=31536000; includeSubDomains
content-security-policy: —
x-frame-options: —
x-content-type-options: —
referrer-policy: —
permissions-policy: —

other headers

cache-control: max-age=300, must-revalidate, private
connection: keep-alive
content-encoding: gzip
content-security-policy-report-only: frame-ancestors 'self'; object-src 'none'; report-uri /api/csp-reporting
content-type: text/html; charset=utf-8
date: Sat, 23 May 2026 09:41:25 GMT
set-cookie: blab=ab3e8210-79da-4f47-aab0-6c203d888750; Max-Age=315360000; Expires=Tue, 20 May 2036 09:41:25 GMT; Secure; SameSite=Lax; Domain=medicalnewstoday.com; Path=/
transfer-encoding: chunked
vary: accept-encoding
via: 1.1 c9f0decc0c63834ae3be48cbc4198f60.cloudfront.net (CloudFront)
x-amz-cf-id: CUQz9WE4fDs-KOv50RobFrBb7mwp3dL0uTnxNzcYbSjIdfBw0oyUeA==
x-amz-cf-pop: IAD61-P9
x-cache: Miss from cloudfront
x-hl-ver: 26246343343

fetched 2026-05-23T09:41:25.829Z

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

no CORS headers — cross-origin requests blocked by default

Why it matters: Overly permissive CORS (wildcard with credentials, or reflected origin) lets any origin read authenticated responses from this domain. OWASP A05 misconfiguration territory (NIST AC-4).

origin: https://drwho.me
method: GET
preflight status: 403

access-control-* headers

access-control-allow-origin: —
access-control-allow-methods: —
access-control-allow-headers: —
access-control-allow-credentials: —
access-control-max-age: —
access-control-expose-headers: —

no access-control-* headers returned — site does not advertise CORS to this origin

fetched 2026-05-23T09:41:25.666Z

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

HTTPS surface reachable (robots ✓, sitemap ✓, title ✓)

Why it matters: Public files — robots.txt, sitemap.xml, head meta — are what attackers see first during reconnaissance. Misadvertised paths, stale sitemaps, and verbose generators leak more than intended (ISO 27001 A.8.9).

robots.txt

present

User-agent: Mediapartners-Google*
Disallow:

User-agent: Nutch
Crawl-delay: 5
Disallow:

User-agent: Slurp
Disallow: /*.gif$
Disallow: /*.jpg$

# --- Amazon / AWS crawlers (begin) ---

# AmazonAdbot is intentionally allowed (ad targeting — see HLMR-6504)
User-agent: AmazonAdbot
Disallow:

User-agent: Amazonbot
Disallow: /

User-agent: Amzn-SearchBot
Disallow: /

User-agent: Amzn-User
Disallow: /

User-agent: amazon-kendra
Disallow: /

User-agent: amazon-QBusiness
Disallow: /

User-agent: bedrockbot
Disallow: /

User-agent: aws-quick-on-behalf-of-
Disallow: /

User-agent: AmazonProductDiscoverybot
Disallow: /

User-agent: AmazonBuyForMe
Disallow: /

User-agent: AmazonSellerInitiatedListing
Disallow: /

User-agent: NovaAct
Disallow: /

# --- Amazon / AWS crawlers (end) ---

User-agent: *
Crawl-delay: 5
Disallow: /linkfwd.php
Disallow: /counters.php

# Wordpress Previews
Disallow: /articles/mnt-*
Disallow: /program/mnt-*

# API Routes
Disallow: /api/*

# Invalid URLs
Disallow: */null$
Disallow: */inline$

User-agent: GPTBot
Disallow: /

User-agent: Applebot-Extended
Disallow: /

User-agent: anthropic-ai
Disallow: /

User-agent: Bytespider
Disallow: /

User-agent: CCBot
Disallow: /

User-agent: ClaudeBot
Disallow: /

User-agent: Diffbot
Disallow: /

User-agent: FacebookBot
Disallow: /

User-agent: Meta-ExternalAgent
Disallow: /

User-agent: omgili
Disallow: /

User-agent: Timpibot
Disallow: /

User-agent: Webzio-Extended
Disallow: /

User-agent: DDM-DCipher/1.0.7
Disallow: /

# Sitemaps
Sitemap: https://www.medicalnewstoday.com/sitemap.xml

# Widget Sampler
Disallow: /articles/widget-sampler

# Static Test Articles
Disallow: /test/

# Block AMP URLs
Disallow: /amp/

sitemap.xml

present — 2 url(s)

head

title: Medical and health information | MedicalNewsToday
description: Medical news and health news headlines posted throughout the day, every day

social

og:title: Medical and health information | MedicalNewsToday
og:description: Medical news and health news headlines posted throughout the day, every day
og:type: article
og:url: https://www.medicalnewstoday.com
og:image: https://assets.medicalnewstoday.com/content/mnt_sharing.png
twitter:title: Medical and health information | MedicalNewsToday
twitter:description: Medical news and health news headlines posted throughout the day, every day
twitter:card: summary_large_image
twitter:image: https://assets.medicalnewstoday.com/content/mnt_sharing.png

fetched 2026-05-23T09:41:25.993Z

web-surface

info

Open standalone →

inspecting web surface…

dnssec

low

Open standalone →

DNSSEC not configured — no DS or DNSKEY records found

Why it matters: DNSSEC cryptographically signs DNS responses, blocking cache-poisoning attacks. US federal civilian agencies are required to enable it under OMB M-22-09 (NIST SC-20).

Recommendations

Enable DNSSEC in your DNS provider's control panel and add the resulting DS record at your registrar

enabled: no
DS records: —
DNSKEY records: —

fetched 2026-05-23T09:41:25.670Z

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

not applicable: no _mta-sts TXT record

Why it matters: MTA-STS forces inbound SMTP to use TLS and refuse downgraded connections. Without it, an in-path attacker can strip TLS and read mail in plaintext (SOC 2 CC6.7).

no _mta-sts TXT record

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

not applicable: no TLSRPT record

Why it matters: TLS-RPT publishes a reporting address for SMTP-TLS failures. Without it, downgrade attacks on inbound mail go unnoticed (SOC 2 CC7.2).

no TLSRPT record

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

domain registered until 2026-11-05

Why it matters: Registrar and expiry tell auditors the domain is owned, current, and not about to lapse. An expired or about-to-expire domain fails business-continuity evidence (SOC 2 A1.2).

registrar: GoDaddy Corporate Domains, LLC
created: 2003-11-05T15:40:17Z
expires: 2026-11-05T15:40:17Z
statuses: clientTransferProhibited https://icann.org/epp#clientTransferProhibited, serverDeleteProhibited https://icann.org/epp#serverDeleteProhibited, serverTransferProhibited https://icann.org/epp#serverTransferProhibited, serverUpdateProhibited https://icann.org/epp#serverUpdateProhibited

fetched 2026-05-23T09:41:25.766Z

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

check failed: crt.sh: Error: crt.sh http 502; certspotter: Error: certspotter http 429

Why it matters: Every certificate issued for this domain is published in Certificate Transparency logs — including subdomains you may have forgotten. Unknown subdomains in CT are pre-disclosed attack surface (ISO 27001 A.8.16).

crt.sh: Error: crt.sh http 502; certspotter: Error: certspotter http 429

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.