salon.com

15-check dossier · scoreboard above, section details below

Get a pack →

Scanning…

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

resolving mx…

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

resolving dmarc…

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

tracing redirects…

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

inspecting web surface…

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.

salon.com

15-check dossier · scoreboard above, section details below

Get a pack →

Mostly compliant · 4 items need attention

Aggregate grade across 15 checks. Auditors typically flag any High-severity finding.

Pass: 11
Warn: 4
Fail: 0

What an auditor would flag first

medium
SPF
~all softfail — receivers may still accept
SOC 2 CC6.7ISO 27001 A.13.2.1
medium
Security headers
6 security header(s) missing
SOC 2 CC6.6ISO 27001 A.14.1.2
low
DKIM
1/6 DKIM selectors valid
SOC 2 CC6.7

Need this as an artifact your auditor can verify?

Your salon.com scan flagged 2 medium and 2 low findings. A signed pack covers the apex plus up to 100 CT-discovered subdomains, Ed25519-signed and ISO-timestamped, delivered in 10–30 minutes.

Get a pack →See methodology See a sample$29

Scanning…

15-check summary

DNS recordsA/AAAA records present
MX5 MX record(s) present
SPF~all softfail — receivers may still accept
DMARCp=reject — strict policy
DKIM1/6 DKIM selectors valid
TLS certificatecert valid for 195 days
Redirect chainHTTPS served correctly
Security headers6 security header(s) missing
CORSno CORS headers — cross-origin requests blocked by default
Web surfaceHTTPS surface reachable (robots ✓, sitemap ✓, title ✓)
MTA-STSnot applicable: no _mta-sts TXT record
TLS-RPTnot applicable: no TLSRPT record
DNSSECDNSSEC not configured — no DS or DNSKEY records found
WHOISdomain registered until 2033-01-06
Certificate Transparencycheck failed: crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

dns

info

Open standalone →

A/AAAA records present

Why it matters: Without authoritative A or AAAA records on the apex, the domain is unreachable. Missing baseline DNS shows up in vendor reviews as evidence of unmanaged infrastructure (SOC 2 CC6.6).

A: ttl=60 3.171.85.70
ttl=60 3.171.85.80
ttl=60 3.171.85.75
ttl=60 3.171.85.35
AAAA: —
NS: ttl=172800 ns-1103.awsdns-09.org.
ttl=172800 ns-1607.awsdns-08.co.uk.
ttl=172800 ns-34.awsdns-04.com.
ttl=172800 ns-517.awsdns-00.net.
SOA: ttl=900 ns-1607.awsdns-08.co.uk. awsdns-hostmaster.amazon.com. 1 7200 900 1209600 86400
CAA: —
TXT: ttl=1 "facebook-domain-verification=tgeiwtothsyny0dy06usfbpl583mto"
ttl=1 "google-site-verification=hCbtC5LIs9hJenUgF1QbrofFesJQOmGbA-BbkOzCZh4"
ttl=1 "google-site-verification=hOEkpArutU5BARUdnMbdzG_y7lrF7509hzx-SSVBZ4g"
ttl=1 "google-site-verification=rSsR11v5yGkHvoifcozdHxAMfv7gGmkig_M1Fa3-9Yk"
ttl=1 "v=spf1 include:_spf.google.com include:amazonses.com include:sparkpostmail.com include:sendgrid.net ~all"

fetched 2026-05-23T09:26:42.940Z

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

5 MX record(s) present

Why it matters: MX records direct inbound mail. Misconfiguration silently breaks email delivery and lets attackers stand up parallel MX hosts for spoofing campaigns (ISO 27001 A.8.21).

pri=1 aspmx.l.google.com.
pri=5 alt1.aspmx.l.google.com.
pri=5 alt2.aspmx.l.google.com.
pri=10 aspmx2.googlemail.com.
pri=10 aspmx3.googlemail.com.

fetched 2026-05-23T09:26:43.120Z

mx

info

Open standalone →

resolving mx…

spf

medium

Open standalone →

~all softfail — receivers may still accept

Why it matters: SPF tells receiving servers which hosts may send mail for the domain. Without it, any sender can forge the envelope-from — the primary mechanism behind business-email-compromise (SOC 2 CC6.7).

Recommendations

Move to -all (hardfail) once your mail flow is confirmed — softfail gives no real protection

v=spf1 include:_spf.google.com include:amazonses.com include:sparkpostmail.com include:sendgrid.net ~all

v=spf1
include:_spf.google.com
include:amazonses.com
include:sparkpostmail.com
include:sendgrid.net
~all

fetched 2026-05-23T09:26:42.931Z

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

p=reject — strict policy

Why it matters: DMARC binds SPF and DKIM into an enforceable policy (quarantine or reject) and surfaces spoofing attempts via aggregate reports. `p=none` or absent means spoofing succeeds silently (SOC 2 CC6.7).

v=DMARC1; p=reject; rua=mailto:xvjc2sr9@ag.eu.dmarcian.com; ruf=mailto:xvjc2sr9@fr.eu.dmarcian.com; fo=1; adkim=s;

v=: DMARC1
p=: reject
rua=: mailto:xvjc2sr9@ag.eu.dmarcian.com
ruf=: mailto:xvjc2sr9@fr.eu.dmarcian.com
fo=: 1
adkim=: s

fetched 2026-05-23T09:26:42.929Z

dmarc

info

Open standalone →

resolving dmarc…

dkim

low

Open standalone →

1/6 DKIM selectors valid

Why it matters: DKIM signs outbound mail so receivers can detect tampering. Missing selectors or rotated-away keys break DMARC alignment and let receivers downgrade trust (ISO 27001 A.8.24).

Recommendations

Check the missing selectors in your DNS provider and re-add any removed records

default:: —
google:: v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCjezP5K4zRqHPCxwF7sK7MtR1t7Ar4YbQNdot6KEg/yhXu3u3JkVcv0HvX3lNvRyaVQTxXLgbqqlEXf7vLd7gJOUh0ywZiIkjsIDzKI2YYo2XPlfBCRxXodvgaB3hMoiLXMeRPmK2OlSaKJQVS9KhB5Xt32K/fiRVJUEthYuYjBwIDAQAB
k1:: —
selector1:: —
selector2:: —
mxvault:: —

fetched 2026-05-23T09:26:43.117Z

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

cert valid for 195 days

Why it matters: A valid current TLS certificate is the baseline for data in transit. Expiry, weak chain, or hostname mismatch break HTTPS and fail PCI 4.2.1 / SOC 2 CC6.1.

subject cn:: salon.com
issuer:: Amazon RSA 2048 M01 / Amazon
valid:: Nov 5 00:00:00 2025 GMT → Dec 4 23:59:59 2026 GMT
authorized:: yes
sha256:: 51:28:8B:A9:A6:4C:D2:96:AD:D4:EA:86:15:AE:12:57:C2:AA:DC:F3:4F:8E:02:0A:FE:EF:01:8D:EB:90:54:E5
sans: salon.com
*.git.salon.com
*.salon.com

fetched 2026-05-23T09:26:42.962Z

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

HTTPS served correctly

Why it matters: Bare HTTP requests must redirect to HTTPS without dropping the user mid-chain. Plain-text fallback or open redirects fail PCI 4.2.1 and feed phishing chains (SOC 2 CC6.6).

final status: 200 · 2 hops

[301] https://salon.com/
[200] https://www.salon.com/

fetched 2026-05-23T09:26:43.014Z

redirects

info

Open standalone →

tracing redirects…

headers

medium

Open standalone →

6 security header(s) missing

Why it matters: Security headers — HSTS, CSP, X-Frame-Options, Referrer-Policy — defend against XSS, clickjacking, and downgrade attacks. Absent headers map directly to OWASP ASVS V14 findings (ISO 27001 A.8.23).

Recommendations

Add response header — Strict-Transport-Security: max-age=15552000; includeSubDomains
Add response header — Content-Security-Policy: default-src 'self' (tune per app)
Add response header — X-Frame-Options: DENY (or SAMEORIGIN if framing is intended)
Add response header — X-Content-Type-Options: nosniff
Add response header — Referrer-Policy: strict-origin-when-cross-origin
Add permissions-policy response header

final url: https://www.salon.com/

security headers

strict-transport-security: —
content-security-policy: —
x-frame-options: —
x-content-type-options: —
referrer-policy: —
permissions-policy: —

other headers

age: 49553
cache-control: public, s-maxage=86400, max-age=0, stale-while-revalidate=600, stale-if-error=86400
connection: keep-alive
content-encoding: gzip
content-length: 22149
content-type: text/html; charset=UTF-8
date: Fri, 22 May 2026 19:40:50 GMT
link: <https://www.salon.com/wp-json/>; rel="https://api.w.org/"
server: Apache
set-cookie: AWSALBCORS=mQZ3HltAeTfc2CrM4YTF88uX0HQmbrE/AedQts+3JGXyrDxJ1cAvQ41z7xuLKExoSW+w4XHzaVYy57KioFoELWMO4kb88qOAPC0+wafCbmqzlCAlbIvUICWRdOsu; Expires=Fri, 29 May 2026 19:40:50 GMT; Path=/; SameSite=None; Secure
vary: Accept-Encoding
via: 1.1 abf0dd48fffc7f5cf9aab730f88497b2.cloudfront.net (CloudFront)
x-amz-cf-id: pJgB1mdk8fw1xF2bYvkZhTt4DF2AYp2kLRJeTx1AYF0I44eucGIhwg==
x-amz-cf-pop: IAD89-P3
x-cache: Hit from cloudfront

fetched 2026-05-23T09:26:43.015Z

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

no CORS headers — cross-origin requests blocked by default

Why it matters: Overly permissive CORS (wildcard with credentials, or reflected origin) lets any origin read authenticated responses from this domain. OWASP A05 misconfiguration territory (NIST AC-4).

origin: https://drwho.me
method: GET
preflight status: 301

access-control-* headers

access-control-allow-origin: —
access-control-allow-methods: —
access-control-allow-headers: —
access-control-allow-credentials: —
access-control-max-age: —
access-control-expose-headers: —

no access-control-* headers returned — site does not advertise CORS to this origin

fetched 2026-05-23T09:26:42.987Z

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

HTTPS surface reachable (robots ✓, sitemap ✓, title ✓)

Why it matters: Public files — robots.txt, sitemap.xml, head meta — are what attackers see first during reconnaissance. Misadvertised paths, stale sitemaps, and verbose generators leak more than intended (ISO 27001 A.8.9).

robots.txt

present

User-agent: *
Disallow: /search/

# Block known SEO crawlers and data co
User-agent: AhrefsBot
Disallow: /

User-agent: SemrushBot
Disallow: /

User-agent: MJ12bot
Disallow: /

User-agent: DotBot
Disallow: /

User-agent: Zoominfobot
Disallow: /

User-agent: BlexBot
Disallow: /

User-agent: Cliqzbot
Disallow: /

User-agent: DataForSeoBot
Disallow: /

User-agent: MauiBot
Disallow: /

User-agent: MegaIndex.ru
Disallow: /

# Image crawlers
User-agent: Pixray-Seeker
Disallow: /

User-agent: Copyleaks
Disallow: /

User-agent: Plaghunter
Disallow: /

User-agent: ImageMax
Disallow: /

User-agent: Tineye
Disallow: /

User-agent: Copytrack
Disallow: /

User-agent: CopytrackBot
Disallow: /

# Allow major search engines
User-agent: Googlebot
Disallow:

User-agent: Bingbot
Disallow:

User-agent: DuckDuckBot
Disallow:

User-agent: Baiduspider
Disallow:

User-agent: YandexBot
Disallow:

User-agent: Sogou
Disallow:

User-agent: PetalBot
Disallow:

User-agent: AspiegelBot
Disallow:

User-agent: SeznamBot
Disallow:

User-agent: Bytespider
Disallow:

User-agent: VoilaBot
Disallow:

# Allow social media platforms
User-agent: Twitterbot
Disallow:

User-agent: FacebookExternalHit
Disallow:

User-agent: LinkedInBot
Disallow:

User-agent: Pinterestbot
Disallow:

User-agent: TelegramBot
Disallow:

User-agent: Discordbot
Disallow:

User-agent: WhatsApp
Disallow:

User-agent: Slackbot
Disallow:

User-agent: Redditbot
Disallow:

# Explicitly allow the following crawlers
User-agent: Verity/1.1 (https://gumgum.com/verity; verity-support@gumgum.com)
Allow: /

User-agent: Scope3/2.0 (scope3.com)
Allow: /

User-agent: AdsBot-Google
Allow: /

User-agent: AdsBot-Google-Mobile
Allow: /

User-agent: Googlebot-Image
Allow: /

User-agent: Googlebot-Video
Allow: /

User-agent: Googlebot-News
Allow: /

User-agent: Googlebot-InspectionTool
Allow: /

User-agent: GPTBot
Allow: /

User-agent: ChatGPT-User
Allow: /

User-agent: ChatGPT-Operator
Allow: /

User-agent: OAI-SearchBot
Allow: /

User-agent: ClaudeBot
Allow: /

User-agent: Claude-User
Allow: /

User-agent: Claude-SearchBot
Allow: /

User-agent: Claude-Web
Allow: /

User-agent: anthropic-ai
Allow: /

User-agent: PerplexityBot
Allow: /

User-agent: Perplexity-User
Allow: /

User-agent: CCBot
Allow: /

User-agent: Google-Extended
Allow: /

User-agent: Applebot
Allow: /

User-agent: Applebot-Extended
Allow: /

User-agent: Amazonbot
Allow: /

User-agent: Meta-ExternalAgent
Allow: /

User-agent: Meta-ExternalFetcher
Allow: /

User-agent: Facebookbot
Allow: /

User-agent: AmazonAdBot
Allow: /

Sitemap: https://www.salon.com/sitemap_index.xml

sitemap.xml

present — 371 url(s)

head

title: Salon.com - News, Politics, Culture, Science & Food
description: —

social

og:locale: en_US
og:type: website
og:url: https://www.salon.com/?utm_source=website&utm_medium=social&utm_campaign=ogshare&utm_content=og
og:site_name: Salon.com
twitter:card: summary_large_image

fetched 2026-05-23T09:26:43.043Z

web-surface

info

Open standalone →

inspecting web surface…

dnssec

low

Open standalone →

DNSSEC not configured — no DS or DNSKEY records found

Why it matters: DNSSEC cryptographically signs DNS responses, blocking cache-poisoning attacks. US federal civilian agencies are required to enable it under OMB M-22-09 (NIST SC-20).

Recommendations

Enable DNSSEC in your DNS provider's control panel and add the resulting DS record at your registrar

enabled: no
DS records: —
DNSKEY records: —

fetched 2026-05-23T09:26:42.942Z

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

not applicable: no _mta-sts TXT record

Why it matters: MTA-STS forces inbound SMTP to use TLS and refuse downgraded connections. Without it, an in-path attacker can strip TLS and read mail in plaintext (SOC 2 CC6.7).

no _mta-sts TXT record

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

not applicable: no TLSRPT record

Why it matters: TLS-RPT publishes a reporting address for SMTP-TLS failures. Without it, downgrade attacks on inbound mail go unnoticed (SOC 2 CC7.2).

no TLSRPT record

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

domain registered until 2033-01-06

Why it matters: Registrar and expiry tell auditors the domain is owned, current, and not about to lapse. An expired or about-to-expire domain fails business-continuity evidence (SOC 2 A1.2).

registrar: GoDaddy.com, LLC
created: 1995-04-18T04:00:00Z
expires: 2033-01-06T16:15:01Z
statuses: clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited, clientRenewProhibited https://icann.org/epp#clientRenewProhibited, clientTransferProhibited https://icann.org/epp#clientTransferProhibited, clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited

fetched 2026-05-23T09:26:43.035Z

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

check failed: crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

Why it matters: Every certificate issued for this domain is published in Certificate Transparency logs — including subdomains you may have forgotten. Unknown subdomains in CT are pre-disclosed attack surface (ISO 27001 A.8.16).

crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.