vox.com

15-check dossier · scoreboard above, section details below

Get a pack →

Scanning…

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

resolving mx…

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

resolving dmarc…

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

tracing redirects…

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

inspecting web surface…

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.

vox.com

15-check dossier · scoreboard above, section details below

Get a pack →

Mostly compliant · 5 items need attention

Aggregate grade across 15 checks. Auditors typically flag any High-severity finding.

Pass: 10
Warn: 5
Fail: 0

What an auditor would flag first

medium
SPF
~all softfail — receivers may still accept
SOC 2 CC6.7ISO 27001 A.13.2.1
low
DKIM
1/6 DKIM selectors valid
SOC 2 CC6.7
low
TLS certificate
cert expires in 64 days
SOC 2 CC6.6ISO 27001 A.13.1.1

Need this as an artifact your auditor can verify?

Your vox.com scan flagged 1 medium and 4 low findings. A signed pack covers the apex plus up to 100 CT-discovered subdomains, Ed25519-signed and ISO-timestamped, delivered in 10–30 minutes.

Get a pack →See methodology See a sample$29

Scanning…

15-check summary

DNS recordsA/AAAA records present
MX5 MX record(s) present
SPF~all softfail — receivers may still accept
DMARCp=reject — strict policy
DKIM1/6 DKIM selectors valid
TLS certificatecert expires in 64 days
Redirect chainHTTPS served correctly
Security headers3 security header(s) missing
CORSno CORS headers — cross-origin requests blocked by default
Web surfaceHTTPS surface reachable (robots ✓, sitemap ✗, title ✓)
MTA-STSnot applicable: no _mta-sts TXT record
TLS-RPTnot applicable: no TLSRPT record
DNSSECDNSSEC not configured — no DS or DNSKEY records found
WHOISdomain registered until 2026-09-29
Certificate Transparencycheck failed: crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

dns

info

Open standalone →

A/AAAA records present

Why it matters: Without authoritative A or AAAA records on the apex, the domain is unreachable. Missing baseline DNS shows up in vendor reviews as evidence of unmanaged infrastructure (SOC 2 CC6.6).

A: ttl=3600 151.101.65.91
ttl=3600 151.101.129.91
ttl=3600 151.101.1.91
ttl=3600 151.101.193.91
AAAA: —
NS: ttl=86400 ns-1283.awsdns-32.org.
ttl=86400 ns-1679.awsdns-17.co.uk.
ttl=86400 ns-221.awsdns-27.com.
ttl=86400 ns-762.awsdns-31.net.
SOA: ttl=900 ns-221.awsdns-27.com. awsdns-hostmaster.amazon.com. 1 7200 900 1209600 86400
CAA: —
TXT: ttl=300 "anthropic-domain-verification-vfk0xv=MhTpENy9nEF4DiHidR1eCP1iA"
ttl=300 "apple-domain-verification=Xj76GEtgSw_hRYBBQaN0HU5DZWNdeir5gLcUijDamFc"
ttl=300 "google-site-verification=5KmXhFNDyJENptHa4Wvi_9YyYU0Dt1QgO3xjmdAPUzg"
ttl=300 "google-site-verification=lxcjiKFaplY5GO6l0_DUQMn8er_4elFN_W4lxlC-7cY"
ttl=300 "openai-domain-verification=dv-YvHI3vkJHqxqNd6NmvQ03HuS"
ttl=300 "slack-domain-verification=DNb0K6ZkZFmN7mIOSDrYG7VHBcurDYnrsKONWN62"
ttl=300 "tollbit-domain-verification=4565bddfe8bc099c8afbe40c9f475193148e9cb524e0a33ebee02f9ed817e7fa"
ttl=300 "v=spf1 ip4:205.220.178.19 ip4:205.220.166.19 a:mail.voxmedia.com include:_spf.google.com include:amazonses.com include:mail.zendesk.com include:helpscoutemail.com ~all"
ttl=300 "yahoo-verification-key=hzyqqU052JKgQFdIXyrkrhyYE4vWrhL/mAocxeCGEFw="

fetched 2026-05-23T09:23:55.223Z

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

5 MX record(s) present

Why it matters: MX records direct inbound mail. Misconfiguration silently breaks email delivery and lets attackers stand up parallel MX hosts for spoofing campaigns (ISO 27001 A.8.21).

pri=1 aspmx.l.google.com.
pri=5 alt1.aspmx.l.google.com.
pri=5 alt2.aspmx.l.google.com.
pri=10 alt3.aspmx.l.google.com.
pri=10 alt4.aspmx.l.google.com.

fetched 2026-05-23T09:23:55.031Z

mx

info

Open standalone →

resolving mx…

spf

medium

Open standalone →

~all softfail — receivers may still accept

Why it matters: SPF tells receiving servers which hosts may send mail for the domain. Without it, any sender can forge the envelope-from — the primary mechanism behind business-email-compromise (SOC 2 CC6.7).

Recommendations

Move to -all (hardfail) once your mail flow is confirmed — softfail gives no real protection

v=spf1 ip4:205.220.178.19 ip4:205.220.166.19 a:mail.voxmedia.com include:_spf.google.com include:amazonses.com include:mail.zendesk.com include:helpscoutemail.com ~all

v=spf1
ip4:205.220.178.19
ip4:205.220.166.19
a:mail.voxmedia.com
include:_spf.google.com
include:amazonses.com
include:mail.zendesk.com
include:helpscoutemail.com
~all

fetched 2026-05-23T09:23:55.031Z

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

p=reject — strict policy

Why it matters: DMARC binds SPF and DKIM into an enforceable policy (quarantine or reject) and surfaces spoofing attempts via aggregate reports. `p=none` or absent means spoofing succeeds silently (SOC 2 CC6.7).

v=DMARC1; p=reject; pct=100; rua=mailto:zicaptxt@ag.dmarcian.com

v=: DMARC1
p=: reject
pct=: 100
rua=: mailto:zicaptxt@ag.dmarcian.com

fetched 2026-05-23T09:23:55.027Z

dmarc

info

Open standalone →

resolving dmarc…

dkim

low

Open standalone →

1/6 DKIM selectors valid

Why it matters: DKIM signs outbound mail so receivers can detect tampering. Missing selectors or rotated-away keys break DMARC alignment and let receivers downgrade trust (ISO 27001 A.8.24).

Recommendations

Check the missing selectors in your DNS provider and re-add any removed records

default:: —
google:: v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCEcZRk+QWnd1pBC2azEk2z+wmEYr8ZQuHZfqPq8BzHbLihFfTLwL4CR3F3i4uGUn5zVyQTcVI+2x0X8Ffuh11oegDWwjsp4nYcaJ+tUa96LYOJePITd4vPng10MUWvbyjaPNN7p0YUz2fCS6kncZ05NwKQRPB5DPGuQhefv8gI9QIDAQAB
k1:: —
selector1:: —
selector2:: —
mxvault:: —

fetched 2026-05-23T09:23:55.227Z

dkim

info

Open standalone →

probing dkim selectors…

tls

low

Open standalone →

cert expires in 64 days

Why it matters: A valid current TLS certificate is the baseline for data in transit. Expiry, weak chain, or hostname mismatch break HTTPS and fail PCI 4.2.1 / SOC 2 CC6.1.

Recommendations

Schedule certificate renewal — consider enabling auto-renewal

subject cn:: *.eater.com
issuer:: GlobalSign Atlas R3 DV TLS CA 2025 Q2 / GlobalSign nv-sa
valid:: Jun 24 14:22:23 2025 GMT → Jul 26 14:22:22 2026 GMT
authorized:: yes
sha256:: BE:F4:83:69:31:48:4D:00:7C:FC:82:7F:9F:7D:38:BE:79:EF:CD:97:57:07:87:C6:CF:73:06:E9:3C:0D:B9:C0
sans: *.eater.com
*.meridian.net
*.recode.net
*.voxcreative.com
*.voxfieldguide.com
*.voxops.net
cdn.cstatic.net
curbed.com
eater.com
meridian.net
racked.com
recode.net
sbnation.com
vox-cdn.com
vox.com
voxcreative.com
voxfieldguide.com
voxops.net
*.theverge.com
*.voxmedia.com
theverge.com
voxmedia.com
*.racked.com
*.sbnation.com
*.vox-cdn.com
*.vox.com

fetched 2026-05-23T09:23:55.061Z

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

HTTPS served correctly

Why it matters: Bare HTTP requests must redirect to HTTPS without dropping the user mid-chain. Plain-text fallback or open redirects fail PCI 4.2.1 and feed phishing chains (SOC 2 CC6.6).

final status: 200 · 2 hops

[301] https://vox.com/
[200] https://www.vox.com/

fetched 2026-05-23T09:23:55.117Z

redirects

info

Open standalone →

tracing redirects…

headers

low

Open standalone →

3 security header(s) missing

Why it matters: Security headers — HSTS, CSP, X-Frame-Options, Referrer-Policy — defend against XSS, clickjacking, and downgrade attacks. Absent headers map directly to OWASP ASVS V14 findings (ISO 27001 A.8.23).

Recommendations

Add response header — X-Frame-Options: DENY (or SAMEORIGIN if framing is intended)
Add response header — X-Content-Type-Options: nosniff
Add permissions-policy response header

final url: https://www.vox.com/

security headers

strict-transport-security: max-age=31556952; preload
content-security-policy: frame-ancestors https://platform.vox.com https://*.vox.com https://platform.vox.com https://*.vox.com 'self'
x-frame-options: —
x-content-type-options: —
referrer-policy: no-referrer-when-downgrade
permissions-policy: —

other headers

accept-ranges: bytes
age: 1940
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
cache-control: no-store,private
connection: keep-alive
content-encoding: br
content-length: 40160
content-type: text/html; charset=utf-8
date: Sat, 23 May 2026 09:23:55 GMT
etag: "18bp0mfvb46jlmg"
set-cookie: _vm_consent_type=opt-out; expires=Sun, 24 May 2026 09:23:55 GMT; path=/;
vary: Accept-Encoding, x-user-state, x-app-id
via: 1.1 varnish
vm-cyclone-community-id: 1cc08290-4858-4562-8f55-7f474d32bee8
x-cache: HIT
x-cache-hits: 1
x-middleware-rewrite: /resource/homepage
x-powered-by: Next.js
x-served-by: cache-iad-kcgs7200037-IAD
x-timer: S1779528235.105138,VS0,VE2

fetched 2026-05-23T09:23:55.124Z

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

no CORS headers — cross-origin requests blocked by default

Why it matters: Overly permissive CORS (wildcard with credentials, or reflected origin) lets any origin read authenticated responses from this domain. OWASP A05 misconfiguration territory (NIST AC-4).

origin: https://drwho.me
method: GET
preflight status: 301

access-control-* headers

access-control-allow-origin: —
access-control-allow-methods: —
access-control-allow-headers: —
access-control-allow-credentials: —
access-control-max-age: —
access-control-expose-headers: —

no access-control-* headers returned — site does not advertise CORS to this origin

fetched 2026-05-23T09:23:55.083Z

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

HTTPS surface reachable (robots ✓, sitemap ✗, title ✓)

Why it matters: Public files — robots.txt, sitemap.xml, head meta — are what attackers see first during reconnaissance. Misadvertised paths, stale sitemaps, and verbose generators leak more than intended (ISO 27001 A.8.9).

robots.txt

present


User-agent: Amazonbot
Allow: /

User-agent: Applebot
Allow: /

User-agent: GPTBot
Allow: /

User-agent: A6-Indexer
Disallow: /
Allow: /sp/

User-agent: AhrefsBot
Disallow: /
Allow: /sp/

User-agent: AI2Bot
Disallow: /
Allow: /sp/

User-agent: AI2Bot-DeepResearchEval
Disallow: /
Allow: /sp/

User-agent: Ai2Bot-Dolma
Disallow: /
Allow: /sp/

User-agent: aiHitBot
Disallow: /
Allow: /sp/

User-agent: Anchor Browser
Disallow: /
Allow: /sp/

User-agent: anthropic-ai
Disallow: /
Allow: /sp/

User-agent: ApifyBot
Disallow: /
Allow: /sp/

User-agent: ApifyWebsiteContentCrawler
Disallow: /
Allow: /sp/

User-agent: Applebot-Extended
Disallow: /
Allow: /sp/

User-agent: Baiduspider
Disallow: /
Allow: /sp/

User-agent: betaBot
Disallow: /
Allow: /sp/

User-agent: BLEXBot
Disallow: /
Allow: /sp/

User-agent: botify
Disallow: /
Allow: /sp/

User-agent: brands-bot-logo
Disallow: /
Allow: /sp/

User-agent: Brightbot
Disallow: /
Allow: /sp/

User-agent: Bytespider
Disallow: /
Allow: /sp/

User-agent: calculon
Disallow: /
Allow: /sp/

User-agent: CCBot
Disallow: /
Allow: /sp/

User-agent: ChatGLM-Spider
Disallow: /
Allow: /sp/

User-agent: ChatGPT-User
Disallow: /
Allow: /sp/

User-agent: Claude-SearchBot
Disallow: /
Allow: /sp/

User-agent: Claude-User
Disallow: /
Allow: /sp/

User-agent: Claude-Web
Disallow: /
Allow: /sp/

User-agent: ClaudeBot
Disallow: /
Allow: /sp/

User-agent: CloudVertexBot
Disallow: /
Allow: /sp/

User-agent: cohere-ai
Disallow: /
Allow: /sp/

User-agent: cohere-training-data-crawler
Disallow: /
Allow: /sp/

User-agent: collection@infegy.com
Disallow: /
Allow: /sp/

User-agent: Cotoyogi
Disallow: /
Allow: /sp/

User-agent: Crawl4AI
Disallow: /
Allow: /sp/

User-agent: CrunchBot
Disallow: /
Allow: /sp/

User-agent: deepcrawl
Disallow: /
Allow: /sp/

User-agent: DeepSeekBot
Disallow: /
Allow: /sp/

User-agent: Diffbot
Disallow: /
Allow: /sp/

User-agent: DirBuster
Disallow: /
Allow: /sp/

User-agent: DTS
Disallow: /
Allow: /sp/

User-agent: DuckAssistBot
Disallow: /
Allow: /sp/

User-agent: EasouSpider
Disallow: /
Allow: /sp/

User-agent: FacebookBot
Disallow: /
Allow: /sp/

User-agent: FirecrawlAgent
Disallow: /
Allow: /sp/

User-agent: FriendlyCrawler
Disallow: /
Allow: /sp/

User-agent: GlutenCrawler
Disallow: /
Allow: /sp/

User-agent: Google-CloudVertexBot
Disallow: /
Allow: /sp/

User-agent: Google-Extended
Disallow: /
Allow: /sp/

User-agent: GrapeshotCrawler
Disallow: /
Allow: /sp/

User-agent: iaskspider
Disallow: /
Allow: /sp/

User-agent: ICC-Crawler
Disallow: /
Allow: /sp/

User-agent: ImagesiftBot
Disallow: /
Allow: /sp/

User-agent: img2dataset
Disallow: /
Allow: /sp/

User-agent: JackCrawl
Disallow: /
Allow: /sp/

User-agent: Jetslide
Disallow: /
Allow: /sp/

User-agent: linkapedia_bot
Disallow: /
Allow: /sp/

User-agent: Mediatoolkitbot
Disallow: /
Allow: /sp/

User-agent: MegaIndex
Disallow: /
Allow: /sp/

User-agent: meta-externalagent
Disallow: /
Allow: /sp/

User-agent: meta-externalfetcher
Disallow: /
Allow: /sp/

User-agent: Microsoft BITS
Disallow: /
Allow: /sp/

User-agent: Microsoft URL Control
Disallow: /
Allow: /sp/

User-agent: Microsoft-WebDAV-MiniRedir
Disallow: /
Allow: /sp/

User-agent: MistralAI-User
Disallow: /
Allow: /sp/

User-agent: news-please
Disallow: /
Allow: /sp/

User-agent: Novellum
Disallow: /
Allow: /sp/

User-agent: NTENTbot
Disallow: /
Allow: /sp/

User-agent: Nutch
Disallow: /
Allow: /sp/

User-agent: omgili
Disallow: /
Allow: /sp/

User-agent: Omgilibot
Disallow: /
Allow: /sp/

User-agent: OpenLinkProfiler
Disallow: /
Allow: /sp/

User-agent: Perplexity-User
Disallow: /
Allow: /sp/

User-agent: PerplexityBot
Disallow: /
Allow: /sp/

User-agent: PetalBot
Disallow: /
Allow: /sp/

User-agent: Primalbot
Disallow: /
Allow: /sp/

User-agent: python-requests
Disallow: /
Allow: /sp/

User-agent: Re-Animator
Disallow: /
Allow: /sp/

User-agent: Riddler
Disallow: /
Allow: /sp/

User-agent: SafeDNSBot
Disallow: /
Allow: /sp/

User-agent: SBIntuitionsBot
Disallow: /
Allow: /sp/

User-agent: Scrapy
Disallow: /
Allow: /sp/

User-agent: SearchAtlas
Disallow: /
Allow: /sp/

User-age

sitemap.xml

absent

head

title: Vox
description: Vox is a general interest news site for the 21st century. Its mission: to help everyone understand our complicated world, so that we can all help shape it. In text, video and audio, our reporters explain politics, policy, world affairs, technology, culture, science, the climate crisis, money, health and everything else that matters. Our goal is to ensure that everyone, regardless of income or status, can access accurate information that empowers them.

social

og:description: Vox is a general interest news site for the 21st century. Its mission: to help everyone understand our complicated world, so that we can all help shape it. In text, video and audio, our reporters explain politics, policy, world affairs, technology, culture, science, the climate crisis, money, health and everything else that matters. Our goal is to ensure that everyone, regardless of income or status, can access accurate information that empowers them.
og:url: https://www.vox.com/
og:type: website
og:image: https://www.vox.com/static-assets/default-og-image.png
og:site_name: Vox
og:title: Vox
twitter:card: summary_large_image
twitter:site: @voxdotcom

fetched 2026-05-23T09:23:55.161Z

web-surface

info

Open standalone →

inspecting web surface…

dnssec

low

Open standalone →

DNSSEC not configured — no DS or DNSKEY records found

Why it matters: DNSSEC cryptographically signs DNS responses, blocking cache-poisoning attacks. US federal civilian agencies are required to enable it under OMB M-22-09 (NIST SC-20).

Recommendations

Enable DNSSEC in your DNS provider's control panel and add the resulting DS record at your registrar

enabled: no
DS records: —
DNSKEY records: —

fetched 2026-05-23T09:23:55.032Z

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

not applicable: no _mta-sts TXT record

Why it matters: MTA-STS forces inbound SMTP to use TLS and refuse downgraded connections. Without it, an in-path attacker can strip TLS and read mail in plaintext (SOC 2 CC6.7).

no _mta-sts TXT record

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

not applicable: no TLSRPT record

Why it matters: TLS-RPT publishes a reporting address for SMTP-TLS failures. Without it, downgrade attacks on inbound mail go unnoticed (SOC 2 CC7.2).

no TLSRPT record

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

domain registered until 2026-09-29

Why it matters: Registrar and expiry tell auditors the domain is owned, current, and not about to lapse. An expired or about-to-expire domain fails business-continuity evidence (SOC 2 A1.2).

registrar: Amazon Registrar, Inc.
created: 1994-09-30T04:00:00Z
expires: 2026-09-29T04:00:00Z
statuses: clientTransferProhibited https://icann.org/epp#clientTransferProhibited

fetched 2026-05-23T09:23:55.127Z

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

check failed: crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

Why it matters: Every certificate issued for this domain is published in Certificate Transparency logs — including subdomains you may have forgotten. Unknown subdomains in CT are pre-disclosed attack surface (ISO 27001 A.8.16).

crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.