rockylinux.org

15-check dossier · scoreboard above, section details below

Get a pack →

Scanning…

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

resolving mx…

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

resolving dmarc…

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

tracing redirects…

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

inspecting web surface…

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.

rockylinux.org

15-check dossier · scoreboard above, section details below

Get a pack →

A-

Audit-ready · 5 minor advisories

Aggregate grade across 15 checks. Auditors typically flag any High-severity finding.

Pass: 10
Warn: 5
Fail: 0

What an auditor would flag first

low
DKIM
1/6 DKIM selectors valid
SOC 2 CC6.7
low
TLS certificate
cert expires in 59 days
SOC 2 CC6.6ISO 27001 A.13.1.1
low
Security headers
5 security header(s) missing
SOC 2 CC6.6ISO 27001 A.14.1.2

Need this as an artifact your auditor can verify?

Your rockylinux.org scan flagged 5 low findings. A signed pack covers the apex plus up to 100 CT-discovered subdomains, Ed25519-signed and ISO-timestamped, delivered in 10–30 minutes.

Get a pack →See methodology See a sample$29

Scanning…

15-check summary

DNS recordsA/AAAA records present
MX5 MX record(s) present
SPF-all hardfail — strict policy
DMARCp=reject — strict policy
DKIM1/6 DKIM selectors valid
TLS certificatecert expires in 59 days
Redirect chainHTTPS served correctly
Security headers5 security header(s) missing
CORSCORS allows all origins (wildcard)
Web surfaceHTTPS surface reachable (robots ✓, sitemap ✓, title ✓)
MTA-STSnot applicable: no _mta-sts TXT record
TLS-RPTTLSRPT configured with reporting URI (rua=)
DNSSECDNSSEC not configured — no DS or DNSKEY records found
WHOISdomain registered until 2028-12-08
Certificate Transparencycheck failed: crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

dns

info

Open standalone →

A/AAAA records present

Why it matters: Without authoritative A or AAAA records on the apex, the domain is unreachable. Missing baseline DNS shows up in vendor reviews as evidence of unmanaged infrastructure (SOC 2 CC6.6).

A: ttl=120 76.223.126.88
AAAA: —
NS: ttl=86400 liv.ns.cloudflare.com.
ttl=86400 morgan.ns.cloudflare.com.
SOA: ttl=1800 liv.ns.cloudflare.com. dns.cloudflare.com. 2404897243 10000 2400 604800 1800
CAA: —
TXT: ttl=300 "amazon-business-verification=c436c427a9ec325c30943cb05e727ae2162039acf5c161f116ad34d6ea078435"
ttl=300 "bw=a4N7fBowulseyn1CAdlp8uhKfn6NbWs1ctxmGlZLaaKn"
ttl=300 "google-site-verification=rkegTzZA363jFQ1w8ICKSXVWEIcE7vOdvzhMoOnhWgc"
ttl=300 "google-site-verification=u60rL1os-NSYu4NK4pNDOmsjhEHu0neQyvPHttj5_b8"
ttl=300 "v=spf1 a include:_spf.google.com include:sendgrid.net include:_spf.z2systems.com include:_spf.neonemails.com -all"

fetched 2026-05-23T09:36:54.969Z

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

5 MX record(s) present

Why it matters: MX records direct inbound mail. Misconfiguration silently breaks email delivery and lets attackers stand up parallel MX hosts for spoofing campaigns (ISO 27001 A.8.21).

pri=1 aspmx.l.google.com.
pri=5 alt1.aspmx.l.google.com.
pri=5 alt2.aspmx.l.google.com.
pri=10 alt3.aspmx.l.google.com.
pri=10 alt4.aspmx.l.google.com.

fetched 2026-05-23T09:36:54.970Z

mx

info

Open standalone →

resolving mx…

spf

info

Open standalone →

-all hardfail — strict policy

Why it matters: SPF tells receiving servers which hosts may send mail for the domain. Without it, any sender can forge the envelope-from — the primary mechanism behind business-email-compromise (SOC 2 CC6.7).

v=spf1 a include:_spf.google.com include:sendgrid.net include:_spf.z2systems.com include:_spf.neonemails.com -all

v=spf1
a
include:_spf.google.com
include:sendgrid.net
include:_spf.z2systems.com
include:_spf.neonemails.com
-all

fetched 2026-05-23T09:36:54.970Z

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

p=reject — strict policy

Why it matters: DMARC binds SPF and DKIM into an enforceable policy (quarantine or reject) and surfaces spoofing attempts via aggregate reports. `p=none` or absent means spoofing succeeds silently (SOC 2 CC6.7).

v=DMARC1; p=reject;

v=: DMARC1
p=: reject

fetched 2026-05-23T09:36:54.971Z

dmarc

info

Open standalone →

resolving dmarc…

dkim

low

Open standalone →

1/6 DKIM selectors valid

Why it matters: DKIM signs outbound mail so receivers can detect tampering. Missing selectors or rotated-away keys break DMARC alignment and let receivers downgrade trust (ISO 27001 A.8.24).

Recommendations

Check the missing selectors in your DNS provider and re-add any removed records

default:: —
google:: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA9cFwXpa+Tbqua4BuwP7QuzdLQPN5FB3pQEqjDR1x9t/CU7wwP88OSozMYLTUmktfjfjrXYQZ2V96nKCFdhNK3rQ7zfjp8NrUHW/OnnRkebH+NTbTJg1ke2HitiUVKUWyqv1c3BBZT1x9HGgLDBo4ApdR8ry5Z3z4Lf3ke0xd4ZuQsM64LzRIW1xeiVC5jetDjNRfojb9flq1vESTFT4fwaUXb4bltZ3Sm4JPYmjFRudCK3LC/xlEs8IprlUXLUk4u4oJtWUOB66zBS35VZPPPH9gtsyAlLv5+hgk6K+1OcMbBXQVbJTaB7K80i+cZgOMv0437UlA8xEkPFWfSAsk6wIDAQAB
k1:: —
selector1:: —
selector2:: —
mxvault:: —

fetched 2026-05-23T09:36:54.975Z

dkim

info

Open standalone →

probing dkim selectors…

tls

low

Open standalone →

cert expires in 59 days

Why it matters: A valid current TLS certificate is the baseline for data in transit. Expiry, weak chain, or hostname mismatch break HTTPS and fail PCI 4.2.1 / SOC 2 CC6.1.

Recommendations

Schedule certificate renewal — consider enabling auto-renewal

subject cn:: rockylinux.org
issuer:: R13 / Let's Encrypt
valid:: Apr 23 06:21:20 2026 GMT → Jul 22 06:21:19 2026 GMT
authorized:: yes
sha256:: EA:E3:D4:37:27:E0:AA:4B:3A:44:8E:5B:FE:6F:87:F3:24:FD:85:0F:97:89:4D:D4:18:3A:C3:90:8D:C2:93:49
sans: rockylinux.org

fetched 2026-05-23T09:36:55.001Z

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

HTTPS served correctly

Why it matters: Bare HTTP requests must redirect to HTTPS without dropping the user mid-chain. Plain-text fallback or open redirects fail PCI 4.2.1 and feed phishing chains (SOC 2 CC6.6).

final status: 200 · 1 hop

[200] https://rockylinux.org/

fetched 2026-05-23T09:36:55.050Z

redirects

info

Open standalone →

tracing redirects…

headers

low

Open standalone →

5 security header(s) missing

Why it matters: Security headers — HSTS, CSP, X-Frame-Options, Referrer-Policy — defend against XSS, clickjacking, and downgrade attacks. Absent headers map directly to OWASP ASVS V14 findings (ISO 27001 A.8.23).

Recommendations

Add response header — Content-Security-Policy: default-src 'self' (tune per app)
Add response header — X-Frame-Options: DENY (or SAMEORIGIN if framing is intended)
Add response header — X-Content-Type-Options: nosniff
Add response header — Referrer-Policy: strict-origin-when-cross-origin
Add permissions-policy response header

final url: https://rockylinux.org/

security headers

strict-transport-security: max-age=63072000
content-security-policy: —
x-frame-options: —
x-content-type-options: —
referrer-policy: —
permissions-policy

headers

info

Open standalone →

fetching headers…

cors

low

Open standalone →

CORS allows all origins (wildcard)

Why it matters: Overly permissive CORS (wildcard with credentials, or reflected origin) lets any origin read authenticated responses from this domain. OWASP A05 misconfiguration territory (NIST AC-4).

Recommendations

Restrict Access-Control-Allow-Origin to specific trusted origins if this API is not fully public

origin: https://drwho.me
method: GET
preflight status: 204

access-control-* headers

access-control-allow-origin: *
access-control-allow-methods: OPTIONS, GET, HEAD
access-control-allow-headers: —
access-control-allow-credentials: —
access-control-max-age: —
access-control-expose-headers: —

fetched 2026-05-23T09:36:55.226Z

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

HTTPS surface reachable (robots ✓, sitemap ✓, title ✓)

Why it matters: Public files — robots.txt, sitemap.xml, head meta — are what attackers see first during reconnaissance. Misadvertised paths, stale sitemaps, and verbose generators leak more than intended (ISO 27001 A.8.9).

robots.txt

present

User-agent: *
Allow: /
Crawl-delay: 10

Sitemap: https://rockylinux.org/sitemap.xml

User-agent: Yandex
Crawl-delay: 20

User-agent: AhrefsBot
Disallow: /

sitemap.xml

present — 16 url(s)

head

title: Rocky Linux
description: Rocky Linux is an open enterprise Operating System designed to be 100% bug-for-bug compatible with Enterprise Linux.

social

og:title: Rocky Linux
og:description: Rocky Linux is an open enterprise Operating System designed to be 100% bug-for-bug compatible with Enterprise Linux.
og:url: https://rockylinux.org
og:site_name: Rocky Linux
og:locale: en_US
og:type: website
twitter:card: summary
twitter:title: Rocky Linux
twitter:description: Rocky Linux is an open enterprise Operating System designed to be 100% bug-for-bug compatible with Enterprise Linux.

fetched 2026-05-23T09:36:55.091Z

web-surface

info

Open standalone →

inspecting web surface…

dnssec

low

Open standalone →

DNSSEC not configured — no DS or DNSKEY records found

Why it matters: DNSSEC cryptographically signs DNS responses, blocking cache-poisoning attacks. US federal civilian agencies are required to enable it under OMB M-22-09 (NIST SC-20).

Recommendations

Enable DNSSEC in your DNS provider's control panel and add the resulting DS record at your registrar

enabled: no
DS records: —
DNSKEY records: —

fetched 2026-05-23T09:36:55.024Z

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

not applicable: no _mta-sts TXT record

Why it matters: MTA-STS forces inbound SMTP to use TLS and refuse downgraded connections. Without it, an in-path attacker can strip TLS and read mail in plaintext (SOC 2 CC6.7).

no _mta-sts TXT record

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

TLSRPT configured with reporting URI (rua=)

Why it matters: TLS-RPT publishes a reporting address for SMTP-TLS failures. Without it, downgrade attacks on inbound mail go unnoticed (SOC 2 CC7.2).

version: TLSRPTv1
rua: mailto:mailadmin@resf.org
raw: v=TLSRPTv1; rua=mailto:mailadmin@resf.org

fetched 2026-05-23T09:36:54.977Z

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

domain registered until 2028-12-08

Why it matters: Registrar and expiry tell auditors the domain is owned, current, and not about to lapse. An expired or about-to-expire domain fails business-continuity evidence (SOC 2 A1.2).

registrar: GoDaddy.com, LLC
created: 2020-12-08T22:03:59Z
expires: 2028-12-08T22:03:59Z
statuses: clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited, clientRenewProhibited https://icann.org/epp#clientRenewProhibited, clientTransferProhibited https://icann.org/epp#clientTransferProhibited, clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited

fetched 2026-05-23T09:36:55.130Z

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

check failed: crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

Why it matters: Every certificate issued for this domain is published in Certificate Transparency logs — including subdomains you may have forgotten. Unknown subdomains in CT are pre-disclosed attack surface (ISO 27001 A.8.16).

crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.