umbraco.com

15-check dossier · scoreboard above, section details below

Get a pack →

Scanning…

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

resolving mx…

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

resolving dmarc…

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

tracing redirects…

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

inspecting web surface…

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.

umbraco.com

15-check dossier · scoreboard above, section details below

Get a pack →

Mostly compliant · 5 items need attention

Aggregate grade across 15 checks. Auditors typically flag any High-severity finding.

Pass: 10
Warn: 5
Fail: 0

What an auditor would flag first

medium
SPF
~all softfail — receivers may still accept
SOC 2 CC6.7ISO 27001 A.13.2.1
low
DMARC
p=quarantine — receivers send to spam
SOC 2 CC6.7ISO 27001 A.13.2.1
low
DKIM
1/6 DKIM selectors valid
SOC 2 CC6.7

Need this as an artifact your auditor can verify?

Your umbraco.com scan flagged 1 medium and 4 low findings. A signed pack covers the apex plus up to 100 CT-discovered subdomains, Ed25519-signed and ISO-timestamped, delivered in 10–30 minutes.

Get a pack →See methodology See a sample$29

Scanning…

15-check summary

DNS recordsA/AAAA records present
MX5 MX record(s) present
SPF~all softfail — receivers may still accept
DMARCp=quarantine — receivers send to spam
DKIM1/6 DKIM selectors valid
TLS certificatecert expires in 81 days
Redirect chainHTTPS served correctly
Security headersall security headers present
CORSno CORS headers — cross-origin requests blocked by default
Web surfaceHTTPS surface reachable (robots ✓, sitemap ✗, title ✓)
MTA-STSMTA-STS testing mode — not yet enforcing inbound TLS
TLS-RPTTLSRPT configured with reporting URI (rua=)
DNSSECDNSSEC enabled — DS records present and chain validated (AD flag)
WHOISdomain registered until 2026-09-23
Certificate Transparencycheck failed: crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

dns

info

Open standalone →

A/AAAA records present

Why it matters: Without authoritative A or AAAA records on the apex, the domain is unreachable. Missing baseline DNS shows up in vendor reviews as evidence of unmanaged infrastructure (SOC 2 CC6.6).

A: ttl=300 104.18.38.165
ttl=300 172.64.149.91
AAAA: ttl=300 2a06:98c1:3102::ac40:955b
ttl=300 2a06:98c1:3109::6812:26a5
NS: ttl=86400 roan.ns.cloudflare.com.
ttl=86400 davina.ns.cloudflare.com.
SOA: ttl=1800 davina.ns.cloudflare.com. dns.cloudflare.com. 2404516431 10000 2400 604800 1800
CAA: ttl=300 \# 17 00 05 69 73 73 75 65 61 6d 61 7a 6f 6e 2e 63 6f 6d
ttl=300 \# 19 00 05 69 73 73 75 65 63 6f 6d 6f 64 6f 63 61 2e 63 6f 6d
ttl=300 \# 45 00 05 69 73 73 75 65 64 69 67 69 63 65 72 74 2e 63 6f 6d 3b 20 63 61 6e 73 69 67 6e 68 74 74 70 65 78 63 68 61 6e 67 65 73 3d 79 65 73
ttl=300 \# 18 00 05 69 73 73 75 65 65 6e 74 72 75 73 74 2e 6e 65 74
ttl=300 \# 22 00 05 69 73 73 75 65 6c 65 74 73 65 6e 63 72 79 70 74 2e 6f 72 67
ttl=300 \# 41 00 05 69 73 73 75 65 70 6b 69 2e 67 6f 6f 67 3b 20 63 61 6e 73 69 67 6e 68 74 74 70 65 78 63 68 61 6e 67 65 73 3d 79 65 73
ttl=300 \# 18 00 05 69 73 73 75 65 73 65 63 74 69 67 6f 2e 63 6f 6d
ttl=300 \# 14 00 05 69 73 73 75 65 73 73 6c 2e 63 6f 6d
ttl=300 \# 23 00 05 69 73 73 75 65 77 77 77 2e 64 69 67 69 63 65 72 74 2e 63 6f 6d
ttl=300 \# 23 00 09 69 73 73 75 65 77 69 6c 64 63 6f 6d 6f 64 6f 63 61 2e 63 6f 6d
ttl=300 \# 49 00 09 69 73 73 75 65 77 69 6c 64 64 69 67 69 63 65 72 74 2e 63 6f 6d 3b 20 63 61 6e 73 69 67 6e 68 74 74 70 65 78 63 68 61 6e 67 65 73 3d 79 65 73
ttl=300 \# 26 00 09 69 73 73 75 65 77 69 6c 64 6c 65 74 73 65 6e 63 72 79 70 74 2e 6f 72 67
ttl=300 \# 45 00 09 69 73 73 75 65 77 69 6c 64 70 6b 69 2e 67 6f 6f 67 3b 20 63 61 6e 73 69 67 6e 68 74 74 70 65 78 63 68 61 6e 67 65 73 3d 79 65 73
ttl=300 \# 18 00 09 69 73 73 75 65 77 69 6c 64 73 73 6c 2e 63 6f 6d
TXT: ttl=60 "MS=ms52615003"
ttl=60 "apple-domain-verification=o3MbQ62rpEfSmlFK"
ttl=60 "status-page-domain-verification=276d3sk1v8q9"
ttl=60 "v=spf1 include:_u.umbraco.com._spf.smart.ondmarc.com ~all"
ttl=60 "facebook-domain-verification=oflwcmlwu5jxowkj9hnukj40pvmj9e"
ttl=60 "anthropic-domain-verification-22jj8c=n4f4GDY2bhy2EpaE0qBJ0ifV2"
ttl=60 "google-site-verification=97vLCVebmXZh4wHcRI7mkKy6rayRisdaglFGzi-zPhU"

fetched 2026-05-23T09:30:44.406Z

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

5 MX record(s) present

Why it matters: MX records direct inbound mail. Misconfiguration silently breaks email delivery and lets attackers stand up parallel MX hosts for spoofing campaigns (ISO 27001 A.8.21).

pri=1 aspmx.l.google.com.
pri=5 alt1.aspmx.l.google.com.
pri=5 alt2.aspmx.l.google.com.
pri=10 alt3.aspmx.l.google.com.
pri=10 alt4.aspmx.l.google.com.

fetched 2026-05-23T09:30:44.404Z

mx

info

Open standalone →

resolving mx…

spf

medium

Open standalone →

~all softfail — receivers may still accept

Why it matters: SPF tells receiving servers which hosts may send mail for the domain. Without it, any sender can forge the envelope-from — the primary mechanism behind business-email-compromise (SOC 2 CC6.7).

Recommendations

Move to -all (hardfail) once your mail flow is confirmed — softfail gives no real protection

v=spf1 include:_u.umbraco.com._spf.smart.ondmarc.com ~all

v=spf1
include:_u.umbraco.com._spf.smart.ondmarc.com
~all

fetched 2026-05-23T09:30:44.405Z

spf

info

Open standalone →

resolving spf…

dmarc

low

Open standalone →

p=quarantine — receivers send to spam

Why it matters: DMARC binds SPF and DKIM into an enforceable policy (quarantine or reject) and surfaces spoofing attempts via aggregate reports. `p=none` or absent means spoofing succeeds silently (SOC 2 CC6.7).

Recommendations

Upgrade to p=reject once your SPF and DKIM pass rates are consistently high

v=DMARC1; p=quarantine; pct=100; sp=quarantine; rua=mailto:ec958dec@inbox.ondmarc.com; ruf=mailto:ec958dec@inbox.ondmarc.com; adkim=r; aspf=r; fo=1; rf=afrf; ri=3600

v=: DMARC1
p=: quarantine
pct=: 100
sp=: quarantine
rua=: mailto:ec958dec@inbox.ondmarc.com
ruf=: mailto:ec958dec@inbox.ondmarc.com
adkim=: r
aspf=: r
fo=: 1
rf=: afrf
ri=: 3600

fetched 2026-05-23T09:30:44.655Z

dmarc

info

Open standalone →

resolving dmarc…

dkim

low

Open standalone →

1/6 DKIM selectors valid

Why it matters: DKIM signs outbound mail so receivers can detect tampering. Missing selectors or rotated-away keys break DMARC alignment and let receivers downgrade trust (ISO 27001 A.8.24).

Recommendations

Check the missing selectors in your DNS provider and re-add any removed records

default:: —
google:: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtZdOHABOabuoYOiOvntMOdK0oem4jKmp0dpxMFFsOrUuxYUCxzyizyJJu6Pr5VCTii4ymX+c4pJMJXxUQCMKiZPa/a3g3+GcdYfG6FzZXOP7tPhRF2W8zU5NV2xkh+8THokdVpzFL70Tpu7nlmj9jy40ANjiZc+ycOOxcPwS6zFPDdycz8ilDMxnI2KwSuAUa +PQuX3TQ6SKpJj+53RfntuZOS5bMoHKEO8JeLu0bApAT4xXE+OZaCmB5PBbTg2fTsXMgaGT6dgYKGF5tl33VBt2hwh7g0KOUnMCH1wLX4nu+xSaDBfcTpq44At14m715NrVf+8LcHaa7rPGleI7/wIDAQAB
k1:: —
selector1:: —
selector2:: —
mxvault:: —

fetched 2026-05-23T09:30:44.421Z

dkim

info

Open standalone →

probing dkim selectors…

tls

low

Open standalone →

cert expires in 81 days

Why it matters: A valid current TLS certificate is the baseline for data in transit. Expiry, weak chain, or hostname mismatch break HTTPS and fail PCI 4.2.1 / SOC 2 CC6.1.

Recommendations

Schedule certificate renewal — consider enabling auto-renewal

subject cn:: umbraco.com
issuer:: WE1 / Google Trust Services
valid:: May 15 02:45:12 2026 GMT → Aug 13 03:45:11 2026 GMT
authorized:: yes
sha256:: 72:A7:A0:1A:E2:1F:37:E2:88:DE:61:4D:BD:D7:BC:56:F0:C6:23:63:35:44:8A:67:57:A0:65:D2:F0:99:74:21
sans: umbraco.com

fetched 2026-05-23T09:30:44.448Z

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

HTTPS served correctly

Why it matters: Bare HTTP requests must redirect to HTTPS without dropping the user mid-chain. Plain-text fallback or open redirects fail PCI 4.2.1 and feed phishing chains (SOC 2 CC6.6).

final status: 200 · 1 hop

[200] https://umbraco.com/

fetched 2026-05-23T09:30:44.602Z

redirects

info

Open standalone →

tracing redirects…

headers

info

Open standalone →

all security headers present

Why it matters: Security headers — HSTS, CSP, X-Frame-Options, Referrer-Policy — defend against XSS, clickjacking, and downgrade attacks. Absent headers map directly to OWASP ASVS V14 findings (ISO 27001 A.8.23).

final url: https://umbraco.com/

security headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: default-src 'self' googleads.g.doubeclick.net play.google.com;script-src 'self' ajax.aspnetcdn.com *.calendly.com www.google.com maps.googleapis.com *.googleapis.com *.gstatic.com *.g2.com *.g2crowd.com recruit.hr-on.com umbracohq.matomo.cloud consent.cookiebot.com consentcdn.cookiebot.com tagmanager.google.com *.googletagmanager.com load.sst.umbraco.com *.load.sst.umbraco.com cdn.matomo.cloud connect.facebook.net *.app-us1.com trackcmp.net *.fluentos.com *.doubleclick.net app.intercom.io widget.intercom.io js.intercomcdn.com blob: 'nonce-2Jr4se0Mt4IyQBxoAxXrdxDjt8KKG2y1KjIprALyBCU=';style-src 'self' fonts.googleapis.com *.calendly.com tagmanager.google.com blob: 'unsafe-inline';connect-src 'self' blob: data: maps.gstatic.com maps.googleapis.com mapsresources-pa.googleapis.com *.googletagmanager.com *.analytics.google.com *.google-analytics.com consentcdn.cookiebot.com www.google.com px.ads.linkedin.com sst.umbraco.com umbracohq.matomo.cloud *.doubleclick.net *.navattic.com *.fluentos.com via.intercom.io api.intercom.io api.au.intercom.io api.eu.intercom.io api-iam.intercom.io api-iam.eu.intercom.io api-iam.au.intercom.io api-ping.intercom.io nexus-websocket-a.intercom.io wss://nexus-websocket-a.intercom.io wss://nexus-websocket-b.intercom.io wss://nexus-europe-websocket.intercom.io wss://nexus-australia-websocket.intercom.io nexus-websocket-b.intercom.io nexus-europe-websocket.intercom.io nexus-australia-websocket.intercom.io https://*.intercom-messenger.com wss://*.intercom-messenger.com uploads.intercomcdn.com uploads.intercomcdn.eu uploads.au.intercomcdn.com uploads.eu.intercomcdn.com uploads.intercomusercontent.com;font-src 'self' fonts.gstatic.com fonts.intercomcdn.com js.intercomcdn.com data:;form-action 'self' intercom.help api-iam.intercom.io api-iam.eu.intercom.io api-iam.au.intercom.io;img-src 'self' *.calendly.com data: blob: *.googleapis.com maps.gstatic.com *.ytimg.com imgsct.cookiebot.com *.googletagmanager.com googletagmanager.com ssl.gstatic.com gstatic.com *.google-analytics.com px.ads.linkedin.com www.google.com *.facebook.com facebook.com *.fluentos.com *.doubleclick.net load.sst.umbraco.com *.load.sst.umbraco.com js.intercomcdn.com static.intercomassets.com downloads.intercomcdn.com downloads.intercomcdn.eu downloads.au.intercomcdn.com uploads.intercomusercontent.com gifs.intercomcdn.com video-messages.intercomcdn.com messenger-apps.intercom.io messenger-apps.eu.intercom.io messenger-apps.au.intercom.io *.intercom-attachments-1.com *.intercom-attachments.eu *.au.intercom-attachments.com *.intercom-attachments-2.com *.intercom-attachments-3.com *.intercom-attachments-4.com *.intercom-attachments-5.com *.intercom-attachments-6.com *.intercom-attachments-7.com *.intercom-attachments-8.com *.intercom-attachments-9.com static.intercomassets.eu static.au.intercomassets.com *.intercom-sheets.com incident.io *.incident.io;media-src 'self' youtube.com *.youtube.com vimeo.com *.vimeo.com js.intercomcdn.com downloads.intercomcdn.com downloads.intercomcdn.eu downloads.au.intercomcdn.com;frame-ancestors 'self';frame-src calendly.com www.g2.com www.google.com youtube.com www.youtube.com recruit.hr-on.com consentcdn.cookiebot.com *.googletagmanager.com intercom-sheets.com www.intercom-reporting.com player.vimeo.com fast.wistia.net capture.navattic.com;worker-src *.g2.com blob:;base-uri 'self'
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
referrer-policy: no-referrer-when-downgrade
permissions-policy: accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=(), display-capture=(), encrypted-media=(), fullscreen=(self "https://capture.navattic.com"), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), web-share=(), xr-spatial-tracking=(), clipboard-read=(), clipboard-write=(), gamepad=(), hid=(), idle-detection=(), interest-cohort=(), serial=(), unload=(self)

other headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: a0030b2bdf008121-IAD
connection: keep-alive
content-encoding: br
content-type: text/html; charset=utf-8
date: Sat, 23 May 2026 09:30:44 GMT
server: cloudflare
set-cookie: __cf_bm=Fm2_8nc7FnGHkCEh9oJ7BWuR_DeTVwoyuc5SBuDVWyo-1779528644.454947-1.0.1.1-q_6SfxQ6TwMqG8qlrdoE8bT2ePzeVg7na_63UaXRJCjObr3hnWikhoHYzzUn93Me0gOggrRm9MnRy.RPC.jPe__DKrnBpDhd5TXw.fdhMG7daq6YIN34WPChqSQwFkeN; HttpOnly; SameSite=None; Secure; Path=/; Domain=umbraco.com; Expires=Sat, 23 May 2026 10:00:44 GMT
transfer-encoding: chunked
x-xss-protection: 1; mode=block

fetched 2026-05-23T09:30:44.614Z

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

no CORS headers — cross-origin requests blocked by default

Why it matters: Overly permissive CORS (wildcard with credentials, or reflected origin) lets any origin read authenticated responses from this domain. OWASP A05 misconfiguration territory (NIST AC-4).

origin: https://drwho.me
method: GET
preflight status: 200

access-control-* headers

access-control-allow-origin: —
access-control-allow-methods: —
access-control-allow-headers: —
access-control-allow-credentials: —
access-control-max-age: —
access-control-expose-headers: —

no access-control-* headers returned — site does not advertise CORS to this origin

fetched 2026-05-23T09:30:44.620Z

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

HTTPS surface reachable (robots ✓, sitemap ✗, title ✓)

Why it matters: Public files — robots.txt, sitemap.xml, head meta — are what attackers see first during reconnaissance. Misadvertised paths, stale sitemaps, and verbose generators leak more than intended (ISO 27001 A.8.9).

robots.txt

present

User-agent: *
Sitemap: https://umbraco.com/sitemap/
Disallow: /App_Plugins/
Disallow: /runtimes/
Disallow: /wwwroot/
Disallow: /umbraco/
Disallow: /views/

#                                       %%%%%%%%%                                   
#                             %%%%%%%%%%%%%%%%%%%%%%%%%%%%#                         
#                       (%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%                    
#                    %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%                
#                *%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%.            
#              %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%          
#            %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%        
#          %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%      
#        (%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%     
#       %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%#   
#      %%%%%%%%%%%%%%%#      %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%(      %%%%%%%%%%%%%%%#  
#     %%%%%%%%%%%%%%%%       %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%       %%%%%%%%%%%%%%%# 
#    #%%%%%%%%%%%%%%%%      (%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%       %%%%%%%%%%%%%%%% 
#    %%%%%%%%%%%%%%%%#      %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%(      (%%%%%%%%%%%%%%%%
#    %%%%%%%%%%%%%%%%       %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%      /%%%%%%%%%%%%%%%%
#   %%%%%%%%%%%%%%%%%       %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%       %%%%%%%%%%%%%%%%
#   %%%%%%%%%%%%%%%%%       %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%       %%%%%%%%%%%%%%%%
#   %%%%%%%%%%%%%%%%%       %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%       %%%%%%%%%%%%%%%%
#    %%%%%%%%%%%%%%%%       %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%(       %%%%%%%%%%%%%%%%
#    %%%%%%%%%%%%%%%%#       %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%       %%%%%%%%%%%%%%%%%
#    *%%%%%%%%%%%%%%%%        %%%%%%%%%%%%%%%%%%%%%%%%%%%%%        %%%%%%%%%%%%%%%% 
#     #%%%%%%%%%%%%%%%%          (%%%%%%%%%%%%%%%%%%%%%/          %%%%%%%%%%%%%%%%/ 
#      %%%%%%%%%%%%%%%%%%                                       %%%%%%%%%%%%%%%%%#  
#       #%%%%%%%%%%%%%%%%%%.                                 %%%%%%%%%%%%%%%%%%%(   
#         %%%%%%%%%%%%%%%%%%%%%%%%%%                 %%%%%%%%%%%%%%%%%%%%%%%%%%     
#          %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%(      
#            %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%        
#              %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%/          
#                 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%             
#                    %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%                
#                        #%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%                    
#                             #%%%%%%%%%%%%%%%%%%%%%%%%%%%/

sitemap.xml

absent

head

title: Umbraco CMS - the flexible open-source .NET CMS
description: Umbraco is the leading open-source ASP.NET Core CMS | More than 700,000 websites worldwide are powered by our flexible and editor-friendly CMS

social

og:title: Umbraco CMS - the flexible open-source .NET CMS
og:description: Umbraco is the leading open-source ASP.NET Core CMS | More than 700,000 websites worldwide are powered by our flexible and editor-friendly CMS
og:type: website
og:image: https://umbraco.com/media/ziikdjap/umbraco_social_og.png?cc=0.0010321753986332466,0.069063888998924364,0,0.0015260460386189473&width=1200&height=628&quality=85&v=1db00457cafc8c0
og:image:width: 1200
og:image:height: 628
og:url: https://umbraco.com/
twitter:title: Umbraco CMS - the flexible open-source .NET CMS
twitter:description: Umbraco is the leading open-source ASP.NET Core CMS | More than 700,000 websites worldwide are powered by our flexible and editor-friendly CMS
twitter:card: summary_large_image
twitter:site: @umbraco
twitter:image: https://umbraco.com/media/ziikdjap/umbraco_social_og.png?cc=0.0010321753986332466,0.069063888998924364,0,0.0015260460386189473&width=1200&height=628&quality=85&v=1db00457cafc8c0

fetched 2026-05-23T09:30:44.636Z

web-surface

info

Open standalone →

inspecting web surface…

dnssec

info

Open standalone →

DNSSEC enabled — DS records present and chain validated (AD flag)

Why it matters: DNSSEC cryptographically signs DNS responses, blocking cache-poisoning attacks. US federal civilian agencies are required to enable it under OMB M-22-09 (NIST SC-20).

enabled: yes
DS records: 2371 ECDSAP256SHA256 2 659ba43f016b3e24025d4726a0a7167c91162f726035f0c2e4fc6d817afa2a9f, DS ECDSAP256SHA256 2 86400 1779847299 1779238299 27677 com. KYhaQ3Kp+U4wD/9WX+VJGIafV6R7deB1037G9u5qdkWg0J+D6uAsNtNFZBgOueqzTd7tIRqh/6oOYcQXDmA1Dg==
DNSKEY records: 3 key(s)

fetched 2026-05-23T09:30:44.422Z

dnssec

info

Open standalone →

checking dnssec…

mta-sts

low

Open standalone →

MTA-STS testing mode — not yet enforcing inbound TLS

Why it matters: MTA-STS forces inbound SMTP to use TLS and refuse downgraded connections. Without it, an in-path attacker can strip TLS and read mail in plaintext (SOC 2 CC6.7).

Recommendations

Update the MTA-STS policy file to set 'mode: enforce' once you've validated TLS delivery

mode: testing
max age: 86401s
mx: aspmx.l.google.com, alt1.aspmx.l.google.com, alt2.aspmx.l.google.com, alt3.aspmx.l.google.com, alt4.aspmx.l.google.com
policy id: 1681374613206

fetched 2026-05-23T09:30:44.633Z

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

TLSRPT configured with reporting URI (rua=)

Why it matters: TLS-RPT publishes a reporting address for SMTP-TLS failures. Without it, downgrade attacks on inbound mail go unnoticed (SOC 2 CC7.2).

version: TLSRPTv1
rua: mailto:ec958dec@inbox.ondmarc.com
raw: v=TLSRPTv1; rua=mailto:ec958dec@inbox.ondmarc.com;

fetched 2026-05-23T09:30:44.604Z

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

domain registered until 2026-09-23

Why it matters: Registrar and expiry tell auditors the domain is owned, current, and not about to lapse. An expired or about-to-expire domain fails business-continuity evidence (SOC 2 A1.2).

registrar: Cloudflare, Inc.
created: 2003-09-23T09:38:07Z
expires: 2026-09-23T09:38:07Z
statuses: clientTransferProhibited https://icann.org/epp#clientTransferProhibited

fetched 2026-05-23T09:30:44.491Z

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

check failed: crt.sh: Error: crt.sh http 502; certspotter: Error: certspotter http 429

Why it matters: Every certificate issued for this domain is published in Certificate Transparency logs — including subdomains you may have forgotten. Unknown subdomains in CT are pre-disclosed attack surface (ISO 27001 A.8.16).

crt.sh: Error: crt.sh http 502; certspotter: Error: certspotter http 429

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.