Back to results

Digital exposure report

atlassian.com

Good shape, with a few gaps worth closing this quarter.

Scanned: 2026-11-15 19:22 UTC

Full coverage: every applicable check was assessed.

B
83/100

What to do first

  1. 1.

    Turn on DNS signing for your domain

    Signing helps resolvers detect forged answers about your domain.

    Who can fix it: Your domain registrar or DNS provider

    How to verify after the fix

    dig +short DS atlassian.com
  2. 2.

    Limit what your site shares when visitors click links

    This reduces how much page address detail is passed to other websites.

    Who can fix it: Your website developer or web host

    How to verify after the fix

    curl -sIL https://atlassian.com/ | grep -i "Referrer-Policy"

A starting point, not a security guarantee.

What this grade means

Tested hostname
atlassian.com
Website request
GET https://atlassian.com/ → https://www.atlassian.com/
Scan time
2026-11-15 19:22:39 UTC
Grading method
Version 2How grading works
Unverified or excluded checks
None. Every applicable check was assessed.

This is a snapshot of the public configuration checks listed in this report. It does not verify the site's owner, business legitimacy, application security, or absence of vulnerabilities. It is not a security certification.

Score by category

Email security29/30Spoofing email from this domain is hard.
Encryption & certificate25/25Traffic to the site is encrypted and the certificate is valid.
Browser protections21/30Some browser protections are missing.
DNS infrastructure8/15The domain's infrastructure works, but recommended hardening is missing.

Fix priorities

  1. 1.MediumDNSSEC — signed DNS records · Hardening gap+7
  2. 2.LowReferrer-Policy · Hardening gap+3
  3. 3.LowPermissions-Policy · Hardening gap+2
  4. 4.LowCSP — protection from script injection · Hardening gap+3

Findings

SPF — who may send mail for the domain

Passed · Severity: OK · 9/10

An authorized sender list is defined; mail from other servers is flagged as suspicious.

~all (softfail) — acceptable when combined with enforced DMARC. 6 of 10 DNS lookups.

Source data: DNS TXT atlassian.com
v=spf1 ip4:54.85.255.245 ip4:54.241.191.3 include:_spf.google.com include:cust-spf.exacttarget.com include:spf-001d9801.pphosted.com include:amazonses.com include:spf1.atlassian.com include:spf3.atlassian.com ip4:54.71.147.74 ip4:54.71.63.106 ip4:54.70.13.32 ~all
$ dig +short TXT atlassian.com
Documentation: RFC 7208 — SPF (https://www.rfc-editor.org/rfc/rfc7208) · M3AAWG — Email Authentication Best Practices (https://www.m3aawg.org/sites/default/files/m3aawg-email-authentication-recommended-best-practices-09-2020.pdf)

DMARC — anti-spoofing policy

Passed · Severity: OK · 15/15

Forged email in the company's name is blocked by mail servers.

Policy p=reject.

Source data: DNS TXT _dmarc.atlassian.com
v=DMARC1; p=reject; fo=1; pct=100; adkim=r; aspf=r; rua=mailto:dmarc_rua@emaildefense.proofpoint.com,mailto:dmarc-rua@abuse.atlassian.com; ruf=mailto:dmarc_ruf@emaildefense.proofpoint.com,mailto:dmarc-ruf@abuse.atlassian.com
$ dig +short TXT _dmarc.atlassian.com
Documentation: RFC 7489 — DMARC (https://www.rfc-editor.org/rfc/rfc7489) · dmarc.org — FAQ (https://dmarc.org/resources/frequently-asked-questions/)

DKIM — digital signature on email

Passed · Severity: OK · 5/5

A DKIM public key is published. On its own this doesn't prove outgoing mail is signed or aligned with your From domain.

DKIM public key found for selector: google, s1, s2. Confirm signing with dkim=pass in a sent message's Authentication-Results.

Source data: DNS TXT <selector>._domainkey.atlassian.com
google._domainkey: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsKEkAUkiVp+FFIbxY5DDRhBFTLhp…
s1._domainkey: k=rsa; t=s; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCyBd8d5z1DFksfA8BmiD34c1JNSHm0OIm/JcnO…
s2._domainkey: k=rsa; t=s; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDg+JmLd6bUWUSr1iir1LVJlXkc357c3qQK74H/…
$ dig +short TXT google._domainkey.atlassian.com
Documentation: RFC 6376 — DKIM (https://www.rfc-editor.org/rfc/rfc6376) · M3AAWG — Email Authentication Best Practices (https://www.m3aawg.org/sites/default/files/m3aawg-email-authentication-recommended-best-practices-09-2020.pdf)

MX — inbound mail routing

Passed · Severity: OK · unscored

Mail exchangers are published for the domain.

2 MX record(s). This shows where inbound mail is routed, not whether mail is sent from the domain.

Source data: DNS MX atlassian.com
10 mxa-001d9801.gslb.pphosted.com
10 mxb-001d9801.gslb.pphosted.com
$ dig +short MX atlassian.com
Documentation: RFC 7505 — Null MX (https://www.rfc-editor.org/rfc/rfc7505) · RFC 5321 §5.1 — Locating the target host (https://www.rfc-editor.org/rfc/rfc5321#section-5.1)

HTTPS available

Passed · Severity: OK · 10/10

The site loads over an encrypted connection.

https://atlassian.com/ returned HTTP 200 (final URL: https://www.atlassian.com/). Client-side certificate validation passed.

Source data: HTTPS GET https://atlassian.com/
HTTP 200
Final URL: https://www.atlassian.com/
$ curl -sIL https://atlassian.com/
Documentation: OWASP — Transport Layer Security Cheat Sheet (https://cheatsheetseries.owasp.org/cheatsheets/Transport_Layer_Security_Cheat_Sheet.html) · Mozilla — Server Side TLS (https://wiki.mozilla.org/Security/Server_Side_TLS)

HTTP → HTTPS redirect

Passed · Severity: OK · 7/7

Visitors arriving at an unencrypted address are automatically sent to the secure version.

HTTP 301 → https://atlassian.com/

Source data: HTTP GET http://atlassian.com/ (redirects not followed)
HTTP 301
Location: https://atlassian.com/
$ curl -sI http://atlassian.com/ | grep -iE "^(HTTP|location)"
Documentation: OWASP — Transport Layer Security Cheat Sheet (https://cheatsheetseries.owasp.org/cheatsheets/Transport_Layer_Security_Cheat_Sheet.html) · RFC 6797 — HSTS (https://www.rfc-editor.org/rfc/rfc6797)

SSL/TLS certificate validity

Passed · Severity: OK · 8/8

The certificate was accepted by a validating TLS client at scan time.

Live TLS handshake succeeded. Latest issuance in CT logs: Amazon Trust Services, expiring 2027-05-18 (184 days). CT shows issued certificates, not necessarily the one served — confirm dates with the verify command.

Source data: Certificate Transparency logs (certspotter) for atlassian.com
Live TLS handshake: certificate accepted
CT logs (context only, not scored):
Issuer: Amazon Trust Services
Valid from: 2026-11-02
Valid until: 2027-05-18
Names: *.atlassian.com, atlassian.com
Based on Certificate Transparency logs; may not reflect the certificate currently served.
$ echo | openssl s_client -connect atlassian.com:443 -servername atlassian.com 2>/dev/null | openssl x509 -noout -issuer -dates
Documentation: Certificate Transparency (https://certificate.transparency.dev/) · Let's Encrypt — Docs (https://letsencrypt.org/docs/) · Mozilla — Server Side TLS (https://wiki.mozilla.org/Security/Server_Side_TLS)

HSTS — enforce encryption in the browser

Passed · Severity: OK · 7/8

Browsers are told to always use an encrypted connection to the site.

max-age=63072000 (730 days), no includeSubDomains, preload. ≥ 180 days recommended.

Source data: Response headers from https://www.atlassian.com/
Strict-Transport-Security: max-age=63072000; preload
$ curl -sIL https://atlassian.com/ | grep -i "Strict-Transport-Security"
Documentation: MDN — Strict-Transport-Security (https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Strict-Transport-Security) · RFC 6797 — HSTS (https://www.rfc-editor.org/rfc/rfc6797) · OWASP — HTTP Headers Cheat Sheet (https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html)

CSP — protection from script injection

Needs attention · Severity: Low · Hardening gap · 5/8

A script policy exists, but it's permissive and offers only partial protection.

script-src includes: 'unsafe-inline', 'unsafe-eval' — weakens XSS protection.

Source data: Response headers from https://www.atlassian.com/
Content-Security-Policy: base-uri 'self'; default-src 'self' *.atlassian.com *.intercomcdn.com *.orangelogic.com *.6sc.co *.6sense.com sourcetreeapp.com *.sourcetreeapp.com bitbucket.org *.bitbucket.org; script-src 'self' *.1mind.com *.gstatic.com *.cookielaw.org *.public.atl-paas.net *.prod.atl-paas.net *.googletagmanager.com *.marketo.net *.marketo.com *.atlassian.com utt.impactcdn.com *.google.com *.doubleclick.com *.googleadservices.com *.livechatinc.com *.bing.com *.quora.com *.yimg.jp *.clicktale.net *.linkedin.com *.twitter.com *.licdn.com *.demandbase.com *.doubleclick.net *.facebook.net *.redditstatic.com *.clearbitscripts.com *.clarity.ms *.vimeo.com *.google-analytics.com facebook.com *.facebook.com impactcdn.com *.impactcdn.com clearbitjs.com *.clearbitjs.com yahoo.co.jp *.yahoo.co.jp *.recaptcha.net *.ads-twitter.com *.intercom.io *.intercomcdn.com *.jsdelivr.net *.6sc.co *.6sense.com *.techtarget.com *.capterra.com sourcetreeapp.com *.sourcetreeapp.com bitbucket.org *.bitbucket.org roundprincethere.com *.roundprincethere.com bzrcdn.openai.com dyv6f9ner1ir9.cloudfront.net *.adsrvr.org analytics.o11.tech https://s3.amazonaws.com/beehiiv-adnetwork-production/pixel-v2.js 'unsafe-eval' 'unsafe-inline'; style-src 'self' *.public.atl-paas.net *.prod.atl-paas.net fonts.googleapis.com https://accounts.google.com/gsi/style *.googletagmanager.com sourcetreeapp.com *.sourcetreeapp.com bitbucket.org *.bitbucket.org 'unsafe-inline'; img-src 'self' *.1mind.com blob: data: atlassian.com *.atlassian.com *.cookielaw.org *.gravatar.com *.wp.com fd-assets.prod.atl-paas.net pixel.pointmediatracker.com *.prod.public.atl-paas.net cnv.event.prod.bidr.io *.doubleclick.net *.clicktale.net *.bing.com rlcdn.com reddit.com quora.com *.rlcdn.com *.reddit.com *.quora.com *.ctfassets.net  *.linkedin.com *.google.com *.google.com.au *.company-target.com *.facebook.com *.google-analytics.com *.twitter.com t.co *.intercomcdn.com *.intercomassets.com *.frontend.public.atl-paas.net *.orangelogic.com *.googletagmanager.com img.logo.dev *.atlassian.net sourcetreeapp.com *.sourcetreeapp.com bitbucket.org *.bitbucket.org bytebucket.org *.bytebucket.org bitbucket-assetroot.s3.amazonaws.com b.6sc.co obs.roundprincethere.com cdn.blisspointmedia.com connect.facebook.net; font-src 'self' *.1mind.com *.ctfassets.net *.intercomcdn.com *.gstatic.com *.frontend.public.atl-paas.net *.atl.orangelogic.com; frame-ancestors 'none'; form-action 'self' pages.eml.atlassian.com app-ab35.marketo.com *.marketo.com *.mktoresp.com *.facebook.com; report-uri https://web-security-reports.services.atlassian.com/csp-report/wac-web; report-to csp-default-endpoint; connect-src 'self' *.1mind.com wss://*.1mind.com ws: atlassian.com *.atlassian.com *.cookielaw.org *.onetrust.com *.public.atl-paas.net *.prod.atl-paas.net *.mktoresp.com *.marketo.com *.ingest.sentry.io *.workato.com atlassian.sjv.io statsigapi.net *.statsigapi.net *.contentful.com atlassian.net *.clicktale.net *.contentsquare.net *.bing.com google-analytics.com company-target.com linkedin.com *.google-analytics.com *.company-target.com *.linkedin.com *.doubleclick.net *.reddit.com *.redditstatic.com *.google.com *.demandbase.com *.clarity.ms *.clearbit.com *.intercom.io *.algolianet.com *.algolia.net *.algolia.io *.recaptcha.net https://unpkg.com/@rive-app/ *.facebook.com *.orangelogic.com *.adnxs.com *.6sc.co *.6sense.com m.castle.io apis.auxia.io *.atlassian.net https://participant.connect.us-east-1.amazonaws.com wss://participant.connect.us-east-1.amazonaws.com *.connect.us-east-1.amazonaws.com sourcetreeapp.com *.sourcetreeapp.com bitbucket.org *.bitbucket.org obs.roundprincethere.com ibc-flow.techtarget.com *.googleadservices.com *.ingest.us.sentry.io bzrcdn.openai.com bzr.openai.com *.adsrvr.org ingestion.prod.apiarydata.net; frame-src 'self' *.1mind.com *.loom.com *.youtube.com *.google.com *.doubleclick.net *.recaptcha.net *.atl-paas.net pages.eml.atlassian.com app-ab35.marketo.com *.marketo.com *.mktoresp.com *.company-target.com *.googletagmanager.com *.atlassian.net *.facebook.com atlassian931.outgrow.us atlassian.wvc-test.ecosystems.io https://support-forms-ui.atlassian.com analytics.o11.tech *.adsrvr.org; media-src 'self' *.1mind.com *.ctfassets.net *.atlassian.com *.orangelogic.com; worker-src 'self' blob:
$ curl -sIL https://atlassian.com/ | grep -i "Content-Security-Policy"
Fix recommendation (effort: Complex)
  1. First publish Content-Security-Policy-Report-Only — it blocks nothing, it only reports.
  2. Collect violations for a week or two and tune the policy to your legitimate sources.
  3. Switch to the Content-Security-Policy header and replace 'unsafe-inline' with a nonce or hash.
/*
  Content-Security-Policy-Report-Only: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'

Safety: This change is made in your server/CDN settings. Test on staging before production. An overly strict CSP will break scripts — that's why you start in Report-Only mode.

Documentation: MDN — Content Security Policy (https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP) · OWASP — CSP Cheat Sheet (https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html)

Clickjacking protection

Passed · Severity: OK · 5/5

The site can't be embedded by foreign sites.

X-Frame-Options: DENY frame-ancestors 'none'

Source data: Response headers from https://www.atlassian.com/
X-Frame-Options: DENY
CSP frame-ancestors: 'none'
$ curl -sIL https://atlassian.com/ | grep -i "X-Frame-Options"
Documentation: MDN — X-Frame-Options (https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-Frame-Options) · OWASP — Clickjacking Defense (https://cheatsheetseries.owasp.org/cheatsheets/Clickjacking_Defense_Cheat_Sheet.html)

X-Content-Type-Options

Passed · Severity: OK · 4/4

The browser won't guess file types in a way that could execute code.

nosniff is set.

Source data: Response headers from https://www.atlassian.com/
X-Content-Type-Options: nosniff
$ curl -sIL https://atlassian.com/ | grep -i "X-Content-Type-Options"
Documentation: MDN — X-Content-Type-Options (https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-Content-Type-Options) · OWASP — HTTP Headers Cheat Sheet (https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html)

Referrer-Policy

Failed · Severity: Low · Hardening gap · 0/3

Internal URLs (including parameters) may leak to external sites.

Referrer-Policy is missing; the browser will use its default.

Source data: Response headers from https://www.atlassian.com/
Referrer-Policy: (missing)
$ curl -sIL https://atlassian.com/ | grep -i "Referrer-Policy"
Fix recommendation (effort: Easy)
  1. Set Referrer-Policy: strict-origin-when-cross-origin.
/*
  Referrer-Policy: strict-origin-when-cross-origin

Safety: This change is made in your server/CDN settings. Test on staging before production.

Documentation: MDN — Referrer-Policy (https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Referrer-Policy) · OWASP — HTTP Headers Cheat Sheet (https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html)

Permissions-Policy

Needs attention · Severity: Low · Hardening gap · 0/2

Access to sensitive features like the camera and location isn't restricted.

Missing Permissions-Policy header.

Source data: Response headers from https://www.atlassian.com/
Permissions-Policy: (missing)
$ curl -sIL https://atlassian.com/ | grep -i "Permissions-Policy"
Fix recommendation (effort: Easy)
  1. Disable browser features the site doesn't need (camera, microphone, geolocation).
/*
  Permissions-Policy: camera=(), microphone=(), geolocation=()

Safety: This change is made in your server/CDN settings. Test on staging before production. Don't disable a feature the site actually uses.

Documentation: MDN — Permissions-Policy (https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Permissions-Policy) · OWASP — HTTP Headers Cheat Sheet (https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html)

Software version disclosure

Passed · Severity: OK · unscored

The server doesn't disclose software versions.

No version numbers found in the Server / X-Powered-By headers.

Source data: Response headers from https://www.atlassian.com/
server: cloudflare
x-powered-by: (missing)
$ curl -sIL https://atlassian.com/ | grep -iE "^(server|x-powered-by)"
Documentation: OWASP — HTTP Headers Cheat Sheet (https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html)

DNSSEC — signed DNS records

Needs attention · Severity: Medium · Hardening gap · 0/7

The domain's records aren't signed, so in some scenarios users could be redirected to a forged server.

No DS record is published at the parent zone, so there's no DNSSEC chain of trust for this zone.

Source data: DNS-over-HTTPS (Cloudflare / Google): AD flag and DS record at the parent
AD = false
DS atlassian.com: NODATA
$ dig +short DS atlassian.com
Fix recommendation (effort: Medium)
  1. Enable DNSSEC at your DNS provider (one click at most providers).
  2. Copy the DS record your provider generates to your domain registrar.
  3. Wait for propagation and verify with DNSViz.
dig +dnssec atlassian.com SOA
delv atlassian.com

Safety: DNS changes are made only at your DNS provider. This tool only reads public data and changes nothing on the domain. A wrong DS record at the registrar will make the domain stop resolving — copy it exactly from the provider.

Documentation: RFC 4033 — DNSSEC (https://www.rfc-editor.org/rfc/rfc4033) · ICANN — DNSSEC: what and why (https://www.icann.org/resources/pages/dnssec-what-is-it-why-important-2019-03-05-en)

CAA — who may issue certificates

Passed · Severity: OK · 5/5

Only authorized certificate authorities can issue certificates for the domain.

CAA records: 0 issue "amazon.com" | 0 issue "digicert.com; account=c2eb0f50ca113d7543d58a10f523d0469ff922f115e5e4e9056f3d5f87d3356c" | 0 issue "globalsign.com" | 0 issue "letsencrypt.org" | 0 issue "pki.goog" | 0 issuewild "amazon.com" | 0 issuewild "digicert.com; account=c2eb0f50ca113d7543d58a10f523d0469ff922f115e5e4e9056f3d5f87d3356c" | 0 issuewild "globalsign.com" | 0 issuewild "letsencrypt.org" | 0 issuewild "pki.goog"

Source data: DNS CAA atlassian.com
0 issue "amazon.com"
0 issue "digicert.com; account=c2eb0f50ca113d7543d58a10f523d0469ff922f115e5e4e9056f3d5f87d3356c"
0 issue "globalsign.com"
0 issue "letsencrypt.org"
0 issue "pki.goog"
0 issuewild "amazon.com"
0 issuewild "digicert.com; account=c2eb0f50ca113d7543d58a10f523d0469ff922f115e5e4e9056f3d5f87d3356c"
0 issuewild "globalsign.com"
0 issuewild "letsencrypt.org"
0 issuewild "pki.goog"
$ dig +short CAA atlassian.com
Documentation: RFC 8659 — CAA (https://www.rfc-editor.org/rfc/rfc8659)

DNS server redundancy

Passed · Severity: OK · 3/3

The domain is served by several DNS servers, so one server failing won't take it down.

4 NS servers.

Source data: DNS NS atlassian.com
ns-112.awsdns-14.com
ns-1388.awsdns-45.org
ns-2018.awsdns-60.co.uk
ns-595.awsdns-10.net
$ dig +short NS atlassian.com
Documentation: RFC 2182 — Secondary DNS server operation (https://www.rfc-editor.org/rfc/rfc2182)

Indicative alignment

Best-practice mapping of public findings to common frameworks. Passive scanning tests public configuration only; it doesn't prove compliance or a violation.

  • Google & Yahoo sender rulesNo gaps observed
  • PCI DSS v4.01 observed gaps
  • NIS2 / vendor due diligence1 observed gaps
  • SOC 2 / ISO 27001 baseline1 observed gaps

Indicative alignment only, based on public configuration. It doesn't establish whether a framework applies to you, and it isn't legal advice, an audit or a certification.

Public DNS records

Aatlassian.com108.156.184.72 | 108.156.184.33 | 108.156.184.44 | 108.156.184.18
AAAAatlassian.com—
MXatlassian.com10 mxa-001d9801.gslb.pphosted.com | 10 mxb-001d9801.gslb.pphosted.com
NSatlassian.comns-112.awsdns-14.com | ns-1388.awsdns-45.org | ns-2018.awsdns-60.co.uk | ns-595.awsdns-10.net
TXTatlassian.com1d0d0fe5-61e0-4edb-a509-92bc5ce59983 | JkOZtIuIvTHsXraQgis9EtXUyG3SaZAj | MS=ms18133540 | SFMC--FelJdVfs1qWNvc7OtWJs6MZcusOPOyWM_eCsysa | SFMC-NEVZE-pd0X15BlxXI8i2N1C977acCSS6iXsjznDF | SFMC-VGtbZqMeaLnLX_ep8blmghawDtsZvdGp8ohWo4J5 | SFMC-wEuWumryKcoCTXQMJmxNyZH7NNNMnlDdhmqeETRC | SwdhbLH9TABXUXVsyv0iFHC0gtExgksKtVsvVoqGKZ4= | _tr70kb8d6vfv6evu0rderlk4g0qp5iu | _y2qw3c3u69fvu67dm6leua04zs07cjj | a7cf340215d81686fa0541a53ec9384c | adobe-idp-site-verification=45af865bd23a9cbf05c82c7c47118beaae9fa1806a8906132943dbf19c9f470b | airtable-verification=220a9b71c22879816d9d241613827202 | anodot-domain-verification=23e696e0e0d3bd0801e872b07a3ae2e96fd14cda1e6e0da7bbaf2e4e095cb21a | anthropic-domain-verification-enh4fz=TCXJHD6cAL2Z8omPsnYyIrBSZ | apperio-domain-verification=205f89afe51545a9805b40d8fca11dc3 | apple-domain-verification=xJk7gq0QjgmNwKOC | atlassian-domain-verification=7xPjAxr91ksK7xsQQrqNJ8JFeaE9d8uAuzKoBhkfR7hlh7Gzy3MuwtWaHXBZfc45 | atlassian-domain-verification=An/zNsIXav1loZKNgNsLVZCSVF2ZwxCmmRmHyazPNupCMhIIewVgxjLRX8vHnEH6 | atlassian-domain-verification=CXg3TfK6ks2yn8qhnjbtaw8KCGz1K31j0BtdTSS5WlX6VJiPfspjjg3f26obkuA8 | atlassian-domain-verification=GoNKpGQAjzgcMJeaDCpawM8OAdqJfI3Qdf9spLiWI8C0YsmbNaRV2Ynl6LCQYdYN | atlassian-domain-verification=JxhV/ZhZkrHgVYscIkTb0uMQ/pZKY49/9ooO9KLUmIFve3PmWY8TFJSMQTmgLgv/ | atlassian-domain-verification=LxdUlMBGyIDZzdv5a3379ISDrFCwFudcod0VChiY9LkNp28183xDRHw8pkPq7Ypk | atlassian-domain-verification=TS3UJOnLYyKBsGxOYnvhbVxyWdzDSJkxGkxrZumZa0N105LDvHaJUaiYaVzOxcUb | atlassian-domain-verification=TX9lehYa7FjdqgpdvamdPToWtgCK34NADujThyFK7Pb36OxG/zvaJ8jrcFRa0DxC | atlassian-domain-verification=X4J4e2ziyymqxQPEr6N8ZLJiWgXUt0la2C6hXn/Av3fiUpeEc6kQbNeGEfeudbjm | atlassian-domain-verification=YgtkR1lUarneaVF9TSEqiX78nL3RNACOQ6IIvkJjhmZx8Db3bRgl/nIrpPNopHWj | atlassian-domain-verification=ZRphniOpyvhHV76mRmxnLkHJVrKnbeOIxmhbxb8PF6AarX0FypthxYB/r5XpVC2E | atlassian-domain-verification=ZlsTGOEPNmWFXzzhEayLG9WDmjOwsr1H36NdpelFLTF/kGCLr/a5rCCOqqGZRjWt | atlassian-domain-verification=gtWlmVkmNlzB0F0QoItHOhMGV1F//z0VsxzR6JiXQLK4LaXZ6nVZMybZEXNimQ/D | atlassian-domain-verification=mnSEydSHNWTwzBa1PLswfF7e/U/IEx9v5ppCtA60bxCvWZLntKvQHd2ddb3h3kEd | atlassian-domain-verification=qXy0sJTeEzEpIxfg30MuaX1rZvWqIE66QYh8m1SKJrAxIK59OFAawrIZjKd6kwgo | atlassian-domain-verification=riKoagHwPoh1ADNcj5c0dKK57fNjgfBsG/c7pORIY3PuL3LwseHjKJ7CklCccfp/ | atlassian-sending-domain-verification=1eef8e00-d3a1-4e96-87d6-3c89eff0c1a0 | atlassian-sending-domain-verification=d3a0d4ae-a1a3-46dc-897e-9b3c7a05aa12 | bugcrowd-verification=e6bfef1b70648d92dfaa9c71109333e1 | canva-site-verification=xQleHIYkB_3_GwMv8WMAhg | cursor-domain-verification-64a3xw=FGgvQz4cWuUQpOR9J9nyQwkR9 | d25ka488dfqyj6.cloudfront.net | docusign=1d2cd2cd-53da-4c43-b487-46a5d4745f60 | docusign=40001689-5955-4691-bdc0-0c95f792b589 | docusign=c709d0e7-f221-4f03-b936-704266b503a0 | dropbox-domain-verification=o4rdwxnte1t0 | facebook-domain-verification=s0cdi2ihgpeg7v7hl45zatfdbi5ia6 | google-site-verification=4BcTn3m9wfJrq8ONDz9ltMbFhVgT51FVkfmSn-fcGZM | google-site-verification=961ryHZWzEAyKPpOY6xTPviMeUlp00RagzX7INHnRpk | google-site-verification=CRUWMjnPZaaZap-3EJktXdl_an_hWEgNqTb_j2LUTcM | google-site-verification=Ey-v6Be7J2lbOSMR7ID-gA6wGZXKxYMuTVkR4LFueow | google-site-verification=Gh3bIDlI_r-ksbSfnr8Kzvgp6Ccq3fE8dd_LXzJVIpo | google-site-verification=JG9JPuB-cRDnvpykq5rcpdNNy9ZwvkfyMVlRn2iapAw | google-site-verification=Kj7SMNgp41m5YiH7KEawowCRQFilQrRZ8D_TztiEn2g | google-site-verification=Lwmfu2vZQ0v_OCc48kYQNXCcmgP7Gj6Fg2kL08Xhfn0 | google-site-verification=MSD4eeRGxm5bA9Au1cGuV8OPQOsju7epTDJ-f9C90gY | google-site-verification=O7Ybt8qvuC_Wr7eNYnJyhTxaGWpIERx_eQXhD219Mmc | google-site-verification=U5hiOly8JOwhyRXMmxgWaDHGMem7kgQud1Iis8gshyA | google-site-verification=fK0r-SyWnbxUuzdIbhScO9WjBIDBuEAh8ldTX3FDheU | google-site-verification=meC0eL8WeS_HRmG0TlwJGmdx0Mju3JwxEa6v9GjYj8k | google-site-verification=r1_7nBuqdcWdM0QIiDWQusHa9jelyX5hJYgX3xWSeTM | google-site-verification=va3Nya0kn20guRQIVU-LF4RRsKZ6u1Rewtqb4eYro-8 | google-site-verification=x-2Aoze34nZo0Bs3hefRL6DJiMtGOyYBixByW_D0ZPU | google-site-verification=z98_8Laz1Jr_VZwpAMfx5IXbFy4PCx66ygZoqCeLyyc | hubspot-developer-verification=YzQ0ODBmZWMtMWI4YS00Zjk4LWI1ZDEtZGFkNzg3NzQ0MWY2 | hubspot-developer-verification=ZjUyYzJkNDEtNTllMC00MjE4LTg0NzctNGFkNDNhMTQwMDJl | jamf-site-verification=tQF45ulu-gGP9PsBrWuMpw | knowbe4-site-verification=d26e46454d5f1bfcd1bd89f8ccf0d578 | krisp-domain-verification=iaYrEjBouKqKfT09dQFvUw0qkjiB2HwO | lastpass-verification-code=6kaWM#TIy^*%CfMRVDa&&j&$JrJ4mr%!b^*HRTs1X3V4pMsGgUnD02HI*9ij&SBYbfoB9UV9xjOgWuaoAjTu4RywpdWrw7c%w5F | miro-verification=6bd145c8ff96aabe81ebbc9298522ad4c41e08f6 | mongodb-site-verification=7ITIBB5r72gygRCiBxwA5UQcOyng1Vz1 | notion-domain-verification=1ez7s7pQwWadv3VpVRoGN6T4wH6rz95OH5yc5aNgDV9 | onetrust-domain-verification=aa11449cf62348e78d229049ddf67df2 | openai-domain-verification=dv-sieehJkHarisQONQPcyKyLrq | pardot548382=251a035bf1d916039f96c33d2457506ec1936c8c8331956b270cb6f51e4a1a6a | pendo-domain-verification=08405cee-3c6b-4169-9461-fef5648efd67 | postman-domain-verification=800d74a33351205a654e3108f639ed29eb015d093ef1c303ac965d3272c6f02456307508bb8236be692906720c795570c4a78814e5ad34365dd2e34731c42197 | ppe-b2f6e67f740d3c6bd37c6665c6d19a140a8acd97 | profound-domain-verification-kwc8pk=Nkeycc3Ki88gmNXVDIlIu2qgb | segment-site-verification=jWNfQP1TpeIY9m5hjMJ9oq7bqKE7ARtD | status-page-domain-verification=3fbwzqm8vjhr | stripe-verification=04d7fb4776f1301905fec8ab2640d90063d83433562200fe8e84a163af2ff537 | stripe-verification=27a7887beca7c109d6beeb7b154db1878cdb699d0d93e48a731ec08c694a6290 | stripe-verification=427826c728dfce0a7a78322acfdbce70473ec2d999a739fd15d0151a8ccb0200 | stripe-verification=580cea36ec46ac0adcc200221811acaca1db456b0fb91bd7cc129d8f3459b9b8 | stripe-verification=71d4571aac7216050c8bebaadf0538662d4e5a950b7c4cfd8e69b12a54835df1 | stripe-verification=8C4E45BA3E22F706F5F3FB72A6F72719FE8C912462788AB8D6C1A38CC1C64A6A | stripe-verification=97aa50e11805a745fd972ed3c9cc3b4fb81d706adb8bf9693b347772e00478d5 | stripe-verification=B90269683791B84C666A07BAEF5A248445E78BA55FA2E2208E3A062BFA751425 | stripe-verification=a08bc6fbbb27bb9d81ddf84670414dc9aec5ed4d6740c0c1a566a71d19ea8341 | stripe-verification=c3c46ec084306a30bcc1d0551fb9a508231831f38a2723e874e6446c29281d55 | stripe-verification=d6a3912e7b1c6ece6fbbd3fbd94ec2809cef42dd52c146b9e97911d819705df9 | stripe-verification=df30411351944f1496e1672379f26a194bc00c7fb0fcbbab989d610f090bffd8 | stripe-verification=e3129af3aea23f39d9869982084895f81fcb2a931daec6fac7052df798612d6f | twilio-domain-verification=e459472c26323f835802d62f65dd9f66 | v=MCPv1; k=ed25519; p=3+HwEl6PGRASMFD+ktCP5sprdenoB/YZHJAOqE2CVoo= | v=spf1 ip4:54.85.255.245 ip4:54.241.191.3 include:_spf.google.com include:cust-spf.exacttarget.com include:spf-001d9801.pphosted.com include:amazonses.com include:spf1.atlassian.com include:spf3.atlassian.com ip4:54.71.147.74 ip4:54.71.63.106 ip4:54.70.13.32 ~all | vp76ki2nsesve2u3a44pp0mahb | zoom-domain-verification=2803a8e0-7054-4e81-a7d7-fd55692d5e3b | zoom-domain-verification=ZOOM_verify_4ad6509ff04743f78e3edc5da0a43c11
TXT_dmarc.atlassian.comv=DMARC1; p=reject; fo=1; pct=100; adkim=r; aspf=r; rua=mailto:dmarc_rua@emaildefense.proofpoint.com,mailto:dmarc-rua@abuse.atlassian.com; ruf=mailto:dmarc_ruf@emaildefense.proofpoint.com,mailto:dmarc-ruf@abuse.atlassian.com
CAAatlassian.com0 issue "amazon.com" | 0 issue "digicert.com; account=c2eb0f50ca113d7543d58a10f523d0469ff922f115e5e4e9056f3d5f87d3356c" | 0 issue "globalsign.com" | 0 issue "letsencrypt.org" | 0 issue "pki.goog" | 0 issuewild "amazon.com" | 0 issuewild "digicert.com; account=c2eb0f50ca113d7543d58a10f523d0469ff922f115e5e4e9056f3d5f87d3356c" | 0 issuewild "globalsign.com" | 0 issuewild "letsencrypt.org" | 0 issuewild "pki.goog"
DSatlassian.com—
Passive check only: reading public DNS records, Certificate Transparency logs and ordinary GET requests to the homepage over HTTPS and HTTP. No changes were made to the scanned domain. Results are an indication and do not replace a professional security assessment.

Check your own domain