telegraph.co.uk

15-check dossier · scoreboard above, section details below

Get a pack →

Scanning…

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

resolving mx…

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

resolving dmarc…

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

tracing redirects…

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

inspecting web surface…

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.

telegraph.co.uk

15-check dossier · scoreboard above, section details below

Get a pack →

Mostly compliant · 5 items need attention

Aggregate grade across 15 checks. Auditors typically flag any High-severity finding.

Pass: 10
Warn: 5
Fail: 0

What an auditor would flag first

medium
SPF
~all softfail — receivers may still accept
SOC 2 CC6.7ISO 27001 A.13.2.1
medium
Security headers
6 security header(s) missing
SOC 2 CC6.6ISO 27001 A.14.1.2
low
DKIM
1/6 DKIM selectors valid
SOC 2 CC6.7

Need this as an artifact your auditor can verify?

Your telegraph.co.uk scan flagged 2 medium and 3 low findings. A signed pack covers the apex plus up to 100 CT-discovered subdomains, Ed25519-signed and ISO-timestamped, delivered in 10–30 minutes.

Get a pack →See methodology See a sample$29

Scanning…

15-check summary

DNS recordsA/AAAA records present
MX5 MX record(s) present
SPF~all softfail — receivers may still accept
DMARCp=reject — strict policy
DKIM1/6 DKIM selectors valid
TLS certificatecert valid for 178 days
Redirect chainHTTPS served correctly
Security headers6 security header(s) missing
CORSno CORS headers — cross-origin requests blocked by default
Web surfaceHTTPS surface reachable (robots ✓, sitemap ✓, title ✗)
MTA-STSMTA-STS enforce mode — inbound TLS required
TLS-RPTTLSRPT configured with reporting URI (rua=)
DNSSECDNSSEC not configured — no DS or DNSKEY records found
WHOISdomain expires in 66 days — renew soon
Certificate Transparencycheck failed: crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

dns

info

Open standalone →

A/AAAA records present

Why it matters: Without authoritative A or AAAA records on the apex, the domain is unreachable. Missing baseline DNS shows up in vendor reviews as evidence of unmanaged infrastructure (SOC 2 CC6.6).

A: ttl=60 3.167.37.75
ttl=60 3.167.37.21
ttl=60 3.167.37.78
ttl=60 3.167.37.54
AAAA: —
NS: ttl=172791 ns-1323.awsdns-37.org.
ttl=172791 ns-17.awsdns-02.com.
ttl=172791 ns-1917.awsdns-47.co.uk.
ttl=172791 ns-654.awsdns-17.net.
SOA: ttl=900 ns-654.awsdns-17.net. awsdns-hostmaster.amazon.com. 1 7200 900 1209600 86400
CAA: —
TXT: ttl=600 "9A5E-5479-92CD-BDB9-363F-DBC3-B73E-FAD5"
ttl=600 "CKO=cli_ngzgfza5x3vexih67qoz3xezpa"
ttl=600 "CKO=cli_uugfgisni7leroxsr3oxeqk6g4"
ttl=600 "MS=ms27293801"
ttl=600 "MS=ms90821322"
ttl=600 "_globalsign-domain-verification=LbLpzJYGfeJslD6Gx67hlqv7w0WBkyhOG1H-vpQ_6m"
ttl=600 "_rimffo8umxnji9opm79mhss0zgux7qt"
ttl=600 "adobe-idp-site-verification=bcbd2ffcc31fe8466714532be859d0aa45942b9c11f3ee0c250a4785b03393bb"
ttl=600 "ahrefs-site-verification_48766bf29e3b4f7e35c7056ac32490aa6dbda277328eff2ac165829719580166"
ttl=600 "apple-domain-verification=e9WiroqCcOpsd3Gi"
ttl=600 "atlassian-domain-verification=r3ZfWHRyy5QaC8kltkIWjwkzx8BUcxNgpipJKO/PVDmY/G7ctUkDd70nE3fZzzm2"
ttl=600 "docker-verification=ea0466af-4045-428b-9632-5000d8e28265"
ttl=600 "e2ma-verification=rmc3"
ttl=600 "globalsign-domain-verification=04e2636792bbdb054e366f54200dae45"
ttl=600 "globalsign-domain-verification=4912c6f6617f49fd849ee96d55373abc"
ttl=600 "globalsign-domain-verification=4B45EB3587B84070B433AEA2FB8436F9"
ttl=600 "google-site-verification=3mCuyDRVD6118MldJ68t9jfagaTFTarbsDhFEaZmQkk"
ttl=600 "google-site-verification=DEWbT7aHyM4Qmah-xGBcZsFYfMnUsTAMVxJavkahxnM"
ttl=600 "google-site-verification=HutNNVGQFKdgIuOS7R2F9zqxmrWxxfmdBennQkPF6hA"
ttl=600 "google-site-verification=V-xjA5Bvf-N5GxtgQioEqlHjAhLienBh-15Ijx9wyVc"
ttl=600 "google-site-verification=VJ4FpapbPtJUxGUoVbu_Al1x6b3D7JwDajV7RpRz0iY"
ttl=600 "google-site-verification=jU9uOgvVJfrW_FNJw96XBHGFRnQAEem67Z-7oITYs60"
ttl=600 "google-site-verification=seEXglnGTvHqVcJ0lNMUHHRSVLxQFdQ5fbCBH42tdcg"
ttl=600 "google-site-verification=zHBE_An0f_qfkknSrhMHaYSlovt1HzeEsUEIhRD_Fxg"
ttl=600 "mongodb-site-verification=yXefl5Vn2tkOZ2EBOPjKVBkIPQnZmXus"
ttl=600 "onetrust-domain-verification=644f8eaea5474790be8e807bc3cbde93"
ttl=600 "tollbit-domain-verification=6563e9ce7006eb396bfba0acc55d5cdc32263bf39a869c73bbeb7e6d3f528770"
ttl=600 "v=spf1 include:_u.telegraph.co.uk._spf.smart.ondmarc.com ~all"
ttl=600 "yw2vqjz30d2614b3dkn0jfsyfdnccmhq"

fetched 2026-05-23T09:36:57.676Z

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

5 MX record(s) present

Why it matters: MX records direct inbound mail. Misconfiguration silently breaks email delivery and lets attackers stand up parallel MX hosts for spoofing campaigns (ISO 27001 A.8.21).

pri=1 aspmx.l.google.com.
pri=5 alt1.aspmx.l.google.com.
pri=5 alt2.aspmx.l.google.com.
pri=10 alt3.aspmx.l.google.com.
pri=10 alt4.aspmx.l.google.com.

fetched 2026-05-23T09:36:57.671Z

mx

info

Open standalone →

resolving mx…

spf

medium

Open standalone →

~all softfail — receivers may still accept

Why it matters: SPF tells receiving servers which hosts may send mail for the domain. Without it, any sender can forge the envelope-from — the primary mechanism behind business-email-compromise (SOC 2 CC6.7).

Recommendations

Move to -all (hardfail) once your mail flow is confirmed — softfail gives no real protection

v=spf1 include:_u.telegraph.co.uk._spf.smart.ondmarc.com ~all

v=spf1
include:_u.telegraph.co.uk._spf.smart.ondmarc.com
~all

fetched 2026-05-23T09:36:57.674Z

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

p=reject — strict policy

Why it matters: DMARC binds SPF and DKIM into an enforceable policy (quarantine or reject) and surfaces spoofing attempts via aggregate reports. `p=none` or absent means spoofing succeeds silently (SOC 2 CC6.7).

v=DMARC1; p=reject; pct=100; sp=reject; rua=mailto:19fcb3ab@inbox.ondmarc.com,mailto:dmarc-dns@telegraph.co.uk; ruf=mailto:19fcb3ab@inbox.ondmarc.com; adkim=r; aspf=r; fo=0; rf=afrf; ri=3600

v=: DMARC1
p=: reject
pct=: 100
sp=: reject
rua=: mailto:19fcb3ab@inbox.ondmarc.com,mailto:dmarc-dns@telegraph.co.uk
ruf=: mailto:19fcb3ab@inbox.ondmarc.com
adkim=: r
aspf=: r
fo=: 0
rf=: afrf
ri=: 3600

fetched 2026-05-23T09:36:57.733Z

dmarc

info

Open standalone →

resolving dmarc…

dkim

low

Open standalone →

1/6 DKIM selectors valid

Why it matters: DKIM signs outbound mail so receivers can detect tampering. Missing selectors or rotated-away keys break DMARC alignment and let receivers downgrade trust (ISO 27001 A.8.24).

Recommendations

Check the missing selectors in your DNS provider and re-add any removed records

default:: —
google:: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAmivQBPVOS3yOIGtMY+CvxlN6Q/gK5tpmUrhzvfwgcecA4B8ydB+uctjbArvLPPpHVMAOyUzsumPCoybq3oX3XwFwpjZ96yax1NnjsCpfO93WQnjpWoInznF32bfS242+F8Efgx4VAQ16yF7cwMlhMkHnZzOOak/Hp8NCLoz0Ct5cZrFsIWXkkyVYh3rEpcLkpZ2TTi1jLuVy1wnBzmvVXrMh0NtTl63u216vjWWvWYieSez2ZyL6Ph0QelywHsQ8CwscLpLINKEHcT4KzmODG1Ul3AsrjjEq9lczlVkEGyt2UvW14K5QI3jl9s7gJEZAjhbqN/qInF60KqlcQojJ4QIDAQAB
k1:: —
selector1:: —
selector2:: —
mxvault:: —

fetched 2026-05-23T09:36:57.786Z

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

cert valid for 178 days

Why it matters: A valid current TLS certificate is the baseline for data in transit. Expiry, weak chain, or hostname mismatch break HTTPS and fail PCI 4.2.1 / SOC 2 CC6.1.

subject cn:: telegraph.co.uk
issuer:: Amazon RSA 2048 M01 / Amazon
valid:: Oct 20 00:00:00 2025 GMT → Nov 17 23:59:59 2026 GMT
authorized:: yes
sha256:: E4:82:D7:06:81:3F:96:11:6A:D2:64:60:28:DC:C7:78:2A:96:64:C0:9A:13:C2:5A:6E:B8:99:F0:03:89:A4:A6
sans: telegraph.co.uk

fetched 2026-05-23T09:36:57.698Z

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

HTTPS served correctly

Why it matters: Bare HTTP requests must redirect to HTTPS without dropping the user mid-chain. Plain-text fallback or open redirects fail PCI 4.2.1 and feed phishing chains (SOC 2 CC6.6).

final status: 200 · 2 hops

[301] https://telegraph.co.uk/
[200] https://www.telegraph.co.uk/

fetched 2026-05-23T09:36:57.874Z

redirects

info

Open standalone →

tracing redirects…

headers

medium

Open standalone →

6 security header(s) missing

Why it matters: Security headers — HSTS, CSP, X-Frame-Options, Referrer-Policy — defend against XSS, clickjacking, and downgrade attacks. Absent headers map directly to OWASP ASVS V14 findings (ISO 27001 A.8.23).

Recommendations

Add response header — Strict-Transport-Security: max-age=15552000; includeSubDomains
Add response header — Content-Security-Policy: default-src 'self' (tune per app)
Add response header — X-Frame-Options: DENY (or SAMEORIGIN if framing is intended)
Add response header — X-Content-Type-Options: nosniff
Add response header — Referrer-Policy: strict-origin-when-cross-origin
Add permissions-policy response header

final url: https://www.telegraph.co.uk/

security headers

strict-transport-security: —
content-security-policy: —
x-frame-options: —
x-content-type-options: —
referrer-policy: —
permissions-policy: —

other headers

akamai-x-true-cache-ttl: -1
connection: keep-alive
content-length: 1029
content-type: text/html; charset=utf-8
date: Sat, 23 May 2026 09:36:57 GMT
x-app-overriden-by-path-including-homepage: true
x-esi-exe: true

fetched 2026-05-23T09:36:57.875Z

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

no CORS headers — cross-origin requests blocked by default

Why it matters: Overly permissive CORS (wildcard with credentials, or reflected origin) lets any origin read authenticated responses from this domain. OWASP A05 misconfiguration territory (NIST AC-4).

origin: https://drwho.me
method: GET
preflight status: 403

access-control-* headers

access-control-allow-origin: —
access-control-allow-methods: —
access-control-allow-headers: —
access-control-allow-credentials: —
access-control-max-age: —
access-control-expose-headers: —

no access-control-* headers returned — site does not advertise CORS to this origin

fetched 2026-05-23T09:36:57.720Z

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

HTTPS surface reachable (robots ✓, sitemap ✓, title ✗)

Why it matters: Public files — robots.txt, sitemap.xml, head meta — are what attackers see first during reconnaissance. Misadvertised paths, stale sitemaps, and verbose generators leak more than intended (ISO 27001 A.8.9).

robots.txt

present

# Production Robots.txt file

User-agent: *
#Special parameters
Disallow: /etc.clientlibs/settings/wcm/designs/telegraph/core/clientlibs/save-article.
Disallow: /etc.clientlibs/settings/wcm/designs/telegraph/core/clientlibs/page-refresh.
Disallow: /*?mobile=true
Disallow: /*?mobile=basic
Disallow: /*?ModPagespeed=noscript
Disallow: /*_jcr_content*
Disallow: /*?source=rss
Disallow: /puzzles/puzzle/*?source=

# Internal Search
Disallow: /search/
Allow: /search/$

# Special areas
Disallow: /news/main.jhtml
Disallow: /p/*/embed/
Disallow: /secure/login/*
Disallow: /content/telegraph/
Disallow: /customer/secure/checkout/tesco/
Disallow: /customer/secure/reset-password/
Disallow: /telegraph/*
Disallow: /news-app/*
Disallow: /amp$
Disallow: */application/*
Disallow: */ixale/
Disallow: /core/Content/
Disallow: /promotions/emails/
Disallow: /r/
Disallow: /sponsored/travel/msc-cruises/
Disallow: /travel/8711559/The-Telegraph-Travel-Awards-2011.html
Disallow: /travel/hotel/e/*
Disallow: /sponsored/staging/
Disallow: /sponsored/business/lloyds-tsb-enterprise-awards/
Disallow: /sponsored/earth/statoil/
Disallow: /sponsored/motoring/alfa-romeo-cars/
Disallow: /sponsored/motoring/vw-up/
Disallow: /sponsored/property/all-saints-eastbourne/
Disallow: /sponsored/supplement-portfolio/
Disallow: /sponsored/travel/cunard-cruises/
Disallow: /sponsored/travel/cruise-holidays/
Disallow: /sponsored/travel/macau/macaumap/
Disallow: /sponsored/travel/telegraph-cottages/
Disallow: /sponsored/finance/spread-betting/
Disallow: /sponsored/finance/retirement-annuity/
Disallow: /sponsored/travel/hidden-britain/
Disallow: /sponsored/business/sme-business-essentials/
Disallow: /sponsored/in-the-know/london-cultural-attractions
Disallow: /sponsored/in-the-know/london-dining
Disallow: /sponsored/in-the-know/london-entertainment
Disallow: /sponsored/in-the-know/london-lifestyle
Disallow: /sponsored/in-the-know/london-nightlife
Disallow: /sponsored/in-the-know/london-shopping
Disallow: /sponsored/in-the-know/london-sport-activities
Disallow: /sponsored/in-the-know/london-transport-accommodation
Disallow: /sponsored/in-the-know/london-video-guides
Disallow: /sponsored/motoring/suzuki-motorbikes/
Disallow: /sponsored/technology/cool-list/
Disallow: /travel/hotels/hotel-finder/
Disallow: /podcasts-more/
Disallow: /secure/register/
Allow: /travel/hotels/hotel-finder/$
Disallow: /martech/js/
Disallow: /martech/css/
Disallow: /martech-content/
Disallow: /bin/telegraph/recombee-config
Disallow: /*&p=
Disallow: /customer/subscription/*?

#Bots which make unnecessary bot traffic

User-Agent: endeca
Disallow: /archive/
Disallow: /search/*

User-agent: AI2Bot
Disallow: /

User-agent: Ai2Bot-Dolma
Disallow: /

User-agent: Amazonbot
Disallow: /

User-agent: anthropic-ai
Disallow: /

User-agent: Applebot-Extended
Disallow: /

User-agent: bedrockbot
Disallow: /

User-agent: Bytespider
Disallow: /

User-agent: CCBot
Disallow: /

User-agent: ChatGLM-Spider
Disallow: /

User-agent: ChatGPT-User
Disallow: /

User-agent: Claude-SearchBot
Disallow: /

User-agent: Claude-User
Disallow: /

User-agent: Claude-Web
Disallow: /

User-agent: ClaudeBot
Disallow: /

User-agent: cohere-ai
Disallow: /

User-agent: Cotoyogi
Disallow: /

User-agent: DeepSeekBot
Disallow: /

User-agent: Diffbot
Disallow: /

User-agent: DuckAssistBot
Disallow: /

User-agent: FacebookBot
Disallow: /

User-agent: FriendlyCrawler
Disallow: /

User-agent: Google-CloudVertexBot
Disallow: /

User-agent: Google-Extended
Disallow: /

User-agent: GoogleOther
Disallow: /

User-agent: GoogleOther-Image
Disallow: /

User-agent: GoogleOther-Video
Disallow: /

User-agent: GPTBot
Disallow: /

User-agent: Grok
Disallow: /

User-agent: iaskspider/2.0
Disallow: /

User-agent: ICC-Crawler
Disallow: /

User-agent: ImagesiftBot
Disallow: /

User-agent: img2dataset
Disallow: /

User-agent: ISSCyberRiskCrawler
Disallow: /

User-agent: Kangaroo Bot
Disallow: /

User-agent: KunatoCrawler
Disallow: /

User-agent: Meltwater
Disallow: /

User-agent: Meta-ExternalAgent
Disallow: /

User-agent: Meta-ExternalFetcher
Disallow: /

User-agent:

sitemap.xml

present — 0 url(s)

head

title: —
description: —

social

no OpenGraph or Twitter meta tags found

fetched 2026-05-23T09:36:57.885Z

web-surface

info

Open standalone →

inspecting web surface…

dnssec

low

Open standalone →

DNSSEC not configured — no DS or DNSKEY records found

Why it matters: DNSSEC cryptographically signs DNS responses, blocking cache-poisoning attacks. US federal civilian agencies are required to enable it under OMB M-22-09 (NIST SC-20).

Recommendations

Enable DNSSEC in your DNS provider's control panel and add the resulting DS record at your registrar

enabled: no
DS records: —
DNSKEY records: —

fetched 2026-05-23T09:36:57.676Z

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

MTA-STS enforce mode — inbound TLS required

Why it matters: MTA-STS forces inbound SMTP to use TLS and refuse downgraded connections. Without it, an in-path attacker can strip TLS and read mail in plaintext (SOC 2 CC6.7).

mode: enforce
max age: 1209600s
mx: aspmx.l.google.com, alt1.aspmx.l.google.com, alt2.aspmx.l.google.com, alt3.aspmx.l.google.com, alt4.aspmx.l.google.com
policy id: 1699518734494

fetched 2026-05-23T09:36:57.800Z

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

TLSRPT configured with reporting URI (rua=)

Why it matters: TLS-RPT publishes a reporting address for SMTP-TLS failures. Without it, downgrade attacks on inbound mail go unnoticed (SOC 2 CC7.2).

version: TLSRPTv1
rua: mailto:19fcb3ab@inbox.ondmarc.com
raw: v=TLSRPTv1; rua=mailto:19fcb3ab@inbox.ondmarc.com;

fetched 2026-05-23T09:36:57.781Z

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

low

Open standalone →

domain expires in 66 days — renew soon

Why it matters: Registrar and expiry tell auditors the domain is owned, current, and not about to lapse. An expired or about-to-expire domain fails business-continuity evidence (SOC 2 A1.2).

Recommendations

Enable auto-renewal at your registrar to avoid accidental expiry

registrar: Markmonitor Inc. [Tag = MARKMONITOR]
created: before Aug-1996
expires: 29-Jul-2026
statuses: Registered until expiry date.

fetched 2026-05-23T09:36:57.883Z

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

check failed: crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

Why it matters: Every certificate issued for this domain is published in Certificate Transparency logs — including subdomains you may have forgotten. Unknown subdomains in CT are pre-disclosed attack surface (ISO 27001 A.8.16).

crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.