mullvad.net

15-check dossier · scoreboard above, section details below

Get a pack →

Scanning…

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

resolving mx…

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

resolving dmarc…

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

tracing redirects…

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

inspecting web surface…

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.

mullvad.net

15-check dossier · scoreboard above, section details below

Get a pack →

A-

Audit-ready · 3 minor advisories

Aggregate grade across 15 checks. Auditors typically flag any High-severity finding.

Pass: 12
Warn: 3
Fail: 0

What an auditor would flag first

low
DKIM
no DKIM selectors found — likely not configured
SOC 2 CC6.7
low
TLS certificate
cert expires in 56 days
SOC 2 CC6.6ISO 27001 A.13.1.1
low
WHOIS
domain expires in 48 days — renew soon
SOC 2 CC1.4

Need this as an artifact your auditor can verify?

Your mullvad.net scan flagged 3 low findings. A signed pack covers the apex plus up to 100 CT-discovered subdomains, Ed25519-signed and ISO-timestamped, delivered in 10–30 minutes.

Get a pack →See methodology See a sample$29

Scanning…

15-check summary

DNS recordsA/AAAA records present
MX5 MX record(s) present
SPF-all hardfail — strict policy
DMARCp=reject — strict policy
DKIMno DKIM selectors found — likely not configured
TLS certificatecert expires in 56 days
Redirect chainHTTPS served correctly
Security headersall security headers present
CORSno CORS headers — cross-origin requests blocked by default
Web surfaceHTTPS surface reachable (robots ✓, sitemap ✓, title ✓)
MTA-STSnot applicable: no _mta-sts TXT record
TLS-RPTnot applicable: no TLSRPT record
DNSSECDNSSEC enabled — DS records present and chain validated (AD flag)
WHOISdomain expires in 48 days — renew soon
Certificate Transparencycheck failed: crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

dns

info

Open standalone →

A/AAAA records present

Why it matters: Without authoritative A or AAAA records on the apex, the domain is unreachable. Missing baseline DNS shows up in vendor reviews as evidence of unmanaged infrastructure (SOC 2 CC6.6).

A: ttl=16 45.83.223.209
AAAA: —
NS: ttl=1259 ns1.mullvaddns.net.
ttl=1259 ns2.mullvaddns.net.
ttl=1259 ns3.mullvaddns.net.
ttl=1259 ns4.mullvaddns.net.
SOA: ttl=1800 ns1.mullvaddns.net. support.mullvadvpn.net. 1634970317 28800 7200 1209600 900
CAA: ttl=3600 \# 36 80 05 69 6f 64 65 66 6d 61 69 6c 74 6f 3a 73 75 70 70 6f 72 74 40 6d 75 6c 6c 76 61 64 76 70 6e 2e 6e 65 74
ttl=3600 \# 22 80 05 69 73 73 75 65 6c 65 74 73 65 6e 63 72 79 70 74 2e 6f 72 67
ttl=3600 \# 26 80 09 69 73 73 75 65 77 69 6c 64 6c 65 74 73 65 6e 63 72 79 70 74 2e 6f 72 67
TXT: ttl=60 "bunny:303437"
ttl=60 "yandex-verification: f0e9a23691826011"
ttl=60 "gradle-verification=54GHA74UUTS2760IGPVSUPJ9LE6I6"
ttl=60 "google-site-verification=T6j3fHOnwX8sOP55jYtYfVH2J27u9rIY8kM9ApBzBXQ"
ttl=60 "atlassian-domain-verification=xOPm1CvufMcUMKi8KR/Q1i69lUU6WBai4zpIFVQcBszhnTja6HPyIsw2jz/1ABSP"
ttl=60 "v=spf1 ip4:193.138.218.78 ip4:193.138.218.77 ip4:193.138.218.76 ip4:193.138.218.75 ip4:185.213.154.79 ip4:45.129.56.122 ip4:45.83.222.71 ip4:45.83.222.80 ip4:45.129.56.118 include:_spf.google.com -all"

fetched 2026-05-23T09:28:05.083Z

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

5 MX record(s) present

Why it matters: MX records direct inbound mail. Misconfiguration silently breaks email delivery and lets attackers stand up parallel MX hosts for spoofing campaigns (ISO 27001 A.8.21).

pri=10 aspmx.l.google.com.
pri=20 alt1.aspmx.l.google.com.
pri=30 alt2.aspmx.l.google.com.
pri=40 aspmx2.googlemail.com.
pri=50 aspmx3.googlemail.com.

fetched 2026-05-23T09:28:05.007Z

mx

info

Open standalone →

resolving mx…

spf

info

Open standalone →

-all hardfail — strict policy

Why it matters: SPF tells receiving servers which hosts may send mail for the domain. Without it, any sender can forge the envelope-from — the primary mechanism behind business-email-compromise (SOC 2 CC6.7).

v=spf1 ip4:193.138.218.78 ip4:193.138.218.77 ip4:193.138.218.76 ip4:193.138.218.75 ip4:185.213.154.79 ip4:45.129.56.122 ip4:45.83.222.71 ip4:45.83.222.80 ip4:45.129.56.118 include:_spf.google.com -all

v=spf1
ip4:193.138.218.78
ip4:193.138.218.77
ip4:193.138.218.76
ip4:193.138.218.75
ip4:185.213.154.79
ip4:45.129.56.122
ip4:45.83.222.71
ip4:45.83.222.80
ip4:45.129.56.118
include:_spf.google.com
-all

fetched 2026-05-23T09:28:05.008Z

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

p=reject — strict policy

Why it matters: DMARC binds SPF and DKIM into an enforceable policy (quarantine or reject) and surfaces spoofing attempts via aggregate reports. `p=none` or absent means spoofing succeeds silently (SOC 2 CC6.7).

v=DMARC1; p=reject; rua=mailto:azrlj0xm@ag.eu.dmarcian.com, mailto:dmarc@mullvad.net; ruf=mailto:azrlj0xm@fr.eu.dmarcian.com, mailto:dmarcforensics@mullvad.net; rf=afrf; sp=reject; fo=1; pct=100; ri=86400; adkim=s; aspf=s

v=: DMARC1
p=: reject
rua=: mailto:azrlj0xm@ag.eu.dmarcian.com, mailto:dmarc@mullvad.net
ruf=: mailto:azrlj0xm@fr.eu.dmarcian.com, mailto:dmarcforensics@mullvad.net
rf=: afrf
sp=: reject
fo=: 1
pct=: 100
ri=: 86400
adkim=: s
aspf=: s

fetched 2026-05-23T09:28:05.008Z

dmarc

info

Open standalone →

resolving dmarc…

dkim

low

Open standalone →

no DKIM selectors found — likely not configured

Why it matters: DKIM signs outbound mail so receivers can detect tampering. Missing selectors or rotated-away keys break DMARC alignment and let receivers downgrade trust (ISO 27001 A.8.24).

Recommendations

Enable DKIM signing in your mail provider and publish the provided TXT record
Common selectors: google._domainkey, selector1._domainkey (Microsoft), mail._domainkey

no DKIM record on probed selectors (default, google, k1, selector1, selector2, mxvault)

dkim

info

Open standalone →

probing dkim selectors…

tls

low

Open standalone →

cert expires in 56 days

Why it matters: A valid current TLS certificate is the baseline for data in transit. Expiry, weak chain, or hostname mismatch break HTTPS and fail PCI 4.2.1 / SOC 2 CC6.1.

Recommendations

Schedule certificate renewal — consider enabling auto-renewal

subject cn:: mullvad.net
issuer:: E7 / Let's Encrypt
valid:: Apr 20 09:14:39 2026 GMT → Jul 19 09:14:38 2026 GMT
authorized:: yes
sha256:: 90:87:53:97:20:6D:0D:AB:D7:F8:36:B6:42:2F:09:47:0A:E1:EB:9C:EA:DB:1C:9A:A9:FD:41:44:55:A2:BB:C5
sans: mullvad.net
mullvadvpn.net
o54hon2e2vj6c7m3aqqu6uyece65by3vgoxxhlqlsvkmacw6a7m7kiadonion.mullvad.net
o54hon2e2vj6c7m3aqqu6uyece65by3vgoxxhlqlsvkmacw6a7m7kiadonion.www.mullvad.net
se-sto-www-001.mullvad.net
www.mullvad.net
www.mullvadvpn.net

fetched 2026-05-23T09:28:05.234Z

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

HTTPS served correctly

Why it matters: Bare HTTP requests must redirect to HTTPS without dropping the user mid-chain. Plain-text fallback or open redirects fail PCI 4.2.1 and feed phishing chains (SOC 2 CC6.6).

final status: 200 · 2 hops

[302] https://mullvad.net/
[200] https://mullvad.net/en

fetched 2026-05-23T09:28:05.777Z

redirects

info

Open standalone →

tracing redirects…

headers

info

Open standalone →

all security headers present

Why it matters: Security headers — HSTS, CSP, X-Frame-Options, Referrer-Policy — defend against XSS, clickjacking, and downgrade attacks. Absent headers map directly to OWASP ASVS V14 findings (ISO 27001 A.8.23).

final url: https://mullvad.net/en

security headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
content-security-policy: default-src 'self'; frame-src https://js.stripe.com https://newassets.hcaptcha.com https://www.paypal.com; font-src 'self' data:; img-src 'self' data: https://www.paypalobjects.com https://media.mullvad.net; media-src 'self' https://media.mullvad.net; object-src 'none'; script-src 'self' https://js.stripe.com https://js.hcaptcha.com https://newassets.hcaptcha.com https://www.paypal.com 'unsafe-hashes' 'sha256-7dQwUgLau1NFCCGjfn9FsYptB6ZtWxJin6VohGIu20I=' 'nonce-DgMtRdj/Gu+AyqdI4LHPUw=='; style-src 'self' 'unsafe-inline'; base-uri 'self'; frame-ancestors 'none'; connect-src 'self' https://*.mullvad.net
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
referrer-policy: same-origin
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(self), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), web-share=(), xr-spatial-tracking=()

other headers

connection: keep-alive
content-encoding: gzip
content-type: text/html
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: same-origin
date: Sat, 23 May 2026 09:28:05 GMT
etag: W/"ty7oy1"
onion-location: http://o54hon2e2vj6c7m3aqqu6uyece65by3vgoxxhlqlsvkmacw6a7m7kiad.onion/en
server: nginx
transfer-encoding: chunked
x-sveltekit-page: true

fetched 2026-05-23T09:28:05.561Z

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

no CORS headers — cross-origin requests blocked by default

Why it matters: Overly permissive CORS (wildcard with credentials, or reflected origin) lets any origin read authenticated responses from this domain. OWASP A05 misconfiguration territory (NIST AC-4).

origin: https://drwho.me
method: GET
preflight status: 302

access-control-* headers

access-control-allow-origin: —
access-control-allow-methods: —
access-control-allow-headers: —
access-control-allow-credentials: —
access-control-max-age: —
access-control-expose-headers: —

no access-control-* headers returned — site does not advertise CORS to this origin

fetched 2026-05-23T09:28:07.758Z

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

HTTPS surface reachable (robots ✓, sitemap ✓, title ✓)

Why it matters: Public files — robots.txt, sitemap.xml, head meta — are what attackers see first during reconnaissance. Misadvertised paths, stale sitemaps, and verbose generators leak more than intended (ISO 27001 A.8.9).

robots.txt

present

User-agent: *
Allow: /account/create
Allow: /account/login
Allow: /account/recover/
Disallow: /account/

Allow: /ar/account/create
Allow: /ar/account/login
Allow: /ar/account/recover/
Allow: /da/account/create
Allow: /da/account/login
Allow: /da/account/recover/
Allow: /de/account/create
Allow: /de/account/login
Allow: /de/account/recover/
Allow: /en/account/create
Allow: /en/account/login
Allow: /en/account/recover/
Allow: /es/account/create
Allow: /es/account/login
Allow: /es/account/recover/
Allow: /fa/account/create
Allow: /fa/account/login
Allow: /fa/account/recover/
Allow: /fi/account/create
Allow: /fi/account/login
Allow: /fi/account/recover/
Allow: /fr/account/create
Allow: /fr/account/login
Allow: /fr/account/recover/
Allow: /it/account/create
Allow: /it/account/login
Allow: /it/account/recover/
Allow: /ja/account/create
Allow: /ja/account/login
Allow: /ja/account/recover/
Allow: /ko/account/create
Allow: /ko/account/login
Allow: /ko/account/recover/
Allow: /nl/account/create
Allow: /nl/account/login
Allow: /nl/account/recover/
Allow: /no/account/create
Allow: /no/account/login
Allow: /no/account/recover/
Allow: /pl/account/create
Allow: /pl/account/login
Allow: /pl/account/recover/
Allow: /pt/account/create
Allow: /pt/account/login
Allow: /pt/account/recover/
Allow: /ru/account/create
Allow: /ru/account/login
Allow: /ru/account/recover/
Allow: /sv/account/create
Allow: /sv/account/login
Allow: /sv/account/recover/
Allow: /th/account/create
Allow: /th/account/login
Allow: /th/account/recover/
Allow: /tr/account/create
Allow: /tr/account/login
Allow: /tr/account/recover/
Allow: /uk/account/create
Allow: /uk/account/login
Allow: /uk/account/recover/
Allow: /zh-hans/account/create
Allow: /zh-hans/account/login
Allow: /zh-hans/account/recover/
Allow: /zh-hant/account/create
Allow: /zh-hant/account/login
Allow: /zh-hant/account/recover/

Disallow: /ar/account/
Disallow: /ar/setlocale/
Disallow: /da/account/
Disallow: /da/setlocale/
Disallow: /de/account/
Disallow: /de/setlocale/
Disallow: /en/account/
Disallow: /en/setlocale/
Disallow: /es/account/
Disallow: /es/setlocale/
Disallow: /fa/account/
Disallow: /fa/setlocale/
Disallow: /fi/account/
Disallow: /fi/setlocale/
Disallow: /fr/account/
Disallow: /fr/setlocale/
Disallow: /it/account/
Disallow: /it/setlocale/
Disallow: /ja/account/
Disallow: /ja/setlocale/
Disallow: /ko/account/
Disallow: /ko/setlocale/
Disallow: /nl/account/
Disallow: /nl/setlocale/
Disallow: /no/account/
Disallow: /no/setlocale/
Disallow: /pl/account/
Disallow: /pl/setlocale/
Disallow: /pt/account/
Disallow: /pt/setlocale/
Disallow: /ru/account/
Disallow: /ru/setlocale/
Disallow: /sv/account/
Disallow: /sv/setlocale/
Disallow: /th/account/
Disallow: /th/setlocale/
Disallow: /tr/account/
Disallow: /tr/setlocale/
Disallow: /uk/account/
Disallow: /uk/setlocale/
Disallow: /zh-hans/account/
Disallow: /zh-hans/setlocale/
Disallow: /zh-hant/account/
Disallow: /zh-hant/setlocale/
Sitemap: https://mullvad.net/sitemap.xml

sitemap.xml

present — 35 url(s)

head

title: Mullvad VPN - Privacy is for the people
description: Free the internet from mass surveillance and censorship. Fight for privacy with Mullvad VPN and Mullvad Browser.

social

og:title: Mullvad VPN - Privacy is for the people
og:description: Free the internet from mass surveillance and censorship. Fight for privacy with Mullvad VPN and Mullvad Browser.
og:image: https://mullvad.net/press/MullvadVPN_logo_Round_RGB_Color_positive.png
og:site_name: Mullvad VPN
og:type: website
og:url: https://mullvad.net/en
twitter:card: summary

fetched 2026-05-23T09:28:06.335Z

web-surface

info

Open standalone →

inspecting web surface…

dnssec

info

Open standalone →

DNSSEC enabled — DS records present and chain validated (AD flag)

Why it matters: DNSSEC cryptographically signs DNS responses, blocking cache-poisoning attacks. US federal civilian agencies are required to enable it under OMB M-22-09 (NIST SC-20).

enabled: yes
DS records: 36518 ECDSAP256SHA256 2 517376a9e6f1fb1c75966fbd42f969baf7043b7d93d886f59e273c7972c142ff, DS ECDSAP256SHA256 2 86400 1779852406 1779243406 1560 net. S4Cjy3BZlA7BJ/k4A0xQdkZtdSbbPJvN/Uqbh84/VENEVsMOMoVs3P6gS2O2dJ9EYY6vHrQScH4bvtuBLdya8g==
DNSKEY records: 3 key(s)

fetched 2026-05-23T09:28:05.009Z

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

not applicable: no _mta-sts TXT record

Why it matters: MTA-STS forces inbound SMTP to use TLS and refuse downgraded connections. Without it, an in-path attacker can strip TLS and read mail in plaintext (SOC 2 CC6.7).

no _mta-sts TXT record

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

not applicable: no TLSRPT record

Why it matters: TLS-RPT publishes a reporting address for SMTP-TLS failures. Without it, downgrade attacks on inbound mail go unnoticed (SOC 2 CC7.2).

no TLSRPT record

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

low

Open standalone →

domain expires in 48 days — renew soon

Why it matters: Registrar and expiry tell auditors the domain is owned, current, and not about to lapse. An expired or about-to-expire domain fails business-continuity evidence (SOC 2 A1.2).

Recommendations

Enable auto-renewal at your registrar to avoid accidental expiry

registrar: Domeneshop AS dba domainnameshop.com
created: 2008-07-10T20:38:28Z
expires: 2026-07-10T20:38:28Z
statuses: clientTransferProhibited https://icann.org/epp#clientTransferProhibited

fetched 2026-05-23T09:28:05.263Z

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

check failed: crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

Why it matters: Every certificate issued for this domain is published in Certificate Transparency logs — including subdomains you may have forgotten. Unknown subdomains in CT are pre-disclosed attack surface (ISO 27001 A.8.16).

crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.