Digital exposure report
berkeley.edu
High exposure. Significant weaknesses put the brand, customers and email at risk.
Scanned: 2026-11-15 19:22 UTC
Full coverage: every applicable check was assessed.
What to do first
- 1.
Tell browsers to always use the secure version
Helps browsers use HTTPS on future visits after they have received the policy.
Who can fix it: Your web host
How to verify after the fix
curl -sIL https://berkeley.edu/ | grep -i "Strict-Transport-Security"
- 2.
Limit what scripts your pages are allowed to run
This adds one layer of protection against injected scripts.
Who can fix it: Your website developer or web host
How to verify after the fix
curl -sIL https://berkeley.edu/ | grep -i "Content-Security-Policy"
A starting point, not a security guarantee.
What this grade means
- Tested hostname
- berkeley.edu
- Website request
- GET https://berkeley.edu/ → https://www.berkeley.edu/
- Scan time
- 2026-11-15 19:22:36 UTC
- Grading method
- Version 2How grading works
- Unverified or excluded checks
- None. Every applicable check was assessed.
This is a snapshot of the public configuration checks listed in this report. It does not verify the site's owner, business legitimacy, application security, or absence of vulnerabilities. It is not a security certification.
Score by category
| Email security | 29/30 | Spoofing email from this domain is hard. |
| Encryption & certificate | 18/25 | Encryption is in place, but a gap could expose users. |
| Browser protections | 8/30 | Several browser hardening headers are missing, which removes layers of protection against script injection and framing. |
| DNS infrastructure | 10/15 | The domain's infrastructure works, but recommended hardening is missing. |
Fix priorities
- 1.HighHSTS — enforce encryption in the browser · Hardening gap+8
- 2.HighHTTP → HTTPS redirect · Hardening gap+7
- 3.MediumCSP — protection from script injection · Hardening gap+8
- 4.LowCAA — who may issue certificates · Hardening gap+5
- 5.LowX-Content-Type-Options · Hardening gap+4
- 6.LowPermissions-Policy · Hardening gap+2
Findings
SPF — who may send mail for the domain
Passed · Severity: OK · 9/10An authorized sender list is defined; mail from other servers is flagged as suspicious.
~all (softfail) — acceptable when combined with enforced DMARC. 7 of 10 DNS lookups.
v=spf1 include:_spf.berkeley.edu include:_spf2.berkeley.edu include:_spf.google.com include:_spf.qualtrics.com include:servers.mcsv.net include:spf.mailjet.com a:c.spf.service-now.com ~all
$ dig +short TXT berkeley.edu
DMARC — anti-spoofing policy
Passed · Severity: OK · 15/15Forged email in the company's name is blocked by mail servers.
Policy p=reject.
v=DMARC1; p=reject; np=reject; psd=n; rua=mailto:dmarcrpt@berkeley.edu; ruf=mailto:dmarcrpt@berkeley.edu
$ dig +short TXT _dmarc.berkeley.edu
DKIM — digital signature on email
Passed · Severity: OK · 5/5A DKIM public key is published. On its own this doesn't prove outgoing mail is signed or aligned with your From domain.
DKIM public key found for selector: google, k1, s1, s2, mail. Confirm signing with dkim=pass in a sent message's Authentication-Results.
google._domainkey: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAutuzI0L8T7sOTTYuvzHxv/BsZq1p… k1._domainkey: k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDbNrX2cY/GUKIFx2G/1I00ftdAj713WP9AQ1xir85i8… s1._domainkey: k=rsa; t=s; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtbHBYq4A5bj8GlGV3vbqkCTf8OiqMJIl… s2._domainkey: k=rsa; t=s; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC55Kp+4UBxIgnsyVMRhu+5hxyjJofITWLvFihp… mail._domainkey: k=rsa;p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDeMVIzrCa3T14JsNY0IRv5/2V1/v2itlviLQBwXsa7sh…
$ dig +short TXT google._domainkey.berkeley.edu
MX — inbound mail routing
Passed · Severity: OK · unscoredMail exchangers are published for the domain.
5 MX record(s). This shows where inbound mail is routed, not whether mail is sent from the domain.
1 aspmx.l.google.com 5 alt1.aspmx.l.google.com 5 alt2.aspmx.l.google.com 10 alt3.aspmx.l.google.com 10 alt4.aspmx.l.google.com
$ dig +short MX berkeley.edu
HTTPS available
Passed · Severity: OK · 10/10The site loads over an encrypted connection.
https://berkeley.edu/ returned HTTP 200 (final URL: https://www.berkeley.edu/). Client-side certificate validation passed.
HTTP 200 Final URL: https://www.berkeley.edu/
$ curl -sIL https://berkeley.edu/
HTTP → HTTPS redirect
Failed · Severity: High · Hardening gap · 0/7The site is also reachable over an unencrypted connection, so data may travel in plain text on public networks.
http://berkeley.edu/ returned HTTP 301 without redirecting to https:// (Location: http://www.berkeley.edu/).
HTTP 301 Location: http://www.berkeley.edu/
$ curl -sI http://berkeley.edu/ | grep -iE "^(HTTP|location)"
- Set up a permanent (301) redirect from every HTTP request to HTTPS on the server or CDN.
- Then add an HSTS header.
server {
listen 80;
server_name berkeley.edu www.berkeley.edu;
return 301 https://$host$request_uri;
}Safety: This change is made on your server. Make sure HTTPS works first, otherwise the site won't load.
SSL/TLS certificate validity
Passed · Severity: OK · 8/8The certificate was accepted by a validating TLS client at scan time.
Live TLS handshake succeeded. Latest issuance in CT logs: Google Trust Services, expiring 2027-01-09 (54 days). CT shows issued certificates, not necessarily the one served — confirm dates with the verify command.
Live TLS handshake: certificate accepted CT logs (context only, not scored): Issuer: Google Trust Services Valid from: 2026-10-11 Valid until: 2027-01-09 Names: berkeley.edu Based on Certificate Transparency logs; may not reflect the certificate currently served.
$ echo | openssl s_client -connect berkeley.edu:443 -servername berkeley.edu 2>/dev/null | openssl x509 -noout -issuer -dates
HSTS — enforce encryption in the browser
Failed · Severity: High · Hardening gap · 0/8Browsers aren't told to always use an encrypted connection, enabling interception attacks on public networks.
No Strict-Transport-Security header. Users are exposed to SSL stripping on the first request.
Strict-Transport-Security: (missing)
$ curl -sIL https://berkeley.edu/ | grep -i "Strict-Transport-Security"
- Start with a short max-age (300 seconds) and make sure every subdomain works over HTTPS.
- Gradually raise it to 31536000 (one year) and add includeSubDomains.
- Consider preload only once the policy is stable — removal from the preload list is slow.
/* Strict-Transport-Security: max-age=31536000; includeSubDomains
Safety: This change is made in your server/CDN settings. Test on staging before production. HSTS is cached in the visitor's browser — a long max-age on a site without working HTTPS will block access.
CSP — protection from script injection
Failed · Severity: Medium · Hardening gap · 0/8Missing Content-Security-Policy header: this removes one layer of protection against script injection.
No Content-Security-Policy header found.
Content-Security-Policy: (missing)
$ curl -sIL https://berkeley.edu/ | grep -i "Content-Security-Policy"
- First publish Content-Security-Policy-Report-Only — it blocks nothing, it only reports.
- Collect violations for a week or two and tune the policy to your legitimate sources.
- Switch to the Content-Security-Policy header and replace 'unsafe-inline' with a nonce or hash.
/* Content-Security-Policy-Report-Only: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'
Safety: This change is made in your server/CDN settings. Test on staging before production. An overly strict CSP will break scripts — that's why you start in Report-Only mode.
Clickjacking protection
Passed · Severity: OK · 5/5The site can't be embedded by foreign sites.
X-Frame-Options: SAMEORIGIN
X-Frame-Options: SAMEORIGIN
$ curl -sIL https://berkeley.edu/ | grep -i "X-Frame-Options"
X-Content-Type-Options
Failed · Severity: Low · Hardening gap · 0/4The browser may interpret files as code unintentionally.
Missing X-Content-Type-Options: nosniff header (MIME sniffing).
X-Content-Type-Options: (missing)
$ curl -sIL https://berkeley.edu/ | grep -i "X-Content-Type-Options"
- Add X-Content-Type-Options: nosniff to every response.
/* X-Content-Type-Options: nosniff
Safety: This change is made in your server/CDN settings. Test on staging before production.
Referrer-Policy
Passed · Severity: OK · 3/3Internal URLs don't leak to external sites.
Referrer-Policy: strict-origin-when-cross-origin
Referrer-Policy: strict-origin-when-cross-origin
$ curl -sIL https://berkeley.edu/ | grep -i "Referrer-Policy"
Permissions-Policy
Needs attention · Severity: Low · Hardening gap · 0/2Access to sensitive features like the camera and location isn't restricted.
Missing Permissions-Policy header.
Permissions-Policy: (missing)
$ curl -sIL https://berkeley.edu/ | grep -i "Permissions-Policy"
- Disable browser features the site doesn't need (camera, microphone, geolocation).
/* Permissions-Policy: camera=(), microphone=(), geolocation=()
Safety: This change is made in your server/CDN settings. Test on staging before production. Don't disable a feature the site actually uses.
Software version disclosure
Passed · Severity: OK · unscoredThe server doesn't disclose software versions.
No version numbers found in the Server / X-Powered-By headers.
server: cloudflare x-powered-by: WP Engine
$ curl -sIL https://berkeley.edu/ | grep -iE "^(server|x-powered-by)"
DNSSEC — signed DNS records
Passed · Severity: OK · 7/7The domain's records are digitally signed and hard to forge.
An AD (Authenticated Data) flag was returned by a validating resolver.
AD = true
$ dig +dnssec berkeley.edu | grep -E "flags:.* ad"
CAA — who may issue certificates
Needs attention · Severity: Low · Hardening gap · 0/5Any certificate authority can issue a certificate for the domain, raising the risk of mis-issuance.
No CAA records found. RFC 8659 lets the domain owner restrict which CAs are authorized.
(no CAA records found)
$ dig +short CAA berkeley.edu
- Identify which certificate authority issued your current certificate (see the certificate check).
- Publish CAA for that authority only, and add iodef to receive alerts.
berkeley.edu. CAA 0 issue "letsencrypt.org" berkeley.edu. CAA 0 iodef "mailto:security@berkeley.edu"
Safety: DNS changes are made only at your DNS provider. This tool only reads public data and changes nothing on the domain. If your CDN issues certificates on your behalf, include it too — otherwise certificate renewal will fail.
DNS server redundancy
Passed · Severity: OK · 3/3The domain is served by several DNS servers, so one server failing won't take it down.
3 NS servers.
adns1.berkeley.edu adns2.berkeley.edu adns3.berkeley.edu
$ dig +short NS berkeley.edu
Indicative alignment
Best-practice mapping of public findings to common frameworks. Passive scanning tests public configuration only; it doesn't prove compliance or a violation.
- Google & Yahoo sender rulesNo gaps observed
- PCI DSS v4.03 observed gaps
- NIS2 / vendor due diligence2 observed gaps
- SOC 2 / ISO 27001 baseline3 observed gaps
Indicative alignment only, based on public configuration. It doesn't establish whether a framework applies to you, and it isn't legal advice, an audit or a certification.
Public DNS records
| A | berkeley.edu | 141.193.213.20 | 141.193.213.21 |
| AAAA | berkeley.edu | — |
| MX | berkeley.edu | 1 aspmx.l.google.com | 5 alt1.aspmx.l.google.com | 5 alt2.aspmx.l.google.com | 10 alt3.aspmx.l.google.com | 10 alt4.aspmx.l.google.com |
| NS | berkeley.edu | adns1.berkeley.edu | adns2.berkeley.edu | adns3.berkeley.edu |
| TXT | berkeley.edu | MS=ms19521665 | MS=ms37758698 | iContact1393487 | iContact1462072 | iContact1583632 | 896263912-18360412 | klaviyo-site-verification=SWYLuM | ZOOM_verify_RirbP7N1QWC3Zzm02oL4Cw | apple-domain-verification=ZDtApcKYPmKfYxn4 | MS=10BE0CF63C8BD5AFF9A6EF7B71763B098A905719 | brevo-code:a2b2aef0282cf9caec92be7bed7630ad | brevo-code:c6f4c03d44819f8975dc05ff6b3df3a9 | brevo-code:e1e8345a4a2352cdbd9d6979093f2aec | brevo-code:ee0b01818d57850991280d3999efc841 | docusign=25bb9bc1-b377-48ce-a907-61472fca6261 | docusign=31f4475e-737f-4a3a-b6ea-60b1ac273c95 | jamf-site-verification=2jicltwxCxH93ep4OhO0dA | canva-site-verification=HJ933woS6KmNfYtvOaJHZA | amazonses:IuakF7FVH1Y7h0Kap7krqHwRvoXFOzSET+Ri1VBHziA= | adobe-idp-site-verification=a113c870-3c49-4b4a-b3a4-31e1cf1860cb | google-site-verification=C4YkQW0t-gtD5FpVWdjxAipEUofVb2p0KmW3xFaUJeA | google-site-verification=CDuttEoV44OF0dD7qwidnTj3wvYxIPz05W6MKEZfKYc | google-site-verification=R5hbazPMfJqtXtm6OHprlDpBnSThQvYDrt-i-IqZvjE | google-site-verification=fL93jj-VPnl_5wdFDh26YshzKVPraWAurHaBCu-k-Xw | google-site-verification=loQrJWyMsMB249uINb-AsRGTWVoLdTc44Td3aMGn-NE | sending_domain102272=da1fdb1bce80fcb235c498ec3ad47745fed6ea7c6dc03752d88318531e6b07b7 | atlassian-domain-verification=RIwGoMGAwFoHKm3AJg0bhFvuzEkRseqI6LStzthTqt4dWfA6Mqm5OCHFbZd1BJ9e | v=spf1 include:_spf.berkeley.edu include:_spf2.berkeley.edu include:_spf.google.com include:_spf.qualtrics.com include:servers.mcsv.net include:spf.mailjet.com a:c.spf.service-now.com ~all |
| TXT | _dmarc.berkeley.edu | v=DMARC1; p=reject; np=reject; psd=n; rua=mailto:dmarcrpt@berkeley.edu; ruf=mailto:dmarcrpt@berkeley.edu |
| CAA | berkeley.edu | — |
| DS | berkeley.edu | 10359 10 2 90c805bdf785312d7ce4af92d697cdb1e6f5228d7364dce259d0652b8579c65b | 17532 10 2 a6c9ec2b5ac641f87b436d2ff9adb8d5655bc8434de90cc47ed47f8bad65ae1f |