nike.com

15-check dossier · scoreboard above, section details below

Get a pack →

Scanning…

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

resolving mx…

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

resolving dmarc…

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

tracing redirects…

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

inspecting web surface…

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.

nike.com

15-check dossier · scoreboard above, section details below

Get a pack →

Mostly compliant · 4 items need attention

Aggregate grade across 15 checks. Auditors typically flag any High-severity finding.

Pass: 11
Warn: 4
Fail: 0

What an auditor would flag first

medium
SPF
~all softfail — receivers may still accept
SOC 2 CC6.7ISO 27001 A.13.2.1
low
DKIM
no DKIM selectors found — likely not configured
SOC 2 CC6.7
low
Security headers
2 security header(s) missing
SOC 2 CC6.6ISO 27001 A.14.1.2

Need this as an artifact your auditor can verify?

Your nike.com scan flagged 1 medium and 3 low findings. A signed pack covers the apex plus up to 100 CT-discovered subdomains, Ed25519-signed and ISO-timestamped, delivered in 10–30 minutes.

Get a pack →See methodology See a sample$29

Scanning…

15-check summary

DNS recordsA/AAAA records present
MX2 MX record(s) present
SPF~all softfail — receivers may still accept
DMARCp=reject — strict policy
DKIMno DKIM selectors found — likely not configured
TLS certificatecert valid for 163 days
Redirect chainHTTPS served correctly
Security headers2 security header(s) missing
CORSno CORS headers — cross-origin requests blocked by default
Web surfaceHTTPS surface reachable (robots ✓, sitemap ✗, title ✓)
MTA-STSnot applicable: no _mta-sts TXT record
TLS-RPTnot applicable: no TLSRPT record
DNSSECDNSSEC not configured — no DS or DNSKEY records found
WHOISdomain registered until 2028-03-05
Certificate Transparencycheck failed: crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

dns

info

Open standalone →

A/AAAA records present

Why it matters: Without authoritative A or AAAA records on the apex, the domain is unreachable. Missing baseline DNS shows up in vendor reviews as evidence of unmanaged infrastructure (SOC 2 CC6.6).

A: ttl=22 18.160.18.126
ttl=22 18.160.18.105
ttl=22 18.160.18.40
ttl=22 18.160.18.65
AAAA: —
NS: ttl=452 ns-n1.nike.com.
ttl=452 ns-n2.nike.com.
ttl=452 ns-n3.nike.com.
ttl=452 ns-n4.nike.com.
SOA: ttl=3600 ns-n1.nike.com. hostmaster.nike.com. 2020101501 10800 3600 1814400 900
CAA: —
TXT: ttl=300 "4784qfgb1p5cygmgsszmv4bnfqmk7kct"
ttl=300 "52b0ba4a752984fe5aadf8307d978aaad69cc5e0dc654a2f6f011c210bc3d0f8"
ttl=300 "6IHSYqvkFCDiMubO/Czv+XdVcUWb8weKG9uyqn9Kh0u3RZwA+xx73W/f+iQrSciT+peqOK3yNcx1jsIqsHgY+g=="
ttl=300 "Dynatrace-site-verification=3767faff-af76-492b-b89a-8a131cf04b79__c6r5amr4k70b0if4kb7758iej7"
ttl=300 "MS=ms93873368"
ttl=300 "Validation no ext"
ttl=300 "ZOOM_verify_sCcWC00VT72Xd3cKn3ByDQ"
ttl=300 "_3m4ex27y3mflwhlg4u1tmecdcn5ybcr"
ttl=300 "_globalsign-domain-verification=oTFxDWw1mdzzP-Zd45wwC6Ifc6nSakWOmRQSYD_XHz"
ttl=300 "_z9yb4dkbcwn7z68zbmcju1hzw2bdtx9"
ttl=300 "adobe-idp-site-verification=6f949b65-8b97-4bb1-be7a-6088c7b96a98"
ttl=300 "amazonses:guDcMedRx3D3yaitJGO/aV+NzhugJRiKDDdKbUXqbLM="
ttl=300 "apple-domain-verification=FIPflKu9G6kEqyab"
ttl=300 "atlassian-domain-verification=pJlgODoOXqMpfPHoasf4sPWDltyOP4cWVg6ptKTMfoozopE7QCq/a8TYq65TmOxv"
ttl=300 "atlassian-sending-domain-verification=addc73ef-6fc8-4d74-a015-9b63ec7809a1"
ttl=300 "cisco-ci-domain-verification=7ab30713f81d07c44eea6bc370f3a51f2ca7d6c0477a8db10974320ec4bef38f"
ttl=300 "cloudhealth=a8cf6829-a2b8-4f9f-9945-f71659ede7ff"
ttl=300 "cursor-domain-verification-gba5jn=lRd0T4XTIOjBR3FYBvBcEMw9k"
ttl=300 "docker-verification=278531f6-37fe-485c-89db-334e7b913aa0"
ttl=300 "dtm-domain-verification=LmCPecEAhn9C-gGneNj_stFVbTTrES0EtZTslr2YF2c"
ttl=300 "facebook-domain-verification=9qrf9w3jjvoc7r3ry2mv6fds4qd9jd"
ttl=300 "github-verification=9rQmuxzyEyx4yq7LjueTPBmTFPNf9xcMKDBpDkkw"
ttl=300 "google-site-verification=0tcT2lcGC5FZjgDR2BU_t4PwfRpG5TdMC3W7Uq8tleI"
ttl=300 "google-site-verification=AqwT-_WzscdFOiacOoMpw-aMjwRDmJLuT9cHH3zFfkw"
ttl=300 "google-site-verification=JjQcml7P2JjvkTRFwUtkeEGy6-Pehs-zJ3YC2bVcCp4"
ttl=300 "google-site-verification=Ot6fp-6zJPJw5lHQXZm5Lhs3nCmRp7EW2eHn5htn_3A"
ttl=300 "jamf-site-verification=aIUTcaWCojh8ldgWpayjCg"
ttl=300 "mongodb-site-verification=POJ3Ib5m6oOyqX91ZrlgcbAFVKwRhMml"
ttl=300 "pendo-domain-verification=suZZiVajeuV3K-TVqdF0B7QS9o0"
ttl=300 "rhino_accounts=f8b043ccf0f03789479ad9ba4d169b0d"
ttl=300 "scnv-verification=03fe4bf81654621682a5c049867fccb4:4fa32facf3797aa643beb4108a6c956c:d986a0a5e1ca4ceb8941e8d9ed54eb11"
ttl=300 "soa header update"
ttl=300 "stripe-verification=3e045226dd7579f3fea910186ec8aee832e44fecd5d5e89f690efed18c3f38fd"
ttl=300 "stripe-verification=c814f4607c0171c39868805fb1ae7723a2d91d54b0c3149eb8ec46aad7a7be6f"
ttl=300 "v=spf1 include:%{ir}.%{v}.%{d}.spf.has.pphosted.com ~all"
ttl=300 "validate post vanity"
ttl=300 "validation and verification zone"
ttl=300 "vizcom-domain-verification-athga5=ds19jN3O5UWdzylSOLtvX2QN6"
ttl=300 "vmware-cloud-verification-b6516934-01c2-4ad1-bedd-11420be6e415"
ttl=300 "wiz-domain-verification=3cb6d690698de9ba2001d69ed35811baa3f917302293875949b7d863d1bf8b27"

fetched 2026-05-23T09:26:38.892Z

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

2 MX record(s) present

Why it matters: MX records direct inbound mail. Misconfiguration silently breaks email delivery and lets attackers stand up parallel MX hosts for spoofing campaigns (ISO 27001 A.8.21).

pri=10 mxa-001b6002.gslb.pphosted.com.
pri=10 mxb-001b6002.gslb.pphosted.com.

fetched 2026-05-23T09:26:38.882Z

mx

info

Open standalone →

resolving mx…

spf

medium

Open standalone →

~all softfail — receivers may still accept

Why it matters: SPF tells receiving servers which hosts may send mail for the domain. Without it, any sender can forge the envelope-from — the primary mechanism behind business-email-compromise (SOC 2 CC6.7).

Recommendations

Move to -all (hardfail) once your mail flow is confirmed — softfail gives no real protection

v=spf1 include:%{ir}.%{v}.%{d}.spf.has.pphosted.com ~all

v=spf1
include:%{ir}.%{v}.%{d}.spf.has.pphosted.com
~all

fetched 2026-05-23T09:26:38.880Z

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

p=reject — strict policy

Why it matters: DMARC binds SPF and DKIM into an enforceable policy (quarantine or reject) and surfaces spoofing attempts via aggregate reports. `p=none` or absent means spoofing succeeds silently (SOC 2 CC6.7).

v=DMARC1; p=reject; fo=1; rua=mailto:dmarc_rua@emaildefense.proofpoint.com; ruf=mailto:dmarc_ruf@emaildefense.proofpoint.com

v=: DMARC1
p=: reject
fo=: 1
rua=: mailto:dmarc_rua@emaildefense.proofpoint.com
ruf=: mailto:dmarc_ruf@emaildefense.proofpoint.com

fetched 2026-05-23T09:26:38.879Z

dmarc

info

Open standalone →

resolving dmarc…

dkim

low

Open standalone →

no DKIM selectors found — likely not configured

Why it matters: DKIM signs outbound mail so receivers can detect tampering. Missing selectors or rotated-away keys break DMARC alignment and let receivers downgrade trust (ISO 27001 A.8.24).

Recommendations

Enable DKIM signing in your mail provider and publish the provided TXT record
Common selectors: google._domainkey, selector1._domainkey (Microsoft), mail._domainkey

no DKIM record on probed selectors (default, google, k1, selector1, selector2, mxvault)

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

cert valid for 163 days

Why it matters: A valid current TLS certificate is the baseline for data in transit. Expiry, weak chain, or hostname mismatch break HTTPS and fail PCI 4.2.1 / SOC 2 CC6.1.

subject cn:: nike.com
issuer:: Amazon RSA 2048 M04 / Amazon
valid:: Apr 19 00:00:00 2026 GMT → Nov 2 23:59:59 2026 GMT
authorized:: yes
sha256:: 92:69:F9:25:41:CA:48:9D:56:7B:31:60:77:F1:A0:B7:95:65:E6:71:48:BF:DC:63:67:41:C3:1C:56:CF:41:72
sans: nike.com
*.nike.com

fetched 2026-05-23T09:26:38.908Z

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

HTTPS served correctly

Why it matters: Bare HTTP requests must redirect to HTTPS without dropping the user mid-chain. Plain-text fallback or open redirects fail PCI 4.2.1 and feed phishing chains (SOC 2 CC6.6).

final status: 200 · 2 hops

[301] https://nike.com/
[200] https://www.nike.com/

fetched 2026-05-23T09:26:39.379Z

redirects

info

Open standalone →

tracing redirects…

headers

low

Open standalone →

2 security header(s) missing

Why it matters: Security headers — HSTS, CSP, X-Frame-Options, Referrer-Policy — defend against XSS, clickjacking, and downgrade attacks. Absent headers map directly to OWASP ASVS V14 findings (ISO 27001 A.8.23).

Recommendations

Add response header — X-Content-Type-Options: nosniff
Add response header — Referrer-Policy: strict-origin-when-cross-origin

final url: https://www.nike.com/

security headers

strict-transport-security: max-age=2628000 ; includeSubDomains
content-security-policy: frame-ancestors 'self' *.nike.com *.nikecloud.com *.nikedev.com
x-frame-options: sameorigin
x-content-type-options: —
referrer-policy: —
permissions-policy: ch-ua-model=("https://sdk-api-v1.singular.net"), ch-ua-platform-version=("https://sdk-api-v1.singular.net"), ch-ua-full-version-list=("https://sdk-api-v1.singular.net")

other headers

accept-ch: sec-ch-ua-model, sec-ch-ua-platform-version, sec-ch-ua-full-version-list
akamai-grn: 0.f3c83017.1779528398.d55d93b8
cache-control: max-age=900
connection: keep-alive, Transfer-Encoding
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Sat, 23 May 2026 09:26:39 GMT
etag: "zff0efih6g7byz"
expires: Sat, 23 May 2026 09:41:39 GMT
server: unified-edge-router
server-timing: edge; dur=1, cdn-cache; desc=HIT, ak_p; desc="1779528398947_389073139_3579679672_39_225731_2_39_-";dur=1
set-cookie: ni_d=D50D2BE0-9AAE-4E2D-a3A6-CDCF1087C57A; expires=Tue, 22-Jun-2027 09:26:39 GMT; path=/; domain=.nike.com; secure
transfer-encoding: chunked
vary: Accept-Encoding
x-akamai-transformed: 9 - 0 pmb=mNONE,1mRUM,3
x-b3-traceid: 9e4e3e536d6ff0a8e0ef03cf4917af22
x-branch-name: production-2026-05-20--18-29-15
x-build-number: 1
x-commerce-region: us-east-1
x-commit-sha: 2fa7e8964
x-environment: production
x-powered-by: Next.js

fetched 2026-05-23T09:26:39.561Z

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

no CORS headers — cross-origin requests blocked by default

Why it matters: Overly permissive CORS (wildcard with credentials, or reflected origin) lets any origin read authenticated responses from this domain. OWASP A05 misconfiguration territory (NIST AC-4).

origin: https://drwho.me
method: GET
preflight status: 403

access-control-* headers

access-control-allow-origin: —
access-control-allow-methods: —
access-control-allow-headers: —
access-control-allow-credentials: —
access-control-max-age: —
access-control-expose-headers: —

no access-control-* headers returned — site does not advertise CORS to this origin

fetched 2026-05-23T09:26:38.931Z

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

HTTPS surface reachable (robots ✓, sitemap ✗, title ✓)

Why it matters: Public files — robots.txt, sitemap.xml, head meta — are what attackers see first during reconnaissance. Misadvertised paths, stale sitemaps, and verbose generators leak more than intended (ISO 27001 A.8.9).

robots.txt

present

# www.nike.com robots.txt -- just crawl it.

User-agent: *

Disallow: */member/inbox
Disallow: */member/settings
Disallow: */p/
Disallow: */checkout/
Disallow: /*.swf$
Disallow: /*.pdf$
Disallow: /pdf/
Disallow: /ar/help/
Disallow: /br/help/
Disallow: /hk/help/
Disallow: /uy/help/
Disallow: /xf/help/
Disallow: /xl/help/
Disallow: /xm/help/
Disallow: /fragments/recommendations-carousel
Disallow: /kr/en$
Disallow: /kr/en/
Disallow: */w/*-*z*z*z*z*z

User-agent: Baiduspider
Allow: /cn$
Allow: /cn/
Allow: /CN$
Allow: /CN/
Allow: /assets/
Allow: /static/
Allow: /styleguide/
Disallow: */w?q=
Disallow: */w/?q=
Disallow: /
 
User-agent: HaoSouSpider
Allow: /cn$
Allow: /cn/
Allow: /CN$
Allow: /CN/
Allow: /assets/
Allow: /static/
Allow: /styleguide/
Disallow: */w?q=
Disallow: */w/?q=
Disallow: /

User-agent: Sogou web spider
Allow: /cn$
Allow: /cn/
Allow: /CN$
Allow: /CN/
Allow: /assets/
Allow: /static/
Allow: /styleguide/
Disallow: */w?q=
Disallow: */w/?q=
Disallow: /

User-agent: Sogou inst spider
Allow: /cn$
Allow: /cn/
Allow: /CN$
Allow: /CN/
Allow: /assets/
Allow: /static/
Allow: /styleguide/
Disallow: */w?q=
Disallow: */w/?q=
Disallow: /

User-agent: Sogou spider2
Allow: /cn$
Allow: /cn/
Allow: /CN$
Allow: /CN/
Allow: /assets/
Allow: /static/
Allow: /styleguide/
Disallow: */w?q=
Disallow: */w/?q=
Disallow: /

Sitemap: https://www.nike.com/sitemap-us-help.xml
Sitemap: https://www.nike.com/sitemap-v2-landingpage-index.xml
Sitemap: https://www.nike.com/sitemap-v2-pdp-index.xml
Sitemap: https://www.nike.com/sitemap-v2-snkrsweb-index.xml
Sitemap: https://www.nike.com/sitemap-v2-gridwall-index.xml
Sitemap: https://www.nike.com/sitemap-v2-article-index.xml
Sitemap: https://www.nike.com/sitemap-locator-index.xml

#                                                                                                    
#                 ``                                                                        ```.`    
#               `+/                                                                 ``.-/+o+:-.      
#             `/mo                                                          ``.-:+syhdhs/-`          
#            -hMd                                                    `..:+oyhmNNmds/-`               
#          `oNMM/                                            ``.-/oyhdmMMMMNdy+:.                    
#         .hMMMM-                                     `.-/+shdmNMMMMMMNdy+:.                         
#        :mMMMMM+                             `.-:+sydmNMMMMMMMMMNmho:.`                             
#       :NMMMMMMN:                    `.-:/oyhmmNMMMMMMMMMMMNmho:.`                                  
#      .NMMMMMMMMNy:`          `.-/oshdmNMMMMMMMMMMMMMMMmhs/-`                                       
#      hMMMMMMMMMMMMmhysooosyhdmNMMMMMMMMMMMMMMMMMMmds/-`                                            
#     .MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMNdy+-.`                                                
#     -MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMNdy+-.`                                                     
#     `NMMMMMMMMMMMMMMMMMMMMMMMMMMMMMmyo:.`                                                          
#      /NMMMMMMMMMMMMMMMMMMMMMMMmho:.`                                                               
#       .yNMMMMMMMMMMMMMMMMmhs/.`                                                                    
#         ./shdmNNmmdhyo/-``                                                                         
#              `````

sitemap.xml

absent

head

title: Nike. Just Do It. Nike.com
description: Inspiring the world's athletes, Nike delivers innovative products, experiences and services.

social

og:description: Nike delivers innovative products, experiences and services to inspire athletes.
og:image: https://c.static-nike.com/a/images/w_1920,c_limit/bzl2wmsfh7kgdkufrrjq/image.jpg
og:locale: en-US
og:site_name: Nike.com
og:title: Nike. Just Do It
og:type: website
og:url: https://www.nike.com/
twitter:card: summary_large_image
twitter:creator: @nike
twitter:description: Nike delivers innovative products, experiences and services to inspire athletes.
twitter:image: https://c.static-nike.com/a/images/w_1920,c_limit/bzl2wmsfh7kgdkufrrjq/image.jpg
twitter:site: @nike
twitter:title: Nike. Just Do It

fetched 2026-05-23T09:26:39.737Z

web-surface

info

Open standalone →

inspecting web surface…

dnssec

low

Open standalone →

DNSSEC not configured — no DS or DNSKEY records found

Why it matters: DNSSEC cryptographically signs DNS responses, blocking cache-poisoning attacks. US federal civilian agencies are required to enable it under OMB M-22-09 (NIST SC-20).

Recommendations

Enable DNSSEC in your DNS provider's control panel and add the resulting DS record at your registrar

enabled: no
DS records: —
DNSKEY records: —

fetched 2026-05-23T09:26:38.887Z

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

not applicable: no _mta-sts TXT record

Why it matters: MTA-STS forces inbound SMTP to use TLS and refuse downgraded connections. Without it, an in-path attacker can strip TLS and read mail in plaintext (SOC 2 CC6.7).

no _mta-sts TXT record

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

not applicable: no TLSRPT record

Why it matters: TLS-RPT publishes a reporting address for SMTP-TLS failures. Without it, downgrade attacks on inbound mail go unnoticed (SOC 2 CC7.2).

no TLSRPT record

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

domain registered until 2028-03-05

Why it matters: Registrar and expiry tell auditors the domain is owned, current, and not about to lapse. An expired or about-to-expire domain fails business-continuity evidence (SOC 2 A1.2).

registrar: MarkMonitor Inc.
created: 1995-03-04T05:00:00Z
expires: 2028-03-05T05:00:00Z
statuses: clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited, clientTransferProhibited https://icann.org/epp#clientTransferProhibited, clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited, serverDeleteProhibited https://icann.org/epp#serverDeleteProhibited, serverTransferProhibited https://icann.org/epp#serverTransferProhibited, serverUpdateProhibited https://icann.org/epp#serverUpdateProhibited

fetched 2026-05-23T09:26:39.110Z

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

check failed: crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

Why it matters: Every certificate issued for this domain is published in Certificate Transparency logs — including subdomains you may have forgotten. Unknown subdomains in CT are pre-disclosed attack surface (ISO 27001 A.8.16).

crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.