amazon.com

An authorized sender list is defined and mail from other servers is rejected.

Valid SPF record with -all. 3 of the 10 allowed DNS lookups.

v=spf1 include:spf1.amazon.com include:spf2.amazon.com include:amazonses.com -all

$ dig +short TXT amazon.com

Forged email in the company's name is sent to the spam folder.

Policy p=quarantine. p=quarantine — consider moving to p=reject.

v=DMARC1;p=quarantine;pct=100;rua=mailto:report@dmarc.amazon.com;ruf=mailto:report@dmarc.amazon.com

$ dig +short TXT _dmarc.amazon.com

No DKIM key was found under the common selectors we probed. That doesn't mean DKIM is missing — selectors can't be listed from public DNS. Not scored.

A missing name for a probed selector (NXDOMAIN/NODATA) only means that selector isn't published. DKIM is marked unverified and excluded from the score. Check a sent message's Authentication-Results for dkim=pass and its s= selector.

Selectors checked: google, selector1, selector2, default, k1, s1, s2, dkim, mail, smtp — no key found
google._domainkey: nxdomain
selector1._domainkey: nxdomain
selector2._domainkey: nxdomain
default._domainkey: nxdomain
k1._domainkey: nxdomain
s1._domainkey: nxdomain
s2._domainkey: nxdomain
dkim._domainkey: nxdomain
mail._domainkey: nxdomain
smtp._domainkey: nxdomain

$ dig +short TXT google._domainkey.amazon.com

Mail exchangers are published for the domain.

1 MX record(s). This shows where inbound mail is routed, not whether mail is sent from the domain.

5 amazon-smtp.amazon.com

$ dig +short MX amazon.com

The site loads over an encrypted connection.

https://amazon.com/ returned HTTP 200 (final URL: https://www.amazon.com/). Client-side certificate validation passed.

HTTP 200
Final URL: https://www.amazon.com/

$ curl -sIL https://amazon.com/

Visitors arriving at an unencrypted address are automatically sent to the secure version.

HTTP 301 → https://amazon.com/

HTTP 301
Location: https://amazon.com/

$ curl -sI http://amazon.com/ | grep -iE "^(HTTP|location)"

The certificate was accepted by a validating TLS client at scan time.

Live TLS handshake succeeded. Latest issuance in CT logs: DigiCert, expiring 2027-01-23 (69 days). CT shows issued certificates, not necessarily the one served — confirm dates with the verify command.

Live TLS handshake: certificate accepted
CT logs (context only, not scored):
Issuer: DigiCert
Valid from: 2026-02-02
Valid until: 2027-01-23
Names: *.aa.peg.a2z.com, *.ab.peg.a2z.com, *.ac.peg.a2z.com, *.bz.peg.a2z.com, *.peg.a2z.com, amazon.co.jp
Based on Certificate Transparency logs; may not reflect the certificate currently served.

$ echo | openssl s_client -connect amazon.com:443 -servername amazon.com 2>/dev/null | openssl x509 -noout -issuer -dates

Browsers are told to always use an encrypted connection to the site.

max-age=47474747 (549 days), includeSubDomains, preload. ≥ 180 days recommended.

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload

$ curl -sIL https://amazon.com/ | grep -i "Strict-Transport-Security"

A script policy exists, but it's permissive and offers only partial protection.

script-src includes: no script-src/default-src — weakens XSS protection.

Content-Security-Policy: upgrade-insecure-requests;report-uri https://metrics.media-amazon.com/

$ curl -sIL https://amazon.com/ | grep -i "Content-Security-Policy"

/*
  Content-Security-Policy-Report-Only: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'

The site can't be embedded by foreign sites.

X-Frame-Options: SAMEORIGIN

X-Frame-Options: SAMEORIGIN

$ curl -sIL https://amazon.com/ | grep -i "X-Frame-Options"

The browser won't guess file types in a way that could execute code.

nosniff is set.

X-Content-Type-Options: nosniff

$ curl -sIL https://amazon.com/ | grep -i "X-Content-Type-Options"

Internal URLs (including parameters) may leak to external sites.

Referrer-Policy is missing; the browser will use its default.

Referrer-Policy: (missing)

$ curl -sIL https://amazon.com/ | grep -i "Referrer-Policy"

/*
  Referrer-Policy: strict-origin-when-cross-origin

The site restricts access to sensitive browser features.

Permissions-Policy: ch-dpr=(self "https://m.media-amazon.com" "https://images-na.ssl-images-amazon.com"), ch-viewport-width=(self "https://m.media-amazon.com" "https://images-na.ss

Permissions-Policy: ch-dpr=(self "https://m.media-amazon.com" "https://images-na.ssl-images-amazon.com"), ch-viewport-width=(self "https://m.media-amazon.com" "https://images-na.ssl-images-amazon.com"), ch-downlink=(self "https://m.media-amazon.com" "https://images-na.ssl-images-amazon.com"), ch-ect=(self "https://m.media-amazon.com" "https://images-na.ssl-images-amazon.com")

$ curl -sIL https://amazon.com/ | grep -i "Permissions-Policy"

The server doesn't disclose software versions.

No version numbers found in the Server / X-Powered-By headers.

server: cloudflare
x-powered-by: (missing)

$ curl -sIL https://amazon.com/ | grep -iE "^(server|x-powered-by)"

The domain's records aren't signed, so in some scenarios users could be redirected to a forged server.

No DS record is published at the parent zone, so there's no DNSSEC chain of trust for this zone.

AD = false
DS amazon.com: NODATA

$ dig +short DS amazon.com

dig +dnssec amazon.com SOA
delv amazon.com

Any certificate authority can issue a certificate for the domain, raising the risk of mis-issuance.

No CAA records found. RFC 8659 lets the domain owner restrict which CAs are authorized.

(no CAA records found)

$ dig +short CAA amazon.com

amazon.com.  CAA  0 issue "letsencrypt.org"
amazon.com.  CAA  0 iodef "mailto:security@amazon.com"

The domain is served by several DNS servers, so one server failing won't take it down.

4 NS servers.

ns-1447.awsdns-52.org
ns-1707.awsdns-21.co.uk
ns-264.awsdns-33.com
ns-521.awsdns-01.net

$ dig +short NS amazon.com