zeit.de

15-check dossier · scoreboard above, section details below

Get a pack →

Scanning…

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

resolving mx…

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

resolving dmarc…

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

tracing redirects…

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

inspecting web surface…

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.

zeit.de

15-check dossier · scoreboard above, section details below

Get a pack →

C+

6 items need attention

Aggregate grade across 15 checks. Auditors typically flag any High-severity finding.

Pass: 9
Warn: 6
Fail: 0

What an auditor would flag first

medium
SPF
~all softfail — receivers may still accept
SOC 2 CC6.7ISO 27001 A.13.2.1
medium
DMARC
p=none — monitoring only, no enforcement
SOC 2 CC6.7ISO 27001 A.13.2.1
medium

Scanning…

dns

info

Open standalone →

A/AAAA records present

Why it matters: Without authoritative A or AAAA records on the apex, the domain is unreachable. Missing baseline DNS shows up in vendor reviews as evidence of unmanaged infrastructure (SOC 2 CC6.6).

A: ttl=600 34.89.229.115
AAAA: —
NS: ttl=300 dns1.p01.nsone.net.
ttl=300 dns2.p01.nsone.net.
ttl=300 dns3.p01.nsone.net.
ttl=300 dns4.p01.nsone.net.
SOA: ttl=3600 dns1.p01.nsone.net. administrator.zeit.de. 1637605899 43200 7200 1209600 300
CAA: —
TXT: ttl=1800 "1password-site-verification=76KQ3OKJ3FH35OMHXYMAINGJ5Q"
ttl=1800 "3j98x7j4yjf2xvtw6gt4rt8yjn117l3x"
ttl=1800 "5F0-8UN-VT6"
ttl=1800 "MS=ms15247335"
ttl=1800 "MS=ms37100824"
ttl=1800 "P2A_58148_200"
ttl=1800 "_globalsign-domain-verification=Fw09cFhmPL_-Bfg6BV5_NkyDEkXJfmQd4uPViX560A"
ttl=1800 "a8e28041862668f7d799dcf2cdff2f75"
ttl=1800 "adobe-idp-site-verification=23219eabc0a82ab7eca544a45515b433090e77f559461941395be62189f6d8f0"
ttl=1800 "adobe-idp-site-verification=9204c69a-b8c5-4286-a6d5-6c3259f8cf1d"
ttl=1800 "apple-domain-verification=TYlrXCrrWPMzHzAY"
ttl=1800 "asv=128b0bc0702196cf36653421800e6808"
ttl=1800 "atlassian-domain-verification=0KXQ/HyHlWaW2LeS2kKh/QYjoZkk7smirpVo/Q1IPHetkLFv/eN7OwNE/FKNVMh7"
ttl=1800 "atlassian-domain-verification=1ImdxQwjaBPB5dXgPBYl2HIs9t45uAqjWHxPe2aKn2aKCTUXGuf3HXbG5vYm2959"
ttl=1800 "canva-site-verification=HGiDOMp4J0OMWIO_vX2irg"
ttl=1800 "elevenlabs=AkVMNw8U-sHd65pGypKEoqiMEsmMhUooL9FJ4TyUgaQ"
ttl=1800 "figma-domain-verification=5e6d24ca5cac9fbcdad302605f2185d9a7fef03e17170672f424d334b70a949b-1768473624"
ttl=1800 "google-gws-recovery-domain-verification=59065683"
ttl=1800 "google-site-verification=tLw22x4l0DHcYxy-T7rQxtbQp2bh3_GJ6vAeRXJQEAw"
ttl=1800 "gxg1t2ljzzj4n05h57kh5bvsxjr1ctcp"
ttl=1800 "jamf-site-verification=qlf_TOpLdeS2DNRMndJxIA"
ttl=1800 "klaviyo-site-verification=VfVpZ3"
ttl=1800 "mgverify=fa8deab5e1cdad1afca895f77cb4460493457c695b1b6b0bccc40a8732f882da"
ttl=1800 "miro-verification=00f74b9596272eaafb51a7d481892788837e487b"
ttl=1800 "mxI8RUm6rfKEWT0c"
ttl=1800 "pardot1088002=2b9a0e203820f4740ccc144cc3a5c523f49f60334cd030c6b87aac23cf9ef02e"
ttl=1800 "smeazeit.sbc1.getdirectrouting.de"
ttl=1800 "smeazeit.sbc2.getdirectrouting.de"
ttl=1800 "teamviewer-sso-verification=0da1e5ee3dc04351aa206dff020cda50"
ttl=1800 "tollbit-domain-verification=0acc441095133f12278c9179168937ecd19b3f5c9b36b930acac5d3a96353c14"
ttl=1800 "v=spf1 mx include:spf1.zeit.de include:spf.mailjet.com include:sendgrid.net include:spf.mandrillapp.com include:spfa.myconvento.com include:spf.protection.outlook.com ~all"

fetched 2026-05-23T09:23:38.243Z

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

1 MX record(s) present

Why it matters: MX records direct inbound mail. Misconfiguration silently breaks email delivery and lets attackers stand up parallel MX hosts for spoofing campaigns (ISO 27001 A.8.21).

pri=10 zeit-de.mail.protection.outlook.com.

fetched 2026-05-23T09:23:38.242Z

mx

info

Open standalone →

resolving mx…

spf

medium

Open standalone →

~all softfail — receivers may still accept

Why it matters: SPF tells receiving servers which hosts may send mail for the domain. Without it, any sender can forge the envelope-from — the primary mechanism behind business-email-compromise (SOC 2 CC6.7).

Recommendations

Move to -all (hardfail) once your mail flow is confirmed — softfail gives no real protection

v=spf1 mx include:spf1.zeit.de include:spf.mailjet.com include:sendgrid.net include:spf.mandrillapp.com include:spfa.myconvento.com include:spf.protection.outlook.com ~all

v=spf1
mx
include:spf1.zeit.de
include:spf.mailjet.com
include:sendgrid.net
include:spf.mandrillapp.com
include:spfa.myconvento.com
include:spf.protection.outlook.com
~all

fetched 2026-05-23T09:23:38.244Z

spf

info

Open standalone →

resolving spf…

dmarc

medium

Open standalone →

p=none — monitoring only, no enforcement

Why it matters: DMARC binds SPF and DKIM into an enforceable policy (quarantine or reject) and surfaces spoofing attempts via aggregate reports. `p=none` or absent means spoofing succeeds silently (SOC 2 CC6.7).

Recommendations

Review rua= aggregate reports to confirm legitimate mail passes SPF/DKIM
Move to p=quarantine and then p=reject once mail flow is validated

v=DMARC1; p=none;

v=: DMARC1
p=: none

fetched 2026-05-23T09:23:38.241Z

dmarc

info

Open standalone →

resolving dmarc…

dkim

low

Open standalone →

2/6 DKIM selectors valid

Why it matters: DKIM signs outbound mail so receivers can detect tampering. Missing selectors or rotated-away keys break DMARC alignment and let receivers downgrade trust (ISO 27001 A.8.24).

Recommendations

Check the missing selectors in your DNS provider and re-add any removed records

default:: —
google:: —
k1:: —
selector1:: v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDWkMFDKwZBvshkeuB8TjonJHSxF30DwH7o8lwsMVS79H/ZB9NjFAvNWj3oukeBMxB4PdCW0RB2wMmx7ZULqykcY/9RLzueC242llCgRqyTsqunmjFuZF+qUFnI0r5BYcVmj6WQTmIF5mN8+6imraFEhUKCX2Q6lle2lisTzItowQIDAQAB;
selector2:: v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCgNIVNxN1A64olzYP68b/XmRWsxmJcJfjts3tWoeWveX6w+e/bwI884+kojsZ/J/X1cQJTeXRqEdlG4eVm1YG5R+GrFtStiAndcCViq+ixx1tK2NURM4mw8bIjq+ZOEOEVh24TREO1wB6nJMi00f0DcCuoK+qeeIYH8QlrjoJT/QIDAQAB;
mxvault:: —

fetched 2026-05-23T09:23:38.247Z

dkim

info

Open standalone →

probing dkim selectors…

tls

low

Open standalone →

cert expires in 44 days

Why it matters: A valid current TLS certificate is the baseline for data in transit. Expiry, weak chain, or hostname mismatch break HTTPS and fail PCI 4.2.1 / SOC 2 CC6.1.

Recommendations

Schedule certificate renewal — consider enabling auto-renewal

subject cn:: zeit.de
issuer:: R12 / Let's Encrypt
valid:: Apr 8 07:11:05 2026 GMT → Jul 7 07:11:04 2026 GMT
authorized:: yes
sha256:: 7F:12:A5:A9:15:19:BA:36:BA:96:1E:C5:7F:6D:79:F5:A0:DE:89:80:89:5B:61:19:55:42:6E:1C:3A:86:5A:61
sans: zeit.de

fetched 2026-05-23T09:23:38.420Z

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

HTTPS served correctly

Why it matters: Bare HTTP requests must redirect to HTTPS without dropping the user mid-chain. Plain-text fallback or open redirects fail PCI 4.2.1 and feed phishing chains (SOC 2 CC6.6).

final status: 200 · 2 hops

[301] https://zeit.de/
[200] https://www.zeit.de/index

fetched 2026-05-23T09:23:38.876Z

redirects

info

Open standalone →

tracing redirects…

headers

medium

Open standalone →

5 security header(s) missing

Why it matters: Security headers — HSTS, CSP, X-Frame-Options, Referrer-Policy — defend against XSS, clickjacking, and downgrade attacks. Absent headers map directly to OWASP ASVS V14 findings (ISO 27001 A.8.23).

Recommendations

Add response header — Strict-Transport-Security: max-age=15552000; includeSubDomains
Add response header — X-Frame-Options: DENY (or SAMEORIGIN if framing is intended)
Add response header — X-Content-Type-Options: nosniff
Add response header — Referrer-Policy: strict-origin-when-cross-origin
Add permissions-policy response header

final url: https://www.zeit.de/index

security headers

strict-transport-security: —
content-security-policy: upgrade-insecure-requests;
x-frame-options: —
x-content-type-options: —
referrer-policy: —
permissions-policy: —

other headers

accept-ranges: none
cache-control: max-age=0, must-revalidate, no-cache, no-store
connection: keep-alive
content-encoding: br
content-type: text/html; charset=UTF-8
date: Sat, 23 May 2026 09:23:38 GMT
expires: Sat, 23 May 2026 09:20:37 GMT
last-modified: Sat, 23 May 2026 09:20:37 GMT
pragma: no-cache
set-cookie: creid=1865970580718268523; expires=Thu, 31-Dec-37 23:55:55 GMT; domain=.zeit.de; path=/; SameSite=Lax; Secure
transfer-encoding: chunked
vary: accept-encoding, user-agent
x-served-by: cache-iad-kcgs7200170-IAD

fetched 2026-05-23T09:23:38.692Z

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

no CORS headers — cross-origin requests blocked by default

Why it matters: Overly permissive CORS (wildcard with credentials, or reflected origin) lets any origin read authenticated responses from this domain. OWASP A05 misconfiguration territory (NIST AC-4).

origin: https://drwho.me
method: GET
preflight status: 301

access-control-* headers

access-control-allow-origin: —
access-control-allow-methods: —
access-control-allow-headers: —
access-control-allow-credentials: —
access-control-max-age: —
access-control-expose-headers: —

no access-control-* headers returned — site does not advertise CORS to this origin

fetched 2026-05-23T09:23:38.522Z

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

HTTPS surface reachable (robots ✓, sitemap ✓, title ✓)

Why it matters: Public files — robots.txt, sitemap.xml, head meta — are what attackers see first during reconnaissance. Misadvertised paths, stale sitemaps, and verbose generators leak more than intended (ISO 27001 A.8.9).

robots.txt

present

User-agent: Googlebot-News
Disallow: /angebote/

User-agent: *
Disallow: /zeit/
Disallow: /templates/
Disallow: /hp_channels/
Disallow: /send/
Disallow: /rezepte/suche/
Disallow: */comment-thread?
Disallow: */liveblog-backend*
Disallow: /framebuilder/
Disallow: /campus/framebuilder/
Disallow: /navigation-teasers*
Disallow: *iqadcontroller.js
Allow: /llms.txt

User-agent: Baiduspider
Disallow: /

User-agent: GrapeshotCrawler
crawl-delay: 3

User-agent: GPTBot
Disallow: /

User-agent: Google-Extended
Disallow: /
Allow: /*-gxe$

User-agent: Applebot-Extended
Disallow: /

User-agent: CCBot
Disallow: /

User-agent: Bytespider
Disallow: /

User-agent: anthropic-ai
Disallow: /

User-agent: ClaudeBot
Disallow: /

User-agent: Timpibot
Disallow: /

User-agent: Meta-ExternalAgent
Disallow: /

User-agent: FacebookBot
Disallow: /

User-agent: Diffbot
Disallow: /

User-agent: PerplexityBot
Disallow: /

User-agent: Perplexity-User
Disallow: /

User-agent: TerraCotta
Disallow: /

Sitemap: https://www.zeit.de/gsitemaps/index.xml

# Legal notice: zeit.de expressly reserves the right to use its content for commercial text and data mining (§ 44 b UrhG).
# The use of robots or other automated means to access zeit.de or collect or mine data without
# the express permission of zeit.de is strictly prohibited.
# zeit.de may, in its discretion, permit certain automated access to certain zeit.de pages,
# If you would like to apply for permission to crawl zeit.de, collect or use data, please email online-syndication@zeit.de

sitemap.xml

present — 512 url(s)

head

title: DIE ZEIT | Nachrichten, News, Hintergründe und Debatten
description: Aktuelle Nachrichten, Kommentare, Analysen und Hintergrundberichte aus Politik, Wirtschaft, Gesellschaft, Wissen, Feuilleton und Sport lesen Sie bei der ZEIT.

social

og:image: https://img.zeit.de/administratives/sharing/fallback-image-die-zeit/wide__1300x731
og:image:width: 1300
og:image:height: 731
og:site_name: DIE ZEIT
og:type: website
og:title: DIE ZEIT Startseite
og:description: Aktuelle Nachrichten, Kommentare, Analysen und Hintergrundberichte aus Politik, Wirtschaft, Gesellschaft, Wissen, Feuilleton und Sport lesen Sie bei der ZEIT.
og:url: https://www.zeit.de/index
twitter:card: summary
twitter:site: @zeitonline
twitter:creator: @zeitonline
twitter:title: DIE ZEIT Startseite
twitter:description: Aktuelle Nachrichten, Kommentare, Analysen und Hintergrundberichte aus Politik, Wirtschaft, Gesellschaft, Wissen, Feuilleton und Sport lesen Sie bei der ZEIT.
twitter:image: https://img.zeit.de/administratives/sharing/fallback-image-die-zeit/wide__1300x731

fetched 2026-05-23T09:23:38.939Z

web-surface

info

Open standalone →

inspecting web surface…

dnssec

low

Open standalone →

DNSSEC not configured — no DS or DNSKEY records found

Why it matters: DNSSEC cryptographically signs DNS responses, blocking cache-poisoning attacks. US federal civilian agencies are required to enable it under OMB M-22-09 (NIST SC-20).

Recommendations

Enable DNSSEC in your DNS provider's control panel and add the resulting DS record at your registrar

enabled: no
DS records: —
DNSKEY records: —

fetched 2026-05-23T09:23:38.247Z

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

not applicable: no _mta-sts TXT record

Why it matters: MTA-STS forces inbound SMTP to use TLS and refuse downgraded connections. Without it, an in-path attacker can strip TLS and read mail in plaintext (SOC 2 CC6.7).

no _mta-sts TXT record

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

not applicable: no TLSRPT record

Why it matters: TLS-RPT publishes a reporting address for SMTP-TLS failures. Without it, downgrade attacks on inbound mail go unnoticed (SOC 2 CC7.2).

no TLSRPT record

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

not applicable: whois returned no data and RDAP fallback unavailable (registry refused or unmapped TLD)

Why it matters: Registrar and expiry tell auditors the domain is owned, current, and not about to lapse. An expired or about-to-expire domain fails business-continuity evidence (SOC 2 A1.2).

whois returned no data and RDAP fallback unavailable (registry refused or unmapped TLD)

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

check failed: crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

Why it matters: Every certificate issued for this domain is published in Certificate Transparency logs — including subdomains you may have forgotten. Unknown subdomains in CT are pre-disclosed attack surface (ISO 27001 A.8.16).

crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.