workday.com

15-check dossier · scoreboard above, section details below

Get a pack →

Scanning…

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

resolving mx…

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

resolving dmarc…

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

tracing redirects…

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

inspecting web surface…

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.

workday.com

15-check dossier · scoreboard above, section details below

Get a pack →

Mostly compliant · 4 items need attention

Aggregate grade across 15 checks. Auditors typically flag any High-severity finding.

Pass: 11
Warn: 4
Fail: 0

What an auditor would flag first

medium
SPF
~all softfail — receivers may still accept
SOC 2 CC6.7ISO 27001 A.13.2.1
low
DKIM
1/6 DKIM selectors valid
SOC 2 CC6.7
low
Security headers
3 security header(s) missing
SOC 2 CC6.6ISO 27001 A.14.1.2

Need this as an artifact your auditor can verify?

Your workday.com scan flagged 1 medium and 3 low findings. A signed pack covers the apex plus up to 100 CT-discovered subdomains, Ed25519-signed and ISO-timestamped, delivered in 10–30 minutes.

Get a pack →See methodology See a sample$29

Scanning…

15-check summary

DNS recordsA/AAAA records present
MX2 MX record(s) present
SPF~all softfail — receivers may still accept
DMARCp=reject — strict policy
DKIM1/6 DKIM selectors valid
TLS certificatecert valid for 109 days
Redirect chainHTTPS served correctly
Security headers3 security header(s) missing
CORSno CORS headers — cross-origin requests blocked by default
Web surfaceHTTPS surface reachable (robots ✓, sitemap ✗, title ✓)
MTA-STSnot applicable: no _mta-sts TXT record
TLS-RPTnot applicable: no TLSRPT record
DNSSECDNSSEC not configured — no DS or DNSKEY records found
WHOISdomain registered until 2026-09-13
Certificate Transparencycheck failed: crt.sh: Error: crt.sh http 502; certspotter: Error: certspotter http 429

dns

info

Open standalone →

A/AAAA records present

Why it matters: Without authoritative A or AAAA records on the apex, the domain is unreachable. Missing baseline DNS shows up in vendor reviews as evidence of unmanaged infrastructure (SOC 2 CC6.6).

A: ttl=600 209.177.161.149
AAAA: —
NS: ttl=3600 dns1.p01.nsone.net.
ttl=3600 dns2.p01.nsone.net.
ttl=3600 dns3.p01.nsone.net.
ttl=3600 pdns1.ultradns.net.
ttl=3600 pdns2.ultradns.net.
ttl=3600 pdns3.ultradns.org.
SOA: ttl=60 dns1.p01.nsone.net. noc.workday.com. 2826 60 60 1209600 60
CAA: —
TXT: ttl=600 "MS=ms39946896"
ttl=600 "MS=ms41324812"
ttl=600 "asv=37042d2d1a21cbedd7056793527ff308"
ttl=600 "apple-domain-verification=noZBEvsoWBJGxHAp"
ttl=600 "docusign=aad4a6fc-60c0-43ab-bfa7-923367166cef"
ttl=600 "jamf-site-verification=NOP1_oXRvqcYFK-LbZDjvw"
ttl=600 "canva-site-verification=g0TSE4CvzrpVpCjlPLjayw"
ttl=600 "pendo-domain-verification=sDTSAAGNBs3B-WNfBcRGnQtg5FQ"
ttl=600 "airtable-verification=06b09686d9091b2d20c1a5d811945f29"
ttl=600 "airtable-verification=4696d4cccb035cf3401bafdf50f5cec8"
ttl=600 "airtable-verification=471df1cdd04fee3f429e0e6d99d889c4"
ttl=600 "airtable-verification=5eaa1386eed9003f886e80b7d8f09b95"
ttl=600 "amazonses:UEYlSkDYiov9Bt9Eu61YS3bhiGgIYJnT8TR8F+DGkoc="
ttl=600 "amazonses:UzPaoE0Y0+qPQ5mjYDSEJPr4X+OqSTLNC/LLHzAZO5k="
ttl=600 "amazonses:t4swrpA/w3cEUCcpaVBF+sVNVhW+AR60guu/iLgbRnI="
ttl=600 "openai-domain-verification=dv-K9TtcH63DWAdOO44qqmk1p53"
ttl=600 "adobe-sign-verification=f0e0ae31f55e0d19b1cd5eb67f2510de"
ttl=600 "miro-verification=edcda854f5d21415e3a0fdd9eb91eeebe3258055"
ttl=600 "mongodb-site-verification=4CYqogc6dJyFwen5EYLKOQi3hLY07R1A"
ttl=600 "mongodb-site-verification=7sCzgv30gVpKNmzZwq06OkUAkTla6en8"
ttl=600 "mongodb-site-verification=RqVOJyr8k9aSNkI7lLgmtCeUyZW3gsgB"
ttl=600 "mongodb-site-verification=U0Dr5zun2KigFjlL01Em1k1EmJxIKBTB"
ttl=600 "cursor-domain-verification-3eykmy=GkvdlOjvXZwO8X4z9CGSn7EJm"
ttl=600 "fastly-domain-delegation-uWWPjAMeiDvmshW-471290-<2022-03-16"
ttl=600 "mixpanel-domain-verify=c780b8c4-6e68-44a3-a48f-a58cec4ebae6"
ttl=600 "twilio-domain-verification=fe3af6693b3818e25818455c36e4c796"
ttl=600 "aliyun-site-verification=af4b34b2-7394-49ff-9dce-30de3a8db6ce"
ttl=600 "onetrust-domain-verification=0e3f87e831844a2085a0ad1312d807bc"
ttl=600 "onetrust-domain-verification=ba7627cad52146529fe3eec8fbe8f22f"
ttl=600 "anthropic-domain-verification-gfh6jq=5T9iy2lCxbCthSgSLMr98ElTF"
ttl=600 "slack-domain-verification=6YY7Q852mNXXsm5XBX4P0ilwvbsmAmpNc6B8QJyh"
ttl=600 "yahoo-verification-key=I0chZmYdDiKw8zSMRrakqVEjGPVc2RlGVRhLw2AYlC4="
ttl=600 "google-site-verification=-XQX5bd3Nc1E3ONQ4JZk4krJJm6_PR-4wzJUdUV8zAo"
ttl=600 "google-site-verification=-gGAD8ZW2hVpbQPPIKGFQbQkMg1ty7l4nJTp3b4lRNo"
ttl=600 "google-site-verification=0esKGtPO0ZIpphAGmjkqY-X9i7vyYsfLQWEu_LbfpeI"
ttl=600 "google-site-verification=34aQz5ufViRFeZwvoGc7BNV8mV1G3Hi6vgujTMybK64"
ttl=600 "google-site-verification=9USZpaAqAUtQgLSuuH95QoCYZMF6UTgbgs5oQFQQJZg"
ttl=600 "google-site-verification=LnAyibEovWLEGEGH05ny_-Q2yG8yXlkJjHPJ4GD-knU"
ttl=600 "google-site-verification=WHb_5Syp1CpO7GFGr4abtyeU25FgV6fYyWEKrpDHefo"
ttl=600 "google-site-verification=tfWI9GywrkegzNfJcNeDNG3HetcGQ6-ylg3pCVSHmUI"
ttl=600 "notion-domain-verification=V37Nt5DKIqnAVP1fYiSX8RIaIOnpufJyfGpe4ojOvJv"
ttl=600 "atlassian-sending-domain-verification=8bd2ab21-f1bb-482c-a63a-0f1892a45a3b"
ttl=600 "CisionOne SAML=e7fd2b9975d12d4bdff280156e14f163738a402bda62a351c306069c12fcfcea"
ttl=600 "stripe-verification=664E57D8823DC6E44E3CAD5FF80FB7A2C6026E3DBAF597751055E40985AA869A"
ttl=600 "stripe-verification=DF3F80C1E340E8A76F45CFC03F2603D5BEEC32D73E10072EB2798F0C01FF3832"
ttl=600 "sending_domain1028501=ef9e9fd601b823c386c6421a401646e5df99432a25c81283604dcee77e5d744b"
ttl=600 "adobe-sign-verification=a97182a0026dc60caaa85cbc3dd96c75ae3115ebcdb37eaed7c7238fa37f3dd1"
ttl=600 "wiz-domain-verification=46c68a2914897e79d078a78f194124ceb526a8389942d66f8ac67675c77aebae"
ttl=600 "ciscocidomainverification=48db4251922e9528f73243909d73eec71507a0dddd9f2fd8ff80f1d869cad913"
ttl=600 "drift-domain-verification=c27c30cb5d3220cb0eb600eb65e1e6cec4f6d879afcce75a77d530854d500d00"
ttl=600 "adobe-idp-site-verification=b9a2193746f87982e79d7540d52087d888783b881c67de3b61a3ab95cb490478"
ttl=600 "webexdomainverification.4C675B87ACECB136E053AB06FC0A3F65=682bc9e7-9762-464d-96bc-25e73ea45c81"
ttl=600 "webexdomainverification.4C675B89984EB136E053AB06FC0A3F65=d11e39fc-bd74-4411-8a4f-ff7a8ae550ca"
ttl=600 "atlassian-domain-verification=2mwW/IfXRyfnPGqBlXWKyC1uKDG2F5j9VzSs7uAC9OFOy3uiglQC00ga9nOA4mPj"
ttl=600 "atlassian-domain-verification=eDGRCzu4wP6RWifY9QvDj7/qPj8F4MfvMPcs1FXKaUYuSPJQ2n6xKaLQu50gRdR4"
ttl=600 "v=spf1 include:workday.com._nspf.vali.email include:%{i}._ip.%{h}._ehlo.%{d}._spf.vali.email ~all"

fetched 2026-05-23T09:21:23.117Z

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

2 MX record(s) present

Why it matters: MX records direct inbound mail. Misconfiguration silently breaks email delivery and lets attackers stand up parallel MX hosts for spoofing campaigns (ISO 27001 A.8.21).

pri=10 mxa-001ee601.gslb.pphosted.com.
pri=10 mxb-001ee601.gslb.pphosted.com.

fetched 2026-05-23T09:21:23.118Z

mx

info

Open standalone →

resolving mx…

spf

medium

Open standalone →

~all softfail — receivers may still accept

Why it matters: SPF tells receiving servers which hosts may send mail for the domain. Without it, any sender can forge the envelope-from — the primary mechanism behind business-email-compromise (SOC 2 CC6.7).

Recommendations

Move to -all (hardfail) once your mail flow is confirmed — softfail gives no real protection

v=spf1 include:workday.com._nspf.vali.email include:%{i}._ip.%{h}._ehlo.%{d}._spf.vali.email ~all

v=spf1
include:workday.com._nspf.vali.email
include:%{i}._ip.%{h}._ehlo.%{d}._spf.vali.email
~all

fetched 2026-05-23T09:21:23.119Z

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

p=reject — strict policy

Why it matters: DMARC binds SPF and DKIM into an enforceable policy (quarantine or reject) and surfaces spoofing attempts via aggregate reports. `p=none` or absent means spoofing succeeds silently (SOC 2 CC6.7).

v=DMARC1; p=reject; rua=mailto:dmarc_agg@vali.email,mailto:aad996bd@mxtoolbox.dmarc-report.com,mailto:dmarc_agg@dmarc.250ok.net

v=: DMARC1
p=: reject
rua=: mailto:dmarc_agg@vali.email,mailto:aad996bd@mxtoolbox.dmarc-report.com,mailto:dmarc_agg@dmarc.250ok.net

fetched 2026-05-23T09:21:23.109Z

dmarc

info

Open standalone →

resolving dmarc…

dkim

low

Open standalone →

1/6 DKIM selectors valid

Why it matters: DKIM signs outbound mail so receivers can detect tampering. Missing selectors or rotated-away keys break DMARC alignment and let receivers downgrade trust (ISO 27001 A.8.24).

Recommendations

Check the missing selectors in your DNS provider and re-add any removed records

default:: —
google:: —
k1:: —
selector1:: v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDTQg+NU8JxxHmAIfoFeu9issMgVf0387LrpUTGbbbFS1TsCmiLTZ6Pb609tvi5kqJVpm7QW+ZSf4v2jXGud7B9IrkEXIkwhkPuYKxIbRYdBz0lWUnOJ9OuardZ6Gx/8s3A/v0MTSOCiVb9Cpgv7tzx3DeVA+mGmr5VK2v7L1f2DQIDAQAB; n=1024,1453252169,1
selector2:: —
mxvault:: —

fetched 2026-05-23T09:21:23.134Z

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

cert valid for 109 days

Why it matters: A valid current TLS certificate is the baseline for data in transit. Expiry, weak chain, or hostname mismatch break HTTPS and fail PCI 4.2.1 / SOC 2 CC6.1.

subject cn:: *.workday.com
issuer:: DigiCert Global G2 TLS RSA SHA256 2020 CA1 / DigiCert Inc
valid:: Feb 23 00:00:00 2026 GMT → Sep 9 23:59:59 2026 GMT
authorized:: yes
sha256:: C1:F6:58:7B:9C:3C:AF:22:E0:22:62:09:56:FE:EE:7C:66:BB:EC:4B:C4:1E:21:7B:3E:C1:6E:4F:10:D1:0E:B4
sans: *.workday.com
workday.com

fetched 2026-05-23T09:21:23.286Z

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

HTTPS served correctly

Why it matters: Bare HTTP requests must redirect to HTTPS without dropping the user mid-chain. Plain-text fallback or open redirects fail PCI 4.2.1 and feed phishing chains (SOC 2 CC6.6).

final status: 200 · 2 hops

[301] https://workday.com/
[200] https://www.workday.com/

fetched 2026-05-23T09:21:23.382Z

redirects

info

Open standalone →

tracing redirects…

headers

low

Open standalone →

3 security header(s) missing

Why it matters: Security headers — HSTS, CSP, X-Frame-Options, Referrer-Policy — defend against XSS, clickjacking, and downgrade attacks. Absent headers map directly to OWASP ASVS V14 findings (ISO 27001 A.8.23).

Recommendations

Add response header — Content-Security-Policy: default-src 'self' (tune per app)
Add response header — Referrer-Policy: strict-origin-when-cross-origin
Add permissions-policy response header

final url: https://www.workday.com/

security headers

strict-transport-security: max-age=31536000; includeSubDomains, max-age=0
content-security-policy: —
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
referrer-policy: —
permissions-policy: —

other headers

accept-ranges: bytes
access-control-allow-origin: https://forms.workday.com
age: 13897
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
connection: keep-alive
content-encoding: gzip
content-length: 33415
content-type: text/html;charset=utf-8
date: Sat, 23 May 2026 05:29:46 GMT
expires: Sat, 23 May 2026 05:29:46 GMT
pragma: no-cache
server: Apache
set-cookie: client-country=US; domain=workday.com; path=/
vary: Accept-Encoding
via: 1.1 75171afe872c03bf51fccd69b0862020.cloudfront.net (CloudFront)
x-amz-cf-id: WyaVa-Yags15_zXRiJGh7srQW-bFZ9UEmAlCvxJ5qAArAN9EsonJ8A==
x-amz-cf-pop: IAD55-P10
x-cache: Hit from cloudfront

fetched 2026-05-23T09:21:23.386Z

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

no CORS headers — cross-origin requests blocked by default

Why it matters: Overly permissive CORS (wildcard with credentials, or reflected origin) lets any origin read authenticated responses from this domain. OWASP A05 misconfiguration territory (NIST AC-4).

origin: https://drwho.me
method: GET
preflight status: 301

access-control-* headers

access-control-allow-origin: —
access-control-allow-methods: —
access-control-allow-headers: —
access-control-allow-credentials: —
access-control-max-age: —
access-control-expose-headers: —

no access-control-* headers returned — site does not advertise CORS to this origin

fetched 2026-05-23T09:21:23.322Z

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

HTTPS surface reachable (robots ✓, sitemap ✗, title ✓)

Why it matters: Public files — robots.txt, sitemap.xml, head meta — are what attackers see first during reconnaissance. Misadvertised paths, stale sitemaps, and verbose generators leak more than intended (ISO 27001 A.8.9).

robots.txt

present

User-agent: *
Allow: /*.html$
Disallow: /*/data/*
Disallow: *.dl.html
Disallow: /content/dam/web/en-us/documents/case-studies/*.pdf$
Disallow: /content/dam/web/en-us/documents/whitepapers/*.pdf$
Disallow: /content/dam/web/en-us/documents/reports/*.pdf$
Disallow: /content/dam/web/en-us/documents/other/*.pdf$
Disallow: /content/dam/web/en-us/documents/legal/*.pdf$
Disallow: /content/dam/web/en-us/documents/privacy/*.pdf$
Disallow: /content/dam/web/uk/documents/case-studies/*.pdf$
Disallow: /content/dam/web/uk/documents/whitepapers/*.pdf$
Disallow: /content/dam/web/uk/documents/reports/*.pdf$
Disallow: /content/dam/web/uk/documents/other/*.pdf$
Disallow: /content/dam/web/hk/documents/whitepapers/*.pdf$
Disallow: /content/dam/web/hk/documents/reports/*.pdf$
Disallow: /content/dam/web/hk/documents/other/*.pdf$
Disallow: /content/dam/web/hk/documents/case-studies/*.pdf$
Disallow: /content/dam/web/fr/documents/whitepapers/*.pdf$
Disallow: /content/dam/web/fr/documents/reports/*.pdf$
Disallow: /content/dam/web/fr/documents/other/*.pdf$
Disallow: /content/dam/web/nl/documents/whitepapers/*.pdf$
Disallow: /content/dam/web/nl/documents/reports/*.pdf$
Disallow: /content/dam/web/nl/documents/other/*.pdf$
Disallow: /content/dam/web/nl/documents/case-studies/*.pdf$
Disallow: /content/dam/web/au/documents/whitepapers/*.pdf$
Disallow: /content/dam/web/au/documents/reports/*.pdf$
Disallow: /content/dam/web/au/documents/other/*.pdf$
Disallow: /content/dam/web/au/documents/case-studies/*.pdf$
Disallow: /content/dam/web/za/documents/whitepapers/*.pdf$
Disallow: /content/dam/web/za/documents/reports/*.pdf$
Disallow: /content/dam/web/za/documents/other/*.pdf$
Disallow: /content/dam/web/za/documents/case-studies/*.pdf$
Disallow: /content/dam/web/za/documents/ebooks/world-of-work-employee-experience-ebook-enza.pdf
Disallow: /content/dam/web/se/documents/whitepapers/*.pdf$
Disallow: /content/dam/web/se/documents/reports/*.pdf$
Disallow: /content/dam/web/se/documents/other/*.pdf$
Disallow: /content/dam/web/se/documents/case-studies/*.pdf$
Disallow: /content/dam/web/se/documents/ebooks/world-of-work-employee-experience-ebook-ense.pdf
Disallow: /content/dam/web/se/documents/ebooks/emea-eim-ochro-promo-why-workday-hcm-is-different-ebook-and-landing-page-ebook-final-v1-en-SE%20(2).pdf
Disallow: /content/dam/web/ca/documents/whitepapers/*.pdf$
Disallow: /content/dam/web/ca/documents/reports/*.pdf$
Disallow: /content/dam/web/ca/documents/other/*.pdf$
Disallow: /content/dam/web/ca/documents/case-studies/*.pdf$
Disallow: /content/dam/web/de/documents/whitepapers/*.pdf$
Disallow: /content/dam/web/de/documents/reports/*.pdf$
Disallow: /content/dam/web/de/documents/other/*.pdf$
Disallow: /content/dam/web/es/documents/whitepapers/*.pdf$
Disallow: /content/dam/web/es/documents/reports/*.pdf$
Disallow: /content/dam/web/es/documents/other/*.pdf$
Disallow: /content/dam/web/es/documents/case-studies/*.pdf$
Disallow: /content/dam/web/ko/documents/whitepapers/*.pdf$
Disallow: /content/dam/web/ko/documents/reports/*.pdf$
Disallow: /content/dam/web/ko/documents/other/*.pdf$
Disallow: /content/dam/web/ko/documents/case-studies/*.pdf$
Disallow: /content/dam/web/ja/documents/whitepapers/*.pdf$
Disallow: /content/dam/web/ja/documents/reports/*.pdf$
Disallow: /content/dam/web/ja/documents/other/*.pdf$
Disallow: /content/dam/web/sg/documents/whitepapers/*.pdf$
Disallow: /content/dam/web/sg/documents/reports/*.pdf$
Disallow: /content/dam/web/sg/documents/other/*.pdf$
Disallow: /content/dam/web/sg/documents/case-studies/*.pdf$
Disallow: /content/dam/web/it/documents/case-studies/*.pdf$
Disallow: /content/dam/web/mx/documents/case-studies/*.pdf$
Disallow: /content/dam/web/en-us/documents/case-studies/*.pdf$
Disallow: /content/dam/web/be/documents/whitepapers/*.pdf$
Disallow: /content/dam/web/be/documents/reports/*.pdf$
Disallow: /content/dam/web/be/documents/other/*.pdf$
Disallow: /content/dam/web/be/documents/legal/*.pdf$
Disallow: /content/dam/web/be/documents/privacy/*.pdf$
Disallow: /*?refCamp=
Disallow

sitemap.xml

absent

head

title: The Enterprise AI Platform for HR, Finance, and IT | Workday
description: Superintelligence for work is here. Empower your people with AI agents that understand your organization. It’s a new work day.

social

og:title: The Enterprise AI Platform for HR, Finance, and IT | Workday
og:description: Superintelligence for work is here. Empower your people with agentic AI.
og:image: https://www.workday.com/content/dam/web/en-us/images/social/workday-og-theme.png
og:image:alt: Workday Logo
og:image:width: 1200
og:image:height: 640
twitter:site: @Workday
twitter:creator: @Workday
twitter:card: summary_large_image
twitter:title: The Enterprise AI Platform for HR, Finance, and IT | Workday
twitter:description: Superintelligence for work is here. Empower your people with agentic AI.
twitter:url: https://www.workday.com
twitter:image: https://www.workday.com/content/dam/web/en-us/images/social/workday-og-theme.png
twitter:image:alt: Workday Logo

fetched 2026-05-23T09:21:23.539Z

web-surface

info

Open standalone →

inspecting web surface…

dnssec

low

Open standalone →

DNSSEC not configured — no DS or DNSKEY records found

Why it matters: DNSSEC cryptographically signs DNS responses, blocking cache-poisoning attacks. US federal civilian agencies are required to enable it under OMB M-22-09 (NIST SC-20).

Recommendations

Enable DNSSEC in your DNS provider's control panel and add the resulting DS record at your registrar

enabled: no
DS records: —
DNSKEY records: —

fetched 2026-05-23T09:21:23.139Z

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

not applicable: no _mta-sts TXT record

Why it matters: MTA-STS forces inbound SMTP to use TLS and refuse downgraded connections. Without it, an in-path attacker can strip TLS and read mail in plaintext (SOC 2 CC6.7).

no _mta-sts TXT record

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

not applicable: no TLSRPT record

Why it matters: TLS-RPT publishes a reporting address for SMTP-TLS failures. Without it, downgrade attacks on inbound mail go unnoticed (SOC 2 CC7.2).

no TLSRPT record

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

domain registered until 2026-09-13

Why it matters: Registrar and expiry tell auditors the domain is owned, current, and not about to lapse. An expired or about-to-expire domain fails business-continuity evidence (SOC 2 A1.2).

registrar: MarkMonitor Inc.
created: 2001-09-13T22:12:07Z
expires: 2026-09-13T22:12:07Z
statuses: clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited, clientTransferProhibited https://icann.org/epp#clientTransferProhibited, clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited, serverDeleteProhibited https://icann.org/epp#serverDeleteProhibited, serverTransferProhibited https://icann.org/epp#serverTransferProhibited, serverUpdateProhibited https://icann.org/epp#serverUpdateProhibited

fetched 2026-05-23T09:21:23.442Z

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

check failed: crt.sh: Error: crt.sh http 502; certspotter: Error: certspotter http 429

Why it matters: Every certificate issued for this domain is published in Certificate Transparency logs — including subdomains you may have forgotten. Unknown subdomains in CT are pre-disclosed attack surface (ISO 27001 A.8.16).

crt.sh: Error: crt.sh http 502; certspotter: Error: certspotter http 429

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.