smh.com.au

15-check dossier · scoreboard above, section details below

Get a pack →

Scanning…

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

resolving mx…

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

resolving dmarc…

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

tracing redirects…

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

inspecting web surface…

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.

smh.com.au

15-check dossier · scoreboard above, section details below

Get a pack →

Mostly compliant · 5 items need attention

Aggregate grade across 15 checks. Auditors typically flag any High-severity finding.

Pass: 10
Warn: 5
Fail: 0

What an auditor would flag first

medium
SPF
~all softfail — receivers may still accept
SOC 2 CC6.7ISO 27001 A.13.2.1
low
DKIM
1/6 DKIM selectors valid
SOC 2 CC6.7
low
TLS certificate
cert expires in 56 days
SOC 2 CC6.6ISO 27001 A.13.1.1

Need this as an artifact your auditor can verify?

Your smh.com.au scan flagged 1 medium and 4 low findings. A signed pack covers the apex plus up to 100 CT-discovered subdomains, Ed25519-signed and ISO-timestamped, delivered in 10–30 minutes.

Get a pack →See methodology See a sample$29

Scanning…

15-check summary

DNS recordsA/AAAA records present
MX5 MX record(s) present
SPF~all softfail — receivers may still accept
DMARCp=reject — strict policy
DKIM1/6 DKIM selectors valid
TLS certificatecert expires in 56 days
Redirect chainHTTPS served correctly
Security headersall security headers present
CORSno CORS headers — cross-origin requests blocked by default
Web surfaceHTTPS surface reachable (robots ✓, sitemap ✗, title ✓)
MTA-STSnot applicable: no _mta-sts TXT record
TLS-RPTnot applicable: no TLSRPT record
DNSSECDNSSEC not configured — no DS or DNSKEY records found
WHOISWHOIS expiry date unavailable — cannot assess renewal risk
Certificate Transparencycheck failed: crt.sh: AbortError: This operation was aborted; certspotter: Error: certspotter http 429

dns

info

Open standalone →

A/AAAA records present

Why it matters: Without authoritative A or AAAA records on the apex, the domain is unreachable. Missing baseline DNS shows up in vendor reviews as evidence of unmanaged infrastructure (SOC 2 CC6.6).

A: ttl=300 151.101.66.133
ttl=300 151.101.194.133
ttl=300 151.101.130.133
ttl=300 151.101.2.133
AAAA: —
NS: ttl=120 ns-1164.awsdns-17.org.
ttl=120 ns-2042.awsdns-63.co.uk.
ttl=120 ns-322.awsdns-40.com.
ttl=120 ns-609.awsdns-12.net.
SOA: ttl=120 ns-609.awsdns-12.net. hostmaster.f2.com.au. 2018040302 10800 3600 604800 1800
CAA: —
TXT: ttl=1800 "Validity-Domain-Verification=9d2h18sVUYaUN4ldkVFMw00gLtA="
ttl=1800 "_globalsign-domain-verification=7JmN6dazOT7LXjyHvi_YmaRlN4ZcwfGCyQ7CfElelu"
ttl=1800 "apple-domain-verification=3TaE5qM0WY8S6jLK"
ttl=1800 "google-site-verification=33cMHwJZBHNf460tqkdAlHCykad5J-4p4T5TTVc4Q-4"
ttl=1800 "google-site-verification=Ja8nMy3DNxiw2QVmthJHQJ7QS6nx3OGG1IgB9czo63I"
ttl=1800 "google-site-verification=Kfc3crwk0zhgHwzXCH1rip8-_mBPQIpCs9X9F7wZ3L8"
ttl=1800 "google-site-verification=Vm97OWVGuKdmknOh4TFbFDmfv-JLFQljOHArf0X9_qQ"
ttl=1800 "jypyx1tygs026p76fpblqbkdjtnjm2j2"
ttl=1800 "miro-verification=e2736fab20b8db58132d7cb294330e593e27d1b7"
ttl=1800 "smartsheet-site-validation=pfaBIpLJ6cFr7LbThH6gBnSI6FtCfmwF"
ttl=1800 "tollbit-domain-verification=0b0d77e5acbb89602bfc27b508a77f58a0d24329321dc9469cb3dcf5367143a7"
ttl=1800 "v=spf1 include:%{i}._ip.%{h}._ehlo.%{d}._spf.vali.email ~all"

fetched 2026-05-23T09:37:29.646Z

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

5 MX record(s) present

Why it matters: MX records direct inbound mail. Misconfiguration silently breaks email delivery and lets attackers stand up parallel MX hosts for spoofing campaigns (ISO 27001 A.8.21).

pri=1 aspmx.l.google.com.
pri=5 alt1.aspmx.l.google.com.
pri=5 alt2.aspmx.l.google.com.
pri=10 alt3.aspmx.l.google.com.
pri=10 alt4.aspmx.l.google.com.

fetched 2026-05-23T09:37:29.646Z

mx

info

Open standalone →

resolving mx…

spf

medium

Open standalone →

~all softfail — receivers may still accept

Why it matters: SPF tells receiving servers which hosts may send mail for the domain. Without it, any sender can forge the envelope-from — the primary mechanism behind business-email-compromise (SOC 2 CC6.7).

Recommendations

Move to -all (hardfail) once your mail flow is confirmed — softfail gives no real protection

v=spf1 include:%{i}._ip.%{h}._ehlo.%{d}._spf.vali.email ~all

v=spf1
include:%{i}._ip.%{h}._ehlo.%{d}._spf.vali.email
~all

fetched 2026-05-23T09:37:29.642Z

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

p=reject — strict policy

Why it matters: DMARC binds SPF and DKIM into an enforceable policy (quarantine or reject) and surfaces spoofing attempts via aggregate reports. `p=none` or absent means spoofing succeeds silently (SOC 2 CC6.7).

v=DMARC1; p=reject; rua=mailto:dmarc_agg@vali.email;

v=: DMARC1
p=: reject
rua=: mailto:dmarc_agg@vali.email

fetched 2026-05-23T09:37:29.651Z

dmarc

info

Open standalone →

resolving dmarc…

dkim

low

Open standalone →

1/6 DKIM selectors valid

Why it matters: DKIM signs outbound mail so receivers can detect tampering. Missing selectors or rotated-away keys break DMARC alignment and let receivers downgrade trust (ISO 27001 A.8.24).

Recommendations

Check the missing selectors in your DNS provider and re-add any removed records

default:: —
google:: v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCP0nXpleopqkvAGcH1CB5G98dJSI/JJUkTQCQFPmpBjNnfnwPceKYmzoOtK00Yr1vLxRaXHjbIK8TFZ71COtz5XRHP94BLRn51k8JrVlXDQqzFD0m/09S16sTLFcCx+HqdVV5Q6pS915IabUipgwkSbIow3D/a6/AFKGAKZI5IcQIDAQAB
k1:: —
selector1:: —
selector2:: —
mxvault:: —

fetched 2026-05-23T09:37:29.807Z

dkim

info

Open standalone →

probing dkim selectors…

tls

low

Open standalone →

cert expires in 56 days

Why it matters: A valid current TLS certificate is the baseline for data in transit. Expiry, weak chain, or hostname mismatch break HTTPS and fail PCI 4.2.1 / SOC 2 CC6.1.

Recommendations

Schedule certificate renewal — consider enabling auto-renewal

subject cn:: nine.com.au
issuer:: COMODO RSA Organization Validation Secure Server CA / COMODO CA Limited
valid:: Jul 18 00:00:00 2025 GMT → Jul 18 23:59:59 2026 GMT
authorized:: yes
sha256:: 79:8D:1B:45:BD:0D:94:68:FE:8F:A8:23:16:B6:15:FB:88:D6:0F:9E:A6:FE:B9:39:0A:84:7E:16:20:5E:53:FF
sans: nine.com.au
*.2ue.com.au
*.4bh.com.au
*.9pub.io
*.addelivery.com.au
*.adonline.com.au
*.advertisers.com.au
*.afr.com
*.brisbanetimes.com.au
*.cdn.ninetech.dev
*.comms-test.afr.com
*.comms-test.brisbanetimes.com.au
*.comms-test.smh.com.au
*.comms-test.theage.com.au
*.comms-test.watoday.com.au
*.comms.afr.com
*.comms.brisbanetimes.com.au
*.comms.smh.com.au
*.comms.theage.com.au
*.comms.watoday.com.au
*.dev.9pub.io
*.dev.nine.com.au
*.dev.platform.ink
*.f2.com.au
*.fairfax.com.au
*.fairfaxapi.com.au
*.fairfaxmedia.com.au
*.ffx.io
*.ffxblue.com.au
*.goodfood.com.au
*.goodfoodmonth.com
*.magic1278.com.au
*.myfairfax.com.au
*.nine.com.au
*.ninetech.dev
*.notifications.afr.com
*.platform.ink
*.smh.com.au
*.staging.9pub.io
*.staging.nine.com.au
*.staging.platform.ink
*.test.9pub.io
*.test.nine.com.au
*.test.platform.ink
*.theage.com.au
*.watoday.com.au
2ue.com.au
4bh.com.au
addelivery.com.au
adonline.com.au
afr.com
brisbanetimes.com.au
magic1278.com.au
smh.com.au
theage.com.au
watoday.com.au

fetched 2026-05-23T09:37:29.699Z

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

HTTPS served correctly

Why it matters: Bare HTTP requests must redirect to HTTPS without dropping the user mid-chain. Plain-text fallback or open redirects fail PCI 4.2.1 and feed phishing chains (SOC 2 CC6.6).

final status: 200 · 2 hops

[308] https://smh.com.au/
[200] https://www.smh.com.au/

fetched 2026-05-23T09:37:29.755Z

redirects

info

Open standalone →

tracing redirects…

headers

info

Open standalone →

all security headers present

Why it matters: Security headers — HSTS, CSP, X-Frame-Options, Referrer-Policy — defend against XSS, clickjacking, and downgrade attacks. Absent headers map directly to OWASP ASVS V14 findings (ISO 27001 A.8.23).

final url: https://www.smh.com.au/

security headers

strict-transport-security: max-age=31536000
content-security-policy: frame-ancestors 'self' *.ffxblue.com.au *.ffx.io *.smh.com.au *.theage.com.au *.brisbanetimes.com.au *.watoday.com.au *.cdn.ampproject.org *.platform.ink; upgrade-insecure-requests
x-frame-options: sameorigin
x-content-type-options: nosniff
referrer-policy: no-referrer-when-downgrade
permissions-policy: camera=(), geolocation=(), microphone=()

other headers

accept-ch: sec-ch-ua-model,sec-ch-ua-platform-version
accept-ranges: bytes
age: 3
cache-control: public, max-age=20, no-transform
connection: keep-alive
content-encoding: gzip
content-length: 176947
content-security-policy-report-only: child-src blob: data: https:; connect-src https: wss:; default-src blob: data: https: 'report-sample' 'unsafe-eval' 'unsafe-inline'; font-src data: https:; form-action https:; frame-src data: https:; img-src blob: data: https:; media-src blob: data: https:; object-src https:; script-src https: 'unsafe-eval' 'unsafe-inline'; style-src https: 'unsafe-inline'; report-uri https://csp.ffx.io/; report-to csp-endpoint
content-type: text/html; charset=utf-8
date: Sat, 23 May 2026 09:37:29 GMT
report-to: {"endpoints":[{"url":"https://csp.ffx.io/"}],"group":"csp-endpoint","include_subdomains":true,"max_age":7884000}
uber-trace-id: 76ab78cb1b6ef848:76ab78cb1b6ef848:0:0
vary: Accept-Encoding, app-vary, app-vary
via: 1.1 varnish, 1.1 varnish
x-brand-short-name: smh
x-cache: MISS, HIT, HIT
x-cache-hits: 0, 17, 1
x-render-name: rw
x-served-by: cache-syd10123-SYD, cache-syd10173-SYD, cache-iad-kcgs7200137-IAD
x-varnish-grace: normal(limited)
x-xss-protection: 0

fetched 2026-05-23T09:37:29.744Z

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

no CORS headers — cross-origin requests blocked by default

Why it matters: Overly permissive CORS (wildcard with credentials, or reflected origin) lets any origin read authenticated responses from this domain. OWASP A05 misconfiguration territory (NIST AC-4).

origin: https://drwho.me
method: GET
preflight status: 308

access-control-* headers

access-control-allow-origin: —
access-control-allow-methods: —
access-control-allow-headers: —
access-control-allow-credentials: —
access-control-max-age: —
access-control-expose-headers: —

no access-control-* headers returned — site does not advertise CORS to this origin

fetched 2026-05-23T09:37:29.714Z

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

HTTPS surface reachable (robots ✓, sitemap ✗, title ✓)

Why it matters: Public files — robots.txt, sitemap.xml, head meta — are what attackers see first during reconnaissance. Misadvertised paths, stale sitemaps, and verbose generators leak more than intended (ISO 27001 A.8.9).

robots.txt

present

# NINE ENTERTAINMENT CO. POLICY STATEMENT
# Nine Entertainment Co expressly prohibits the use of any Nine
# content or data, including associated metadata, for any machine
# learning and/or artificial intelligence including for the purposes
# of training or development of AI technology, tools and machine
# learning language models.
# View our terms of use - https://login.nine.com.au/terms?client_id=smh

# Sitemaps
Sitemap: https://www.smh.com.au/sitemaps/news/brands/smh
Sitemap: https://www.smh.com.au/sitemaps/smh-sitemaps-videos.xml
Sitemap: https://www.smh.com.au/sitemaps/smh-sitemaps-articles.xml
Sitemap: https://www.smh.com.au/rss/feed.xml

# -----------------------------------------------------------------
# 1. GENERAL CRAWLER RULES (Allowing standard search engines)
# -----------------------------------------------------------------

# All visitors
User-agent: *
Allow: /
Disallow: /search?text=*
Disallow: *?app=*
Disallow: *?do=*
Disallow: *?ocid=*
Disallow: *?ref=*

# -----------------------------------------------------------------
# 2. SPECIFIC BLOCKS FOR AI, LLM, AND DATA-SCRAPING AGENTS
# -----------------------------------------------------------------


##########
# Google AI Agents (Allows standard Googlebot to continue crawling)
User-agent: Google-CloudVertexBot
Disallow: /
User-agent: Google-Extended
Disallow: /

##########
# OpenAI
User-agent: ChatGPT-User
Disallow: /
User-agent: GPTBot
Disallow: /
User-agent: OAI-SearchBot
Disallow: /
User-agent: OAISearch
Disallow: /

##########
# Anthropic
User-agent: anthropic-ai
Disallow: /
User-agent: claude-web
Disallow: /
User-agent: claudebot
Disallow: /

##########
# Meta (Facebook/LLaMA)
User-agent: facebookbot
Disallow: /
User-agent: meta-externalagent
Disallow: /
User-agent: meta-externalfetcher
Disallow: /

##########
# Apple
User-agent: applebot-extended
Disallow: /

##########
# Perplexity AI
User-agent: perplexitybot
Disallow: /

##########
# Cohere
User-agent: cohere-ai
Disallow: /

##########
# You.com
User-agent: youbot
Disallow: /

##########
# Amazon
User-agent: amazonbot
Disallow: /

##########
# Alibaba Cloud
User-agent: aliyunsecbot
Disallow: /

##########
# Audigent
User-agent: audigentadbot
Disallow: /

##########
# Awario
User-agent: awariorssbot
Disallow: /
User-agent: awariosmartbot
Disallow: /

##########
# BLEX AI
User-agent: blexbot
Disallow: /

##########
# ByteDance
User-agent: bytespider
Disallow: /

##########
# Common Crawl
User-agent: ccbot
Disallow: /

##########
# DataForSEO
User-agent: dataforseobot
Disallow: /

##########
# Diffbot
User-agent: diffbot
Disallow: /

##########
# DuckDuckGo
User-agent: duckassistbot
Disallow: /

##########
# Echobox
User-agent: echoboxbot
Disallow: /

##########
# Friendly Technologies
User-agent: friendlycrawler
Disallow: /

##########
# Internet Archive / "Wayback Machine"
User-agent: ia_archiver
Disallow: /

##########
# ImageSift
User-agent: imagesiftbot
Disallow: /

##########
# MyCentralAI
User-agent: mycentralaiscraperbot
Disallow: /

##########
# NewsNow
User-agent: newsnow
Disallow: /

##########
# News-Please (Open-source)
User-agent: news-please
Disallow: /

##########
# Omgili
User-agent: omgili
Disallow: /
User-agent: omgilibot
Disallow: /
User-agent: webzio-extended
Disallow: /

##########
# Peer39
User-agent: peer39_crawler
Disallow: /
User-agent: peer39_crawler/1.0
Disallow: /

##########
# QuillBot
User-agent: quillbot.com
Disallow: /

##########
# Quora
User-agent: quora-bot
Disallow: /

##########
# Scrapy (Open-source)
User-agent: scrapy
Disallow: /

##########
# Seekr
User-agent: seekrbot
Disallow: /

##########
# Seznam.cz
User-agent: seznamhomepagecrawler
Disallow: /

##########
# TaraGroup
User-agent: taragroup intelligent bot
Disallow: /

##########
# Timpi
User-agent: timpibot
Disallow: /

##########
# Turnitin
User-agent: turnitinbot
Disallow: /

##########
# Others
User-agent: viennatinybot
Disallow: /
User-agent: jetslide
Disallow: /
User-agent: magpie-crawler
Disallow: /
User-agent: poseidon research crawler
Disallow: /

sitemap.xml

absent

head

title: Australian Breaking News Headlines & World News Online | SMH.com.au
description: —

social

no OpenGraph or Twitter meta tags found

fetched 2026-05-23T09:37:30.010Z

web-surface

info

Open standalone →

inspecting web surface…

dnssec

low

Open standalone →

DNSSEC not configured — no DS or DNSKEY records found

Why it matters: DNSSEC cryptographically signs DNS responses, blocking cache-poisoning attacks. US federal civilian agencies are required to enable it under OMB M-22-09 (NIST SC-20).

Recommendations

Enable DNSSEC in your DNS provider's control panel and add the resulting DS record at your registrar

enabled: no
DS records: —
DNSKEY records: —

fetched 2026-05-23T09:37:29.645Z

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

not applicable: no _mta-sts TXT record

Why it matters: MTA-STS forces inbound SMTP to use TLS and refuse downgraded connections. Without it, an in-path attacker can strip TLS and read mail in plaintext (SOC 2 CC6.7).

no _mta-sts TXT record

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

not applicable: no TLSRPT record

Why it matters: TLS-RPT publishes a reporting address for SMTP-TLS failures. Without it, downgrade attacks on inbound mail go unnoticed (SOC 2 CC7.2).

no TLSRPT record

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

low

Open standalone →

WHOIS expiry date unavailable — cannot assess renewal risk

Why it matters: Registrar and expiry tell auditors the domain is owned, current, and not about to lapse. An expired or about-to-expire domain fails business-continuity evidence (SOC 2 A1.2).

registrar: Corporation Service Company (Aust) Pty Ltd
created: —
expires: —
statuses: serverDeleteProhibited https://identitydigital.au/whois-status-codes#serverDeleteProhibited, serverRenewProhibited https://identitydigital.au/whois-status-codes#serverRenewProhibited, serverTransferProhibited https://identitydigital.au/whois-status-codes#serverTransferProhibited, serverUpdateProhibited https://identitydigital.au/whois-status-codes#serverUpdateProhibited

fetched 2026-05-23T09:37:30.084Z

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

check failed: crt.sh: AbortError: This operation was aborted; certspotter: Error: certspotter http 429

Why it matters: Every certificate issued for this domain is published in Certificate Transparency logs — including subdomains you may have forgotten. Unknown subdomains in CT are pre-disclosed attack surface (ISO 27001 A.8.16).

crt.sh: AbortError: This operation was aborted; certspotter: Error: certspotter http 429

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.