sec.gov

15-check dossier · scoreboard above, section details below

Get a pack →

Scanning…

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

resolving mx…

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

resolving dmarc…

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

tracing redirects…

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

inspecting web surface…

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.

sec.gov

15-check dossier · scoreboard above, section details below

Get a pack →

A-

Audit-ready · 3 minor advisories

Aggregate grade across 15 checks. Auditors typically flag any High-severity finding.

Pass: 12
Warn: 3
Fail: 0

What an auditor would flag first

low
DKIM
2/6 DKIM selectors valid
SOC 2 CC6.7
low
TLS certificate
cert expires in 63 days
SOC 2 CC6.6ISO 27001 A.13.1.1
low
WHOIS
domain expires in 82 days — renew soon
SOC 2 CC1.4

Need this as an artifact your auditor can verify?

Your sec.gov scan flagged 3 low findings. A signed pack covers the apex plus up to 100 CT-discovered subdomains, Ed25519-signed and ISO-timestamped, delivered in 10–30 minutes.

Get a pack →See methodology See a sample$29

Scanning…

15-check summary

DNS recordsA/AAAA records present
MX1 MX record(s) present
SPF-all hardfail — strict policy
DMARCp=reject — strict policy
DKIM2/6 DKIM selectors valid
TLS certificatecert expires in 63 days
Redirect chainHTTPS served correctly
Security headers1 security header(s) missing
CORSno CORS headers — cross-origin requests blocked by default
Web surfaceHTTPS surface reachable (robots ✓, sitemap ✗, title ✓)
MTA-STSnot applicable: no _mta-sts TXT record
TLS-RPTnot applicable: no TLSRPT record
DNSSECDNSSEC enabled — DS records present and chain validated (AD flag)
WHOISdomain expires in 82 days — renew soon
Certificate Transparencycheck failed: crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

dns

info

Open standalone →

A/AAAA records present

Why it matters: Without authoritative A or AAAA records on the apex, the domain is unreachable. Missing baseline DNS shows up in vendor reviews as evidence of unmanaged infrastructure (SOC 2 CC6.6).

A: ttl=13 104.68.246.135
AAAA: ttl=20 2600:1408:ec00:284::17b2
ttl=20 2600:1408:ec00:289::17b2
NS: ttl=600 a1-32.akam.net.
ttl=600 a3-67.akam.net.
ttl=600 a6-64.akam.net.
ttl=600 a7-65.akam.net.
ttl=600 a18-65.akam.net.
ttl=600 a20-66.akam.net.
SOA: ttl=600 d1-dns-f1.sec.gov. hostmaster.sec.gov. 2020112855 10800 3600 2419200 300
CAA: ttl=300 \# 30 00 05 69 6f 64 65 66 6d 61 69 6c 74 6f 3a 43 41 49 73 73 75 65 73 40 73 65 63 2e 67 6f 76
ttl=300 \# 19 00 05 69 73 73 75 65 64 69 67 69 63 65 72 74 2e 63 6f 6d
ttl=300 \# 18 00 05 69 73 73 75 65 65 6e 74 72 75 73 74 2e 6e 65 74
ttl=300 \# 22 00 05 69 73 73 75 65 6c 65 74 73 65 6e 63 72 79 70 74 2e 6f 72 67
ttl=300 \# 12 00 09 69 73 73 75 65 77 69 6c 64 3b
TXT: ttl=600 "spf2.0/pra"
ttl=600 "MS=ms60731568"
ttl=600 "00DSL0000021HKD=1TBSL000000020D"
ttl=600 "_2haihd08iwp4vmrvs9mrm1dsncy86py"
ttl=600 "_cz0i16g8zz5maeoxkaxts6mosrsg7n6"
ttl=600 "_ovutjguasir5ck46dhg5lqtjmccbl2d"
ttl=600 "y2tqkx3t30c3sr5smhvn1d0rvcy647qq"
ttl=600 "apple-domain-verification=S8k2enqunoaJUuJA"
ttl=600 "apple-domain-verification=jlno4yB7g7OgHZk5"
ttl=600 "ms-domain-verification=ba4248b5-acc8-41ea-8703-abebfda1a96a"
ttl=600 "adobe-idp-site-verification=97319342-419d-4786-87b7-130e1e301d13"
ttl=600 "webexdomainverification.7GA36=c6ae2a26-765a-4237-b87d-f6bddc7a9cd8"
ttl=600 "dtm-domain-verification=BcAH-g0ZVzOswh5LL4axbbHI3sWosnxP15V8LAgmmPw"
ttl=600 "google-site-verification=9GMDw2_WQPOazSHPiWGVPuC5PKpwfADDisMN7sEhMM0"
ttl=600 "X4U/iY9l80yKA4myted6fgTySSIGMnzLSdq/xloixnLrcdKk/Vv/iv0ilF4VuFx0pmVEMwe5HvDilwYRg72RGA=="
ttl=600 "cisco-ci-domain-verification=6916e9cd0609e361edcbea866535f0538c7de04c019c5d4669caf5eeefd6ca58"
ttl=600 "atlassian-domain-verification=awDgAKnU26QrwpZblzNS4OGF8kEEJPtUij0S0WKf13T9qRfcH0wHAGU9DK/Mbwoy"

fetched 2026-05-23T09:26:11.514Z

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

1 MX record(s) present

Why it matters: MX records direct inbound mail. Misconfiguration silently breaks email delivery and lets attackers stand up parallel MX hosts for spoofing campaigns (ISO 27001 A.8.21).

pri=10 sec-gov.mail.protection.outlook.com.

fetched 2026-05-23T09:26:11.508Z

mx

info

Open standalone →

resolving mx…

spf

info

Open standalone →

-all hardfail — strict policy

Why it matters: SPF tells receiving servers which hosts may send mail for the domain. Without it, any sender can forge the envelope-from — the primary mechanism behind business-email-compromise (SOC 2 CC6.7).

v=spf1 include:_mail.sec.gov include:_sas.sec.gov include:_sas1.sec.gov include:_sas2.sec.gov ip4:162.138.52.160 ip4:162.138.52.161 ip4:162.138.53.160 ip4:162.138.53.161 include:spf.protection.outlook.com -all

v=spf1
include:_mail.sec.gov
include:_sas.sec.gov
include:_sas1.sec.gov
include:_sas2.sec.gov
ip4:162.138.52.160
ip4:162.138.52.161
ip4:162.138.53.160
ip4:162.138.53.161
include:spf.protection.outlook.com
-all

fetched 2026-05-23T09:26:11.512Z

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

p=reject — strict policy

Why it matters: DMARC binds SPF and DKIM into an enforceable policy (quarantine or reject) and surfaces spoofing attempts via aggregate reports. `p=none` or absent means spoofing succeeds silently (SOC 2 CC6.7).

v=DMARC1; p=reject; pct=100; rua=mailto:DMARC@sec.gov!10m,mailto:SOCReporting@sec.gov!10m,mailto:reports@dmarc.cyber.dhs.gov

v=: DMARC1
p=: reject
pct=: 100
rua=: mailto:DMARC@sec.gov!10m,mailto:SOCReporting@sec.gov!10m,mailto:reports@dmarc.cyber.dhs.gov

fetched 2026-05-23T09:26:11.510Z

dmarc

info

Open standalone →

resolving dmarc…

dkim

low

Open standalone →

2/6 DKIM selectors valid

Why it matters: DKIM signs outbound mail so receivers can detect tampering. Missing selectors or rotated-away keys break DMARC alignment and let receivers downgrade trust (ISO 27001 A.8.24).

Recommendations

Check the missing selectors in your DNS provider and re-add any removed records

default:: —
google:: —
k1:: —
selector1:: v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCkkUIWS8g9xda6nZ7G3U0yU2UR42EsO9iAO6EA/Yl6USE94E2xu+6XD3teJTAweZ6EAQlwSX7QvpCMnTLFwV0qpMH8pfb5OBpcK6owJUpYT8mzXdlb8wO2hGJHd38gNgfMUX61k7jDoJgawPW/W1Ewty2T4fi+0fMw57u8OfXpcwIDAQAB; n=1024,1456443699,1472168499
selector2:: v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCNChsxBXm7VUKwFy9ajKZc3ch+PkiDCeSEA48LXi7y1iXLx6q2n1pQ0Vr5sj+/0YGLrktbQbmHZbh8WHBkYuIvYKgzgVtzm1bLfY+3x5kRFw+UoUvDuoCJ8RmUOkwXYEgqtbmWnkA+kUL10lNiNMps3pFBNywHf3CtBHiF4EzbvQIDAQAB; n=1024,1456443699,1
mxvault:: —

fetched 2026-05-23T09:26:11.516Z

dkim

info

Open standalone →

probing dkim selectors…

tls

low

Open standalone →

cert expires in 63 days

Why it matters: A valid current TLS certificate is the baseline for data in transit. Expiry, weak chain, or hostname mismatch break HTTPS and fail PCI 4.2.1 / SOC 2 CC6.1.

Recommendations

Schedule certificate renewal — consider enabling auto-renewal

subject cn:: www.sec.gov
issuer:: DigiCert Global G3 TLS ECC SHA384 2020 CA1 / DigiCert Inc
valid:: Jul 25 00:00:00 2025 GMT → Jul 25 23:59:59 2026 GMT
authorized:: yes
sha256:: 9D:24:F5:A0:25:06:7D:3B:8B:0A:78:6E:61:EF:76:C0:FD:C6:1E:37:6F:33:95:F2:AA:DF:5A:5B:2A:51:C4:D7
sans: www.sec.gov
acadia.sec.gov
acadiastg.sec.gov
adfs.sec.gov
akamai-ds.sec.gov
api-bravo.edgarfiling.sec.gov
api.edgarfiling.sec.gov
auth-bravo.edgarfiling.sec.gov
auth.edgarfiling.sec.gov
catalog.sec.gov
data-test.sec.gov
data.sec.gov
edgarfiling-alpha.edgarfiling.sec.gov
edgarfiling-beta.edgarfiling.sec.gov
edgarfiling-bravo.edgarfiling.sec.gov
edgarfiling-enterprise.apps.edgar.sec.gov
edgarfiling-enterprise.appsdmz.edgar.sec.gov
efap.sec.gov
efapstg.sec.gov
effssrtsweb-stage.dynamic.sec.gov
effssrtsweb-stage.sec.gov
effssrtsweb-stage.static.sec.gov
effssrtsweb.dynamic.sec.gov
effssrtsweb.sec.gov
effssrtsweb.static.sec.gov
efoia-pal.sec.gov
efts-stage.sec.gov
efts.sec.gov
enfdev.sec.gov
enfprod.sec.gov
enfstage.sec.gov
enftest.sec.gov
eslogin.sec.gov
esloginstg.sec.gov
fedwire.edgarfiling.sec.gov
feedback-alpha.edgarfiling.sec.gov
feedback-bravo.edgarfiling.sec.gov
fept-alpha.edgarfiling.sec.gov
fept.edgarfiling.sec.gov
filermanagement-beta.edgarfiling.sec.gov
filermanagement-bravo.edgarfiling.sec.gov
hr4me.sec.gov
login.sec.gov
loginstg.sec.gov
omms.sec.gov
onlineforms-alpha.edgarfiling.sec.gov
onlineforms-beta.edgarfiling.sec.gov
onlineforms-bravo.edgarfiling.sec.gov
pavmwebtest.sec.gov
paygov.edgarfiling.sec.gov
penny.edgarcompany.sec.gov
portal-beta.edgarfiling.sec.gov
regandsurvey.sec.gov
sec.gov
stage-api-bravo.edgarfiling.sec.gov
stage-auth-alpha.edgarfiling.sec.gov
stage-auth-bravo.edgarfiling.sec.gov
stage-auth.edgarfiling.sec.gov
stage-edgarfiling-alpha.edgarfiling.sec.gov
stage-edgarfiling-bravo.edgarfiling.sec.gov
stage-fedwire-alpha.edgarfiling.sec.gov
stage-fedwire.edgarfiling.sec.gov
stage-feedback-alpha.edgarfiling.sec.gov
stage-feedback-bravo.edgarfiling.sec.gov
stage-fept-alpha.edgarfiling.sec.gov
stage-fept.edgarfiling.sec.gov
stage-filermanagement-alpha.edgarfiling.sec.gov
stage-filermanagement-bravo.edgarfiling.sec.gov
stage-onlineforms-alpha.edgarfiling.sec.gov
stage-onlineforms-bravo.edgarfiling.sec.gov
stage-portal-alpha.edgarfiling.sec.gov
stage.api-alpha.edgarfiling.sec.gov
stage.api.edgarfiling.sec.gov
stage.edgarfiling.sec.gov
stage.filermanagement.edgarfiling.sec.gov
stage.onlineforms.edgarfiling.sec.gov
stage.paygov-alpha.edgarfiling.sec.gov
stage.paygov.edgarfiling.sec.gov
stage.portal.edgarfiling.sec.gov
tcr.sec.gov
tcrstg.sec.gov
tts.sec.gov
tts2.sec.gov
wts.sec.gov
wtsstg.sec.gov
www-test.sec.gov
www.edgarcompany.sec.gov
www.edgarfiling.sec.gov
www.filermanagement.edgarfiling.sec.gov
www.onlineforms.edgarfiling.sec.gov
www.portal.edgarfiling.sec.gov
xbrl.sec.gov

fetched 2026-05-23T09:26:11.551Z

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

HTTPS served correctly

Why it matters: Bare HTTP requests must redirect to HTTPS without dropping the user mid-chain. Plain-text fallback or open redirects fail PCI 4.2.1 and feed phishing chains (SOC 2 CC6.6).

final status: 200 · 2 hops

[301] https://sec.gov/
[200] https://www.sec.gov/

fetched 2026-05-23T09:26:11.634Z

redirects

info

Open standalone →

tracing redirects…

headers

info

Open standalone →

1 security header(s) missing

Why it matters: Security headers — HSTS, CSP, X-Frame-Options, Referrer-Policy — defend against XSS, clickjacking, and downgrade attacks. Absent headers map directly to OWASP ASVS V14 findings (ISO 27001 A.8.23).

Recommendations

Add permissions-policy response header

final url: https://www.sec.gov/

security headers

strict-transport-security: max-age=31536000 ; includeSubDomains ; preload
content-security-policy: frame-ancestors 'self' *.sec.gov
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
permissions-policy: —

other headers

accept-ranges: bytes
cache-control: public, max-age=49
connection: keep-alive
content-encoding: gzip
content-language: en
content-length: 74857
content-type: text/html; charset=UTF-8
date: Sat, 23 May 2026 09:26:11 GMT
etag: "1779489311"
expires: Sat, 23 May 2026 09:27:00 GMT
last-modified: Fri, 22 May 2026 22:35:11 GMT
server: nginx
vary: Accept-Encoding
x-age: 0
x-ah-environment: prod
x-drupal-cache: HIT
x-drupal-dynamic-cache: MISS
x-request-id: v-9cac5a30-562e-11f1-8847-9fb58cdabcc6
x-xss-protection: 1; mode=block

fetched 2026-05-23T09:26:11.635Z

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

no CORS headers — cross-origin requests blocked by default

Why it matters: Overly permissive CORS (wildcard with credentials, or reflected origin) lets any origin read authenticated responses from this domain. OWASP A05 misconfiguration territory (NIST AC-4).

origin: https://drwho.me
method: GET
preflight status: 301

access-control-* headers

access-control-allow-origin: —
access-control-allow-methods: —
access-control-allow-headers: —
access-control-allow-credentials: —
access-control-max-age: —
access-control-expose-headers: —

no access-control-* headers returned — site does not advertise CORS to this origin

fetched 2026-05-23T09:26:11.588Z

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

HTTPS surface reachable (robots ✓, sitemap ✗, title ✓)

Why it matters: Public files — robots.txt, sitemap.xml, head meta — are what attackers see first during reconnaissance. Misadvertised paths, stale sitemaps, and verbose generators leak more than intended (ISO 27001 A.8.9).

robots.txt

present

#
# robots.txt
#
# This file is to prevent the crawling and indexing of certain parts
# of your site by web crawlers and spiders run by sites like Yahoo!
# and Google. By telling these "robots" where not to go on your site,
# you save bandwidth and server resources.
#
# This file will be ignored unless it is at the root of your host:
# Used:    http://example.com/robots.txt
# Ignored: http://example.com/site/robots.txt
#
# For more information about the robots.txt standard, see:
# http://www.robotstxt.org/robotstxt.html

User-agent: *
# CSS, JS, Images
Allow: /core/*.css$
Allow: /core/*.css?
Allow: /core/*.js$
Allow: /core/*.js?
Allow: /core/*.gif
Allow: /core/*.jpg
Allow: /core/*.jpeg
Allow: /core/*.png
Allow: /core/*.svg
Allow: /profiles/*.css$
Allow: /profiles/*.css?
Allow: /profiles/*.js$
Allow: /profiles/*.js?
Allow: /profiles/*.gif
Allow: /profiles/*.jpg
Allow: /profiles/*.jpeg
Allow: /profiles/*.png
Allow: /profiles/*.svg
# Directories
Disallow: /core/
Disallow: /profiles/
# Files
Disallow: /README.md
Disallow: /composer/Metapackage/README.txt
Disallow: /composer/Plugin/ProjectMessage/README.md
Disallow: /composer/Plugin/Scaffold/README.md
Disallow: /composer/Plugin/VendorHardening/README.txt
Disallow: /composer/Template/README.txt
Disallow: /modules/README.txt
Disallow: /sites/README.txt
Disallow: /themes/README.txt
Disallow: /web.config
# Paths (clean URLs)
Disallow: /admin/
Disallow: /comment/reply/
Disallow: /filter/tips
Disallow: /node/add/
Disallow: /search/
Disallow: /user/register
Disallow: /user/password
Disallow: /user/login
Disallow: /user/logout
Disallow: /media/oembed
Disallow: /*/media/oembed
# Paths (no clean URLs)
Disallow: /index.php/admin/
Disallow: /index.php/comment/reply/
Disallow: /index.php/filter/tips
Disallow: /index.php/node/add/
Disallow: /index.php/search/
Disallow: /index.php/user/password
Disallow: /index.php/user/register
Disallow: /index.php/user/login
Disallow: /index.php/user/logout
Disallow: /index.php/media/oembed
Disallow: /index.php/*/media/oembed

#SEC
Allow: /Archives/edgar/data
Disallow: /Archives/bin
Disallow: /Archives/etc
Disallow: /Archives/usr
Disallow: /cgi-bin
Disallow: /bin
Disallow: /Archives/edgar/vprr/XXXX
Disallow: /Archives/edgar/vprr/vprr_removal
Disallow: /Archives/edgar/vprr/bin
Disallow: /nb
Disallow: /video/live
Disallow: /Archives/edgar/data/1473971/000109181814000042/ex101002.gif
Disallow: /node
Disallow: /spotlight/equity-market-structure-advisory-committee.shtml

Sitemap: https://www.sec.gov/sec-sitemap.xml
Sitemap: https://www.sec.gov/sitemap/sitemap-index.xml
Sitemap: https://www.investor.gov/sitemap.xml

sitemap.xml

absent

head

title: SEC.gov | Home
description: —

social

no OpenGraph or Twitter meta tags found

fetched 2026-05-23T09:26:11.905Z

web-surface

info

Open standalone →

inspecting web surface…

dnssec

info

Open standalone →

DNSSEC enabled — DS records present and chain validated (AD flag)

Why it matters: DNSSEC cryptographically signs DNS responses, blocking cache-poisoning attacks. US federal civilian agencies are required to enable it under OMB M-22-09 (NIST SC-20).

enabled: yes
DS records: 39498 RSASHA1-NSEC3-SHA1 2 95ee2fa7a79ee383d798c03f55e687d82f6da7058a2902973bcda1536f0f7142, DS ECDSAP256SHA256 2 3600 1779618371 1779438371 35496 gov. QeJN8O50ps9M8aZ/0yTcBG8rXvIRk56eg9EfQ/uuSuqm29Kdk3ajLF6b+G9d2DcAJyPIqX73TJj4CzBpxoCUwg==
DNSKEY records: 6 key(s)

fetched 2026-05-23T09:26:11.521Z

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

not applicable: no _mta-sts TXT record

Why it matters: MTA-STS forces inbound SMTP to use TLS and refuse downgraded connections. Without it, an in-path attacker can strip TLS and read mail in plaintext (SOC 2 CC6.7).

no _mta-sts TXT record

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

not applicable: no TLSRPT record

Why it matters: TLS-RPT publishes a reporting address for SMTP-TLS failures. Without it, downgrade attacks on inbound mail go unnoticed (SOC 2 CC7.2).

no TLSRPT record

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

low

Open standalone →

domain expires in 82 days — renew soon

Why it matters: Registrar and expiry tell auditors the domain is owned, current, and not about to lapse. An expired or about-to-expire domain fails business-continuity evidence (SOC 2 A1.2).

Recommendations

Enable auto-renewal at your registrar to avoid accidental expiry

registrar: get.gov
created: 1997-10-02T01:29:29Z
expires: 2026-08-13T15:44:38Z
statuses: serverTransferProhibited https://icann.org/epp#serverTransferProhibited

fetched 2026-05-23T09:26:11.678Z

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

check failed: crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

Why it matters: Every certificate issued for this domain is published in Certificate Transparency logs — including subdomains you may have forgotten. Unknown subdomains in CT are pre-disclosed attack surface (ISO 27001 A.8.16).

crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.