ovhcloud.com

15-check dossier · scoreboard above, section details below

Get a pack →

Scanning…

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

resolving mx…

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

resolving dmarc…

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

tracing redirects…

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

inspecting web surface…

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.

ovhcloud.com

15-check dossier · scoreboard above, section details below

Get a pack →

Mostly compliant · 5 items need attention

Aggregate grade across 15 checks. Auditors typically flag any High-severity finding.

Pass: 10
Warn: 5
Fail: 0

What an auditor would flag first

medium
DMARC
p=none — monitoring only, no enforcement
SOC 2 CC6.7ISO 27001 A.13.2.1
medium
Security headers
4 security header(s) missing
SOC 2 CC6.6ISO 27001 A.14.1.2
low
DKIM
no DKIM selectors found — likely not configured
SOC 2 CC6.7

Need this as an artifact your auditor can verify?

Your ovhcloud.com scan flagged 2 medium and 3 low findings. A signed pack covers the apex plus up to 100 CT-discovered subdomains, Ed25519-signed and ISO-timestamped, delivered in 10–30 minutes.

Get a pack →See methodology See a sample$29

Scanning…

15-check summary

DNS recordsA/AAAA records present
MX4 MX record(s) present
SPF-all hardfail — strict policy
DMARCp=none — monitoring only, no enforcement
DKIMno DKIM selectors found — likely not configured
TLS certificatecert expires in 44 days
Redirect chainHTTPS served correctly
Security headers4 security header(s) missing
CORSno CORS headers — cross-origin requests blocked by default
Web surfaceHTTPS surface reachable (robots ✓, sitemap ✗, title ✓)
MTA-STSnot applicable: no _mta-sts TXT record
TLS-RPTnot applicable: no TLSRPT record
DNSSECDNSSEC not configured — no DS or DNSKEY records found
WHOISdomain registered until 2032-11-24
Certificate Transparencycheck failed: crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

dns

info

Open standalone →

A/AAAA records present

Why it matters: Without authoritative A or AAAA records on the apex, the domain is unreachable. Missing baseline DNS shows up in vendor reviews as evidence of unmanaged infrastructure (SOC 2 CC6.6).

A: ttl=60 198.27.92.14
AAAA: —
NS: ttl=3325 dns104.ovh.net.
ttl=3325 ns200.anycast.me.
ttl=3325 ns104.ovh.net.
ttl=3325 dns200.anycast.me.
SOA: ttl=3600 dns200.anycast.me. tech.ovh.net. 2078059948 86400 3600 3600000 300
CAA: —
TXT: ttl=600 "cisco-ci-domain-verification=32f2b8ddce80b463dc43b33d3bb5f0c83d257bbedb6020cb5f7f25b3f661d5c9"
ttl=600 "facebook-domain-verification=8kj3gpbwyeqw41ktapwkofzwsw1uqp"
ttl=600 "3RoZhLqk4o0o5QYXFmXtW2zewSQ="
ttl=600 "google-site-verification=t7xqQ70NkWY2pbMXrFUwbfENajrQxal2VoFggL3kIDs"
ttl=600 "v=spf1 include:_corp._spf.mail.ovh.net include:_corp._spf.mail.ovh.us -all"
ttl=600 "_3t9m3f8rge9ea0snbvenv64g0vghovn"
ttl=600 "google-gws-recovery-domain-verification=62994887"
ttl=600 "apple-domain-verification=tigOYzNOjCVi5d61"
ttl=600 "docusign=a218f691-a7bf-45f4-90a8-04cd2fb65b35"
ttl=600 "MS=ms99085437"
ttl=600 "google-site-verification=RP2yxpK8JpRqf-kzOhjvOisACorxMYs6XggPHPExyaM"

fetched 2026-05-23T09:26:55.349Z

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

4 MX record(s) present

Why it matters: MX records direct inbound mail. Misconfiguration silently breaks email delivery and lets attackers stand up parallel MX hosts for spoofing campaigns (ISO 27001 A.8.21).

pri=1 mx0.mail.ovh.net.
pri=5 mx1.mail.ovh.net.
pri=50 mx2.mail.ovh.net.
pri=100 mx3.mail.ovh.net.

fetched 2026-05-23T09:26:55.287Z

mx

info

Open standalone →

resolving mx…

spf

info

Open standalone →

-all hardfail — strict policy

Why it matters: SPF tells receiving servers which hosts may send mail for the domain. Without it, any sender can forge the envelope-from — the primary mechanism behind business-email-compromise (SOC 2 CC6.7).

v=spf1 include:_corp._spf.mail.ovh.net include:_corp._spf.mail.ovh.us -all

v=spf1
include:_corp._spf.mail.ovh.net
include:_corp._spf.mail.ovh.us
-all

fetched 2026-05-23T09:26:55.350Z

spf

info

Open standalone →

resolving spf…

dmarc

medium

Open standalone →

p=none — monitoring only, no enforcement

Why it matters: DMARC binds SPF and DKIM into an enforceable policy (quarantine or reject) and surfaces spoofing attempts via aggregate reports. `p=none` or absent means spoofing succeeds silently (SOC 2 CC6.7).

Recommendations

Review rua= aggregate reports to confirm legitimate mail passes SPF/DKIM
Move to p=quarantine and then p=reject once mail flow is validated

v=DMARC1; p=none; rua=mailto:dmarc+ovhcloud.com@abuse.ovh.net; rf=afrf; pct=100;

v=: DMARC1
p=: none
rua=: mailto:dmarc+ovhcloud.com@abuse.ovh.net
rf=: afrf
pct=: 100

fetched 2026-05-23T09:26:55.289Z

dmarc

info

Open standalone →

resolving dmarc…

dkim

low

Open standalone →

no DKIM selectors found — likely not configured

Why it matters: DKIM signs outbound mail so receivers can detect tampering. Missing selectors or rotated-away keys break DMARC alignment and let receivers downgrade trust (ISO 27001 A.8.24).

Recommendations

Enable DKIM signing in your mail provider and publish the provided TXT record
Common selectors: google._domainkey, selector1._domainkey (Microsoft), mail._domainkey

no DKIM record on probed selectors (default, google, k1, selector1, selector2, mxvault)

dkim

info

Open standalone →

probing dkim selectors…

tls

low

Open standalone →

cert expires in 44 days

Why it matters: A valid current TLS certificate is the baseline for data in transit. Expiry, weak chain, or hostname mismatch break HTTPS and fail PCI 4.2.1 / SOC 2 CC6.1.

Recommendations

Schedule certificate renewal — consider enabling auto-renewal

subject cn:: ovhcloud.com
issuer:: R12 / Let's Encrypt
valid:: Apr 7 12:52:32 2026 GMT → Jul 6 12:52:31 2026 GMT
authorized:: yes
sha256:: AF:42:1E:08:32:2C:B9:EF:85:C1:C0:84:12:BA:39:05:DD:71:90:76:8A:86:35:B3:A4:AE:75:C2:DF:4C:3A:0B
sans: *.ovhcloud.com
auth.ca.ovhcloud.com
auth.eu.ovhcloud.com
manager.ca.ovhcloud.com
manager.eu.ovhcloud.com
order.ca.ovhcloud.com
order.eu.ovhcloud.com
ovhcloud.com

fetched 2026-05-23T09:26:55.316Z

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

HTTPS served correctly

Why it matters: Bare HTTP requests must redirect to HTTPS without dropping the user mid-chain. Plain-text fallback or open redirects fail PCI 4.2.1 and feed phishing chains (SOC 2 CC6.6).

final status: 200 · 2 hops

[301] https://ovhcloud.com/
[200] https://us.ovhcloud.com/

fetched 2026-05-23T09:26:55.411Z

redirects

info

Open standalone →

tracing redirects…

headers

medium

Open standalone →

4 security header(s) missing

Why it matters: Security headers — HSTS, CSP, X-Frame-Options, Referrer-Policy — defend against XSS, clickjacking, and downgrade attacks. Absent headers map directly to OWASP ASVS V14 findings (ISO 27001 A.8.23).

Recommendations

Add response header — Strict-Transport-Security: max-age=15552000; includeSubDomains
Add response header — Content-Security-Policy: default-src 'self' (tune per app)
Add response header — Referrer-Policy: strict-origin-when-cross-origin
Add permissions-policy response header

final url: https://us.ovhcloud.com/

security headers

strict-transport-security: —
content-security-policy: —
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
referrer-policy: —
permissions-policy: —

other headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: public, must-revalidate, max-age=90
connection: keep-alive
content-encoding: br
content-length: 41960
content-type: text/html
date: Sat, 23 May 2026 09:25:25 GMT
vary: Accept-Encoding
x-cacheable: Matched cache
x-cdn-pop: vin
x-cdn-pop-ip: 51.81.91.128/27
x-cdn-request-id: 7278903
x-grace: partial
x-iplb-request-id: 33515B9A:E906_C063418B:01BB_6A117284_6A09A:2EA4D3
x-toujours-debout-branch: A
x-toujours-debout-location: BHS
x-xss-protection: 1; mode=block

fetched 2026-05-23T09:26:55.395Z

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

no CORS headers — cross-origin requests blocked by default

Why it matters: Overly permissive CORS (wildcard with credentials, or reflected origin) lets any origin read authenticated responses from this domain. OWASP A05 misconfiguration territory (NIST AC-4).

origin: https://drwho.me
method: GET
preflight status: 301

access-control-* headers

access-control-allow-origin: —
access-control-allow-methods: —
access-control-allow-headers: —
access-control-allow-credentials: —
access-control-max-age: —
access-control-expose-headers: —

no access-control-* headers returned — site does not advertise CORS to this origin

fetched 2026-05-23T09:26:55.336Z

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

HTTPS surface reachable (robots ✓, sitemap ✗, title ✓)

Why it matters: Public files — robots.txt, sitemap.xml, head meta — are what attackers see first during reconnaissance. Misadvertised paths, stale sitemaps, and verbose generators leak more than intended (ISO 27001 A.8.9).

robots.txt

present

User-agent: *
Disallow: /cgi-bin/
Disallow: /7af16cdb/contrib/ovh_theme_patternlab/dist/js/ods-olu.min.js
Disallow: */node/

Sitemap: https://www.ovhcloud.com/asia/www.ovhcloud.com_en-142_sitemap.xml
Sitemap: https://www.ovhcloud.com/de/www.ovhcloud.com_de_sitemap.xml
Sitemap: https://www.ovhcloud.com/en-au/www.ovhcloud.com_en-au_sitemap.xml
Sitemap: https://www.ovhcloud.com/en-ca/www.ovhcloud.com_en-ca_sitemap.xml
Sitemap: https://www.ovhcloud.com/en-gb/www.ovhcloud.com_en-gb_sitemap.xml
Sitemap: https://www.ovhcloud.com/en-ie/www.ovhcloud.com_en-ie_sitemap.xml
Sitemap: https://www.ovhcloud.com/en-in/www.ovhcloud.com_en-in_sitemap.xml
Sitemap: https://www.ovhcloud.com/en-sg/www.ovhcloud.com_en-sg_sitemap.xml
Sitemap: https://www.ovhcloud.com/en/www.ovhcloud.com_en_sitemap.xml
Sitemap: https://www.ovhcloud.com/es-es/www.ovhcloud.com_es_sitemap.xml
Sitemap: https://www.ovhcloud.com/es/www.ovhcloud.com_es-419_sitemap.xml
Sitemap: https://www.ovhcloud.com/fr-ca/www.ovhcloud.com_fr-ca_sitemap.xml
Sitemap: https://www.ovhcloud.com/fr-ma/www.ovhcloud.com_fr-ma_sitemap.xml
Sitemap: https://www.ovhcloud.com/fr-sn/www.ovhcloud.com_fr-sn_sitemap.xml
Sitemap: https://www.ovhcloud.com/fr-tn/www.ovhcloud.com_fr-tn_sitemap.xml
Sitemap: https://www.ovhcloud.com/fr/www.ovhcloud.com_fr_sitemap.xml
Sitemap: https://www.ovhcloud.com/it/www.ovhcloud.com_it_sitemap.xml
Sitemap: https://www.ovhcloud.com/nl/www.ovhcloud.com_nl_sitemap.xml
Sitemap: https://www.ovhcloud.com/pl/www.ovhcloud.com_pl_sitemap.xml
Sitemap: https://www.ovhcloud.com/pt/www.ovhcloud.com_pt-pt_sitemap.xml

sitemap.xml

absent

head

title: OVHcloud
description: OVHcloud is a global, cloud provider delivering hosted private cloud, public cloud, and dedicated server solutions trusted by over 1.5 million developers.

social

og:site_name: OVHcloud
og:url: https://us.ovhcloud.com/
og:title: OVHcloud
twitter:site: @OVHcloud_us

fetched 2026-05-23T09:26:55.424Z

web-surface

info

Open standalone →

inspecting web surface…

dnssec

low

Open standalone →

DNSSEC not configured — no DS or DNSKEY records found

Why it matters: DNSSEC cryptographically signs DNS responses, blocking cache-poisoning attacks. US federal civilian agencies are required to enable it under OMB M-22-09 (NIST SC-20).

Recommendations

Enable DNSSEC in your DNS provider's control panel and add the resulting DS record at your registrar

enabled: no
DS records: —
DNSKEY records: —

fetched 2026-05-23T09:26:55.351Z

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

not applicable: no _mta-sts TXT record

Why it matters: MTA-STS forces inbound SMTP to use TLS and refuse downgraded connections. Without it, an in-path attacker can strip TLS and read mail in plaintext (SOC 2 CC6.7).

no _mta-sts TXT record

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

not applicable: no TLSRPT record

Why it matters: TLS-RPT publishes a reporting address for SMTP-TLS failures. Without it, downgrade attacks on inbound mail go unnoticed (SOC 2 CC7.2).

no TLSRPT record

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

domain registered until 2032-11-24

Why it matters: Registrar and expiry tell auditors the domain is owned, current, and not about to lapse. An expired or about-to-expire domain fails business-continuity evidence (SOC 2 A1.2).

registrar: OVH sas
created: 2011-11-24T14:49:05Z
expires: 2032-11-24T14:49:05Z
statuses: clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited, clientTransferProhibited https://icann.org/epp#clientTransferProhibited

fetched 2026-05-23T09:26:55.551Z

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

check failed: crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

Why it matters: Every certificate issued for this domain is published in Certificate Transparency logs — including subdomains you may have forgotten. Unknown subdomains in CT are pre-disclosed attack surface (ISO 27001 A.8.16).

crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.