adobe.com

An authorized sender list is defined and mail from other servers is rejected.

Valid SPF record with -all. 3 of the 10 allowed DNS lookups.

v=spf1 exists:%{i}._i.%{d}._d.espf.agari.com include:%{d}.55.spf-protect.agari.com include:_spf.intacct.com IP4:172.193.27.96 -all

$ dig +short TXT adobe.com

Forged email in the company's name is blocked by mail servers.

Policy p=reject.

v=DMARC1; p=reject; sp=reject; pct=100; rua=mailto:adobe@rua.agari.com; ruf=mailto:adobe@ruf.agari.com; fo=1

$ dig +short TXT _dmarc.adobe.com

A DKIM public key is published. On its own this doesn't prove outgoing mail is signed or aligned with your From domain.

DKIM public key found for selector: google, selector2, default, k1, s1, s2. Confirm signing with dkim=pass in a sent message's Authentication-Results.

google._domainkey: v=DKIM1;k=rsa;p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAiVEIHhmG6ZUeUOgabJUCHmtHSZC2hk…
selector2._domainkey: v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDZKv7DDaVLGXKWmz8rmfEPpTk48dX71OCW…
default._domainkey: v=DKIM1;h=sha256;k=rsa;p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAz1FVDOjxJxBL/vH0j/veO…
k1._domainkey: k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDbNrX2cY/GUKIFx2G/1I00ftdAj713WP9AQ1xir85i8…
s1._domainkey: k=rsa; t=s; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEApZPxcNcHYvvA22w6x7HbdKpIjlh+UtGT…
s2._domainkey: k=rsa; t=s; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCyLNopWCdax1IhwHI5Z8YFFg9tCN7V9LltTMLH…

$ dig +short TXT google._domainkey.adobe.com

Mail exchangers are published for the domain.

2 MX record(s). This shows where inbound mail is routed, not whether mail is sent from the domain.

2 adobe.mail.protection.outlook.com
1 adobe-com.mail.protection.outlook.com

$ dig +short MX adobe.com

The site loads over an encrypted connection.

https://adobe.com/ returned HTTP 403 (final URL: https://www.adobe.com/). Client-side certificate validation passed.

HTTP 403
Final URL: https://www.adobe.com/

$ curl -sIL https://adobe.com/

Visitors arriving at an unencrypted address are automatically sent to the secure version.

HTTP 301 → https://adobe.com/

HTTP 301
Location: https://adobe.com/

$ curl -sI http://adobe.com/ | grep -iE "^(HTTP|location)"

The certificate was accepted by a validating TLS client at scan time.

Live TLS handshake succeeded. Latest issuance in CT logs: DigiCert, expiring 2027-05-23 (189 days). CT shows issued certificates, not necessarily the one served — confirm dates with the verify command.

Live TLS handshake: certificate accepted
CT logs (context only, not scored):
Issuer: DigiCert
Valid from: 2026-11-06
Valid until: 2027-05-23
Names: *.adobe.com, adobe.com
Based on Certificate Transparency logs; may not reflect the certificate currently served.

$ echo | openssl s_client -connect adobe.com:443 -servername adobe.com 2>/dev/null | openssl x509 -noout -issuer -dates

Browsers are told to always use an encrypted connection to the site.

max-age=15768000 (183 days), no includeSubDomains. ≥ 180 days recommended.

Strict-Transport-Security: max-age=15768000

$ curl -sIL https://adobe.com/ | grep -i "Strict-Transport-Security"

Missing Content-Security-Policy header: this removes one layer of protection against script injection.

No Content-Security-Policy header found.

Content-Security-Policy: (missing)

$ curl -sIL https://adobe.com/ | grep -i "Content-Security-Policy"

/*
  Content-Security-Policy-Report-Only: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'

Missing X-Frame-Options / frame-ancestors: this removes one layer of protection against clickjacking.

No valid X-Frame-Options and no frame-ancestors in the CSP.

X-Frame-Options: (missing)

$ curl -sIL https://adobe.com/ | grep -i "X-Frame-Options"

/*
  X-Frame-Options: SAMEORIGIN

The browser may interpret files as code unintentionally.

Missing X-Content-Type-Options: nosniff header (MIME sniffing).

X-Content-Type-Options: (missing)

$ curl -sIL https://adobe.com/ | grep -i "X-Content-Type-Options"

/*
  X-Content-Type-Options: nosniff

Internal URLs (including parameters) may leak to external sites.

Referrer-Policy is missing; the browser will use its default.

Referrer-Policy: (missing)

$ curl -sIL https://adobe.com/ | grep -i "Referrer-Policy"

/*
  Referrer-Policy: strict-origin-when-cross-origin

Access to sensitive features like the camera and location isn't restricted.

Missing Permissions-Policy header.

Permissions-Policy: (missing)

$ curl -sIL https://adobe.com/ | grep -i "Permissions-Policy"

/*
  Permissions-Policy: camera=(), microphone=(), geolocation=()

The server doesn't disclose software versions.

No version numbers found in the Server / X-Powered-By headers.

server: cloudflare
x-powered-by: (missing)

$ curl -sIL https://adobe.com/ | grep -iE "^(server|x-powered-by)"

The domain's records aren't signed, so in some scenarios users could be redirected to a forged server.

No DS record is published at the parent zone, so there's no DNSSEC chain of trust for this zone.

AD = false
DS adobe.com: NODATA

$ dig +short DS adobe.com

dig +dnssec adobe.com SOA
delv adobe.com

Any certificate authority can issue a certificate for the domain, raising the risk of mis-issuance.

No CAA records found. RFC 8659 lets the domain owner restrict which CAs are authorized.

(no CAA records found)

$ dig +short CAA adobe.com

adobe.com.  CAA  0 issue "letsencrypt.org"
adobe.com.  CAA  0 iodef "mailto:security@adobe.com"

The domain is served by several DNS servers, so one server failing won't take it down.

6 NS servers.

a28-67.akam.net
a13-65.akam.net
a26-66.akam.net
a1-217.akam.net
a10-64.akam.net
a7-64.akam.net

$ dig +short NS adobe.com