qwant.com

15-check dossier · scoreboard above, section details below

Get a pack →

Scanning…

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

resolving mx…

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

resolving dmarc…

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

tracing redirects…

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

inspecting web surface…

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.

qwant.com

15-check dossier · scoreboard above, section details below

Get a pack →

A-

Audit-ready · 2 minor advisories

Aggregate grade across 15 checks. Auditors typically flag any High-severity finding.

Pass: 13
Warn: 2
Fail: 0

What an auditor would flag first

low
DKIM
1/6 DKIM selectors valid
SOC 2 CC6.7
low
TLS certificate
cert expires in 51 days
SOC 2 CC6.6ISO 27001 A.13.1.1

Need this as an artifact your auditor can verify?

Your qwant.com scan flagged 2 low findings. A signed pack covers the apex plus up to 100 CT-discovered subdomains, Ed25519-signed and ISO-timestamped, delivered in 10–30 minutes.

Get a pack →See methodology See a sample$29

Scanning…

15-check summary

DNS recordsA/AAAA records present
MX1 MX record(s) present
SPF-all hardfail — strict policy
DMARCp=reject — strict policy
DKIM1/6 DKIM selectors valid
TLS certificatecert expires in 51 days
Redirect chainHTTPS served correctly
Security headers1 security header(s) missing
CORSno CORS headers — cross-origin requests blocked by default
Web surfaceHTTPS surface reachable (robots ✓, sitemap ✓, title ✓)
MTA-STSnot applicable: no _mta-sts TXT record
TLS-RPTnot applicable: no TLSRPT record
DNSSECDNSSEC enabled — DS records present and chain validated (AD flag)
WHOISdomain registered until 2026-10-28
Certificate Transparencycheck failed: crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

dns

info

Open standalone →

A/AAAA records present

Why it matters: Without authoritative A or AAAA records on the apex, the domain is unreachable. Missing baseline DNS shows up in vendor reviews as evidence of unmanaged infrastructure (SOC 2 CC6.6).

A: ttl=86400 54.38.0.163
ttl=86400 141.94.211.182
ttl=86400 141.95.150.143
AAAA: —
NS: ttl=86400 gns21.cloudns.net.
ttl=86400 gns22.cloudns.net.
ttl=86400 gns23.cloudns.net.
ttl=86400 gns24.cloudns.net.
SOA: ttl=3600 gns21.cloudns.net. support.cloudns.net. 2026051601 7200 1800 1209600 3600
CAA: ttl=3600 \# 22 00 05 69 73 73 75 65 6c 65 74 73 65 6e 63 72 79 70 74 2e 6f 72 67
ttl=3600 \# 18 00 05 69 73 73 75 65 73 65 63 74 69 67 6f 2e 63 6f 6d
ttl=3600 \# 26 00 09 69 73 73 75 65 77 69 6c 64 6c 65 74 73 65 6e 63 72 79 70 74 2e 6f 72 67
ttl=3600 \# 22 00 09 69 73 73 75 65 77 69 6c 64 73 65 63 74 69 67 6f 2e 63 6f 6d
TXT: ttl=3600 "Dv9-b7p-47M"
ttl=3600 "MS=ms90901364"
ttl=3600 "apple-domain-verification=p4IYUqjmTB4BXLwx"
ttl=3600 "cursor-domain-verification-df0kan=HoA0KzastxtEwLsdXTG1cfjVn"
ttl=3600 "slack-domain-verification=dGJ6Osn5PVcN9TkhenEXKcr47ZqlcW8RVuxRcjkJ"
ttl=3600 "google-site-verification=NcOr9SlS_5_ozLbftZgGKfMjASv7Ob2a7m02z7AtrFA"
ttl=3600 "google-site-verification=Z7u9u7Y5i6rXSLYbg8vnl2VtEdeYDsLlBBPwOETbejI"
ttl=3600 "google-site-verification=cJ0ILi3TKzkP23HzzS1Y9StYqpduBFLGoPKzfNihisg"
ttl=3600 "google-site-verification=erMLYVscQmYoBGeH9zMDdXlMTi0B8HoxdQGv1Mk1zb8"
ttl=3600 "google-site-verification=fNsOxqy4iwCayCWTalHcZzGt2knNDL6EU5dbkd5iCXk"
ttl=3600 "google-site-verification=mHRzapUOfSYsw5EQJyoEnpzt2j6IEzAuFoS9jNd6lSM"
ttl=3600 "mistral-domain-verification=0b41d06c88051780d0a380e2b6b6f26d4196305f"
ttl=3600 "notion-domain-verification=C2QSoe44VMe08G4F4unNGERKrDu4qXVvuhK8dLHYLAc"
ttl=3600 "riot-domain-verification=f44e72e1a8a86c56da96b1b2e486ac5c8944a8360d45b4fa8c9e8ca7723a"
ttl=3600 "v=spf1 ip4:194.187.168.35 ip4:194.187.168.37 ip4:194.187.168.38 ip4:94.23.181.132 ip4:52.28.158.135 ip4:52.29.12.146 include:_spf.google.com -all"

fetched 2026-05-23T09:28:09.986Z

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

1 MX record(s) present

Why it matters: MX records direct inbound mail. Misconfiguration silently breaks email delivery and lets attackers stand up parallel MX hosts for spoofing campaigns (ISO 27001 A.8.21).

pri=1 smtp.google.com.

fetched 2026-05-23T09:28:09.984Z

mx

info

Open standalone →

resolving mx…

spf

info

Open standalone →

-all hardfail — strict policy

Why it matters: SPF tells receiving servers which hosts may send mail for the domain. Without it, any sender can forge the envelope-from — the primary mechanism behind business-email-compromise (SOC 2 CC6.7).

v=spf1 ip4:194.187.168.35 ip4:194.187.168.37 ip4:194.187.168.38 ip4:94.23.181.132 ip4:52.28.158.135 ip4:52.29.12.146 include:_spf.google.com -all

v=spf1
ip4:194.187.168.35
ip4:194.187.168.37
ip4:194.187.168.38
ip4:94.23.181.132
ip4:52.28.158.135
ip4:52.29.12.146
include:_spf.google.com
-all

fetched 2026-05-23T09:28:09.988Z

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

p=reject — strict policy

Why it matters: DMARC binds SPF and DKIM into an enforceable policy (quarantine or reject) and surfaces spoofing attempts via aggregate reports. `p=none` or absent means spoofing succeeds silently (SOC 2 CC6.7).

v=DMARC1; p=reject; pct=100; rua=mailto:dmarc-report@qwant.com;

v=: DMARC1
p=: reject
pct=: 100
rua=: mailto:dmarc-report@qwant.com

fetched 2026-05-23T09:28:09.985Z

dmarc

info

Open standalone →

resolving dmarc…

dkim

low

Open standalone →

1/6 DKIM selectors valid

Why it matters: DKIM signs outbound mail so receivers can detect tampering. Missing selectors or rotated-away keys break DMARC alignment and let receivers downgrade trust (ISO 27001 A.8.24).

Recommendations

Check the missing selectors in your DNS provider and re-add any removed records

default:: —
google:: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA7UEz80wP+0644e9M+3+AiGdvAck21BBGvdS+TZkE9bosvF+qT6wp0+nsPTIai3ntFl2F/0aqOpgQKehBpC2XQTu72N9YnjCYMyoDFkIsHzwk3Q3dC/jiXC3Z5KEMTyeXAFbwJvs16bkeLyskk8V6s+a4hIfO+gGTVQCgZC+lI8roTaRM7F0ta5+dQBLZkSZ71g1LwNCaNFZNRgpN6hAujTFrlbfQY6OA9aZlzrDV3IqUXt5jTcwPcxJeBtub6CsqxqnzohBQ9M38OsG6LOVAAyiQlPj6V4981qWJJQVtS4KyOgWlTyNd2otfFDXMmG6RpBsbovanl1ZFsjMSHUUDgQIDAQAB
k1:: —
selector1:: —
selector2:: —
mxvault:: —

fetched 2026-05-23T09:28:09.990Z

dkim

info

Open standalone →

probing dkim selectors…

tls

low

Open standalone →

cert expires in 51 days

Why it matters: A valid current TLS certificate is the baseline for data in transit. Expiry, weak chain, or hostname mismatch break HTTPS and fail PCI 4.2.1 / SOC 2 CC6.1.

Recommendations

Schedule certificate renewal — consider enabling auto-renewal

subject cn:: *.qwant.com
issuer:: Gandi RSA Domain Validation Secure Server CA 3 / Gandi
valid:: Jun 26 00:00:00 2025 GMT → Jul 13 23:59:59 2026 GMT
authorized:: yes
sha256:: BC:31:1B:75:E2:F1:13:CF:0C:F9:ED:4F:72:DA:4F:9B:A3:36:C1:EB:90:77:15:D7:68:59:01:E3:92:E9:5C:91
sans: *.qwant.com
qwant.com

fetched 2026-05-23T09:28:10.180Z

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

HTTPS served correctly

Why it matters: Bare HTTP requests must redirect to HTTPS without dropping the user mid-chain. Plain-text fallback or open redirects fail PCI 4.2.1 and feed phishing chains (SOC 2 CC6.6).

final status: 200 · 2 hops

[302] https://qwant.com/
[200] https://www.qwant.com/

fetched 2026-05-23T09:28:10.623Z

redirects

info

Open standalone →

tracing redirects…

headers

info

Open standalone →

1 security header(s) missing

Why it matters: Security headers — HSTS, CSP, X-Frame-Options, Referrer-Policy — defend against XSS, clickjacking, and downgrade attacks. Absent headers map directly to OWASP ASVS V14 findings (ISO 27001 A.8.23).

Recommendations

Add permissions-policy response header

final url: https://www.qwant.com/

security headers

strict-transport-security: max-age=31536000; includeSubDomains
content-security-policy: default-src 'self' data: blob:;script-src 'self' 'unsafe-inline' 'unsafe-eval' data: *.qwant.com qwant.com *.qwant.com qwant.com;script-src-elem 'self' 'unsafe-inline' data: *.qwant.com qwant.com *.qwant.com sdk.privacy-center.org api.privacy-center.org qwant-prod.piwik.pro https://*.clarity.ms https://c.bing.com https://msadsscale.azureedge.net https://msadsscale.microsoft.com ;style-src 'self' 'unsafe-inline' data: *.qwant.com qwant.com;object-src 'self';connect-src 'self' ws: *.apple.com *.qwant.com qwant.com *.qwant.com qwant.com https://*.clarity.ms https://c.bing.com https://msadsscale.azureedge.net https://*.microsoft.com sdk.privacy-center.org api.privacy-center.org qwant-prod.piwik.pro ;img-src blob: 'self' www.qwant.com s1.qwant.com s2.qwant.com s.qwant.com f.qwant.com data: s.qwant.com s1.qwant.com s2.qwant.com www.qwant.com *.s3.gra.io.cloud.ovh.net sdk.privacy-center.org https://*.clarity.ms https://c.bing.com prod-adserver.s3.gra.perf.cloud.ovh.net;frame-ancestors *.qwant.com *.qwant.com;form-action auth.qwant.com accounts.google.com appleid.apple.com;font-src 'self';worker-src blob: 'self' www.youtube-nocookie.com www.youtube.com;frame-src player.twitch.tv player.vimeo.com www.dailymotion.com www.youtube-nocookie.com net.geo.opera.com *.captcha-delivery.com *.qwant.com *.qwant.com;media-src blob: *.qwant.com *.qwant.com *.apple.com *.s3.gra.io.cloud.ovh.net;base-uri 'self'
x-frame-options: SAMEORIGIN, SAMEORIGIN
x-content-type-options: nosniff, nosniff
referrer-policy: no-referrer, same-origin
permissions-policy: —

other headers

accept-ch: Sec-CH-Prefers-Color-Scheme
accept-ranges: bytes
age: 0
cache-control: no-cache
connection: keep-alive
content-encoding: gzip
content-language: en
content-type: text/html; charset=utf-8
critical-ch: Sec-CH-Prefers-Color-Scheme
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: same-origin
date: Sat, 23 May 2026 09:28:10 GMT
etag: W/"247e4-tFzvIli72hTt9HxYOTb5j8KwYRg"
origin-agent-cluster: ?1
permission-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(self), camera=(), display-capture=(), document-domain=(), encrypted-media=(), fullscreen=(), geolocation=(self), gyroscope=(), interest-cohort=(), magnetometer=(), microphone=(), midi=(), oversized-images=(), payment=(), speaker=(self), sync-xhr=(self "https://api.qwant.com/v3"), usb=(), vibrate=(), vr=()
set-cookie: ab_test_group=2; Max-Age=15552000; Path=/; Expires=Thu, 19 Nov 2026 09:28:10 GMT; SameSite=Lax
transfer-encoding: chunked
vary: Accept-Encoding, Sec-CH-Prefers-Color-Scheme
x-cache: MISS

fetched 2026-05-23T09:28:10.621Z

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

no CORS headers — cross-origin requests blocked by default

Why it matters: Overly permissive CORS (wildcard with credentials, or reflected origin) lets any origin read authenticated responses from this domain. OWASP A05 misconfiguration territory (NIST AC-4).

origin: https://drwho.me
method: GET
preflight status: 302

access-control-* headers

access-control-allow-origin: —
access-control-allow-methods: —
access-control-allow-headers: —
access-control-allow-credentials: —
access-control-max-age: —
access-control-expose-headers: —

no access-control-* headers returned — site does not advertise CORS to this origin

fetched 2026-05-23T09:28:10.268Z

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

HTTPS surface reachable (robots ✓, sitemap ✓, title ✓)

Why it matters: Public files — robots.txt, sitemap.xml, head meta — are what attackers see first during reconnaissance. Misadvertised paths, stale sitemaps, and verbose generators leak more than intended (ISO 27001 A.8.9).

robots.txt

present


<!doctype html>
<html lang="en">

  

  <head>
    <meta charset="utf-8">
    <meta http-equiv="X-UA-Compatible" content="IE=edge">
    <meta http-equiv="Accept-CH" content="Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA, Sec-CH-Prefers-Color-Scheme">
    <base href="https://www.qwant.com">
    <meta name="theme-color" content="#FFFFFF">
    <meta name="twitter:card" content="summary_large_image">
    <meta name="twitter:site" content="@QwantCom">
    <meta name="twitter:creator" content="@QwantCom">
    <meta name="twitter:domain" content="https://www.qwant.com">
    <meta name="twitter:widgets:csp" content="on"/>
    
        <meta property="og:image" content="https://www.qwant.com/public/qwant-logo-seo.0ea4e62ad0a6047e242cdb57128d7995.png" />
        <meta property="og:image:width" content="1000" />
        <meta property="og:image:height" content="536" />
        <meta name="twitter:image" content="https://www.qwant.com/public/qwant-logo-seo.0ea4e62ad0a6047e242cdb57128d7995.png">
      
    <meta property="og:type" content="website"/>
    <meta property="og:url" content="https://www.qwant.com" id="meta_og_url"/>
    <meta name="application-name" content="Qwant"/>
    <meta name="viewport" content="width=device-width,initial-scale=1.0,minimum-scale=1.0" />
    <title>Qwant - The search engine that values you as a user, not as a product</title>
    <meta name="description" content="Fast, reliable answers and still in trust: Qwant does not store your search data, does not sell your personal data and is hosted in Europe."/>
    <meta name="keywords" content="search engine"/>
    <meta property="og:description" content="Fast, reliable answers and still in trust: Qwant does not store your search data, does not sell your personal data and is hosted in Europe."/>
    <meta property="og:title" content="Qwant" id="meta_og_title"/>
    <meta property="og:site_name" content="Qwant"/>
    <meta name="twitter:title" content="Qwant - The search engine that values you as a user, not as a product"/>
    <link rel="manifest" href="/manifest.json">
    <link data-chunk="app" rel="preload" as="style" href="/c8969f81142adc494461_app.chunks.css">
<link data-chunk="app" rel="preload" as="script" href="/4ec8526027d539c9caaa_runtime.Phoenix.js">
<link data-chunk="app" rel="preload" as="script" href="/687ca90010a1a686c7dc_vendors~app.chunks.js">
<link data-chunk="app" rel="preload" as="script" href="/8750bb349ab968b15e12_app.chunks.js">
    <link data-chunk="app" rel="stylesheet" href="/c8969f81142adc494461_app.chunks.css">
    <meta name="robots" content="index">
    <link rel="shortcut icon" href="/public/favicon.066f5ee2ab77b590bb5846c32c57cb84.ico" type="image/x-icon">
    <link rel="icon" href="/public/favicon.97e9bd6cd3d07b5f096430c1b09ea705.png" type="image/png">
    <link rel="icon" sizes="32x32" type="image/png" href="/public/favicon-32.9d2af599f2a0364630ddb8a2a32026ec.png" type="image/png">
    <link rel="icon" sizes="64x64" type="image/png" href="/public/favicon-64.ddb1092939bad1aaca378c29744e7be3.png" type="image/png">
    <link rel="icon" sizes="96x96" type="image/png" href="/public/favicon-96.3a477836f89ad0ed8e0420c7c7ef4679.png" type="image/png">
    <link rel="icon" sizes="144x144" type="image/png" href="/public/favicon-144.6fdb01169d8537aeadd4f95dce2982e4.png" type="image/png">
    <link rel="icon" sizes="152x152" href="/public/favicon-152.8c87cc8fd7862d72eee478c8f503d3e8.png" type="image/png">
    <link rel="icon" sizes="196x196" href="/public/favicon-196.b2a1214ee3c261334512a377f1d678f7.png" type="image/png">
    <link rel="apple-touch-icon" sizes="152x152" href="/public/apple-touch-icon.e9d3092ec9fb9e1a28c1ea1a3b10777a.png">
    <link rel="apple-touch-icon" sizes="60x60" href="/public/apple-touch-icon-60x60.2f06b254c6f7bc88c95cb88780b2548d.png">
    <link rel="apple-touch-icon" sizes="76x76" href="/public/apple-touch-

sitemap.xml

present — 0 url(s)

head

title: Qwant - The search engine that values you as a user, not as a product
description: Fast, reliable answers and still in trust: Qwant does not store your search data, does not sell your personal data and is hosted in Europe.

social

og:image: https://www.qwant.com/public/qwant-logo-seo.0ea4e62ad0a6047e242cdb57128d7995.png
og:image:width: 1000
og:image:height: 536
og:type: website
og:url: https://www.qwant.com
og:description: Fast, reliable answers and still in trust: Qwant does not store your search data, does not sell your personal data and is hosted in Europe.
og:title: Qwant
og:site_name: Qwant
twitter:card: summary_large_image
twitter:site: @QwantCom
twitter:creator: @QwantCom
twitter:domain: https://www.qwant.com
twitter:widgets:csp: on
twitter:image: https://www.qwant.com/public/qwant-logo-seo.0ea4e62ad0a6047e242cdb57128d7995.png
twitter:title: Qwant - The search engine that values you as a user, not as a product

fetched 2026-05-23T09:28:10.736Z

web-surface

info

Open standalone →

inspecting web surface…

dnssec

info

Open standalone →

DNSSEC enabled — DS records present and chain validated (AD flag)

Why it matters: DNSSEC cryptographically signs DNS responses, blocking cache-poisoning attacks. US federal civilian agencies are required to enable it under OMB M-22-09 (NIST SC-20).

enabled: yes
DS records: 47504 ECDSAP256SHA256 2 c724f1a55fb918ad5f5a6799ad753de436068472fa16a011e23809c1f06212a9, DS ECDSAP256SHA256 2 86400 1779841208 1779232208 27677 com. Y9g8EOceLVZ2/u5cyFwrHXtqxcfUh0EhmY8B6ysxSd1L1KleW8zuD19LNkQ6MajrWcLXojQderChKrTVPzakng==
DNSKEY records: 4 key(s)

fetched 2026-05-23T09:28:09.991Z

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

not applicable: no _mta-sts TXT record

Why it matters: MTA-STS forces inbound SMTP to use TLS and refuse downgraded connections. Without it, an in-path attacker can strip TLS and read mail in plaintext (SOC 2 CC6.7).

no _mta-sts TXT record

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

not applicable: no TLSRPT record

Why it matters: TLS-RPT publishes a reporting address for SMTP-TLS failures. Without it, downgrade attacks on inbound mail go unnoticed (SOC 2 CC7.2).

no TLSRPT record

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

domain registered until 2026-10-28

Why it matters: Registrar and expiry tell auditors the domain is owned, current, and not about to lapse. An expired or about-to-expire domain fails business-continuity evidence (SOC 2 A1.2).

registrar: Gandi SAS
created: 2009-10-28T18:47:26Z
expires: 2026-10-28T18:47:26Z
statuses: clientTransferProhibited https://icann.org/epp#clientTransferProhibited

fetched 2026-05-23T09:28:10.274Z

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

check failed: crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

Why it matters: Every certificate issued for this domain is published in Certificate Transparency logs — including subdomains you may have forgotten. Unknown subdomains in CT are pre-disclosed attack surface (ISO 27001 A.8.16).

crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.