Digital exposure report

docusign.com

Moderate exposure. There are gaps an attacker could exploit — fix them soon.

Scanned: 2026-11-15 19:22 UTC

Full coverage: every applicable check was assessed.

79/100

What to do first

1.
Stop other sites from embedding your pages
This removes one way to trick visitors into clicking something on your site unknowingly.
Who can fix it: Your website developer or web host
How to verify after the fix
```
curl -sIL https://docusign.com/ | grep -i "X-Frame-Options"
```
2.
Limit what scripts your pages are allowed to run
This adds one layer of protection against injected scripts.
Who can fix it: Your website developer or web host
How to verify after the fix
```
curl -sIL https://docusign.com/ | grep -i "Content-Security-Policy-Report-Only"
```

A starting point, not a security guarantee.

What this grade means

Tested hostname: docusign.com
Website request: GET https://docusign.com/ → https://www.docusign.com/
Scan time: 2026-11-15 19:22:33 UTC
Grading method: Version 2How grading works
Unverified or excluded checks: None. Every applicable check was assessed.

This is a snapshot of the public configuration checks listed in this report. It does not verify the site's owner, business legitimacy, application security, or absence of vulnerabilities. It is not a security certification.

Score by category

Email security	30/30	Spoofing email from this domain is hard.
Encryption & certificate	25/25	Traffic to the site is encrypted and the certificate is valid.
Browser protections	14/30	Several browser hardening headers are missing, which removes layers of protection against script injection and framing.
DNS infrastructure	10/15	The domain's infrastructure works, but recommended hardening is missing.

Fix priorities

1.MediumClickjacking protection · Hardening gap+5
2.MediumCSP — protection from script injection · Hardening gap+5
3.LowCAA — who may issue certificates · Hardening gap+5
4.LowReferrer-Policy · Hardening gap+3
5.LowPermissions-Policy · Hardening gap+2

Findings

SPF — who may send mail for the domain

Passed · Severity: OK · 10/10

An authorized sender list is defined and mail from other servers is rejected.

Valid SPF record with -all. 2 of the 10 allowed DNS lookups.

Source data: DNS TXT docusign.com

v=spf1 include:%{ir}.%{v}.%{d}.spf.has.pphosted.com ip4:205.220.176.129 ip4:205.220.164.129 ip4:205.220.166.129 ip4:205.220.177.61 include:_spf.google.com -all

$ dig +short TXT docusign.com

Documentation: RFC 7208 — SPF (https://www.rfc-editor.org/rfc/rfc7208) · M3AAWG — Email Authentication Best Practices (https://www.m3aawg.org/sites/default/files/m3aawg-email-authentication-recommended-best-practices-09-2020.pdf)

DMARC — anti-spoofing policy

Passed · Severity: OK · 15/15

Forged email in the company's name is blocked by mail servers.

Policy p=reject.

Source data: DNS TXT _dmarc.docusign.com

v=DMARC1; p=reject; sp=reject; adkim=r; aspf=r; rua=mailto:dmarc_rua@emaildefense.proofpoint.com; ruf=mailto:dmarc_ruf@emaildefense.proofpoint.com; fo=1;

$ dig +short TXT _dmarc.docusign.com

Documentation: RFC 7489 — DMARC (https://www.rfc-editor.org/rfc/rfc7489) · dmarc.org — FAQ (https://dmarc.org/resources/frequently-asked-questions/)

DKIM — digital signature on email

Passed · Severity: OK · 5/5

A DKIM public key is published. On its own this doesn't prove outgoing mail is signed or aligned with your From domain.

DKIM public key found for selector: google, s1, s2. Confirm signing with dkim=pass in a sent message's Authentication-Results.

Source data: DNS TXT <selector>._domainkey.docusign.com

google._domainkey: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAkoquLaKqzh/IRIJAINldcjalgMmm…
s1._domainkey: k=rsa; t=s; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0Y+tjr3+3ycVQgUPBCYuitQkfOLKt8Be…
s2._domainkey: k=rsa; t=s; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDxCn5WrEiA5x0DjbtCNEW30H9TUg2cgNpwB8Pg…

$ dig +short TXT google._domainkey.docusign.com

Documentation: RFC 6376 — DKIM (https://www.rfc-editor.org/rfc/rfc6376) · M3AAWG — Email Authentication Best Practices (https://www.m3aawg.org/sites/default/files/m3aawg-email-authentication-recommended-best-practices-09-2020.pdf)

MX — inbound mail routing

Passed · Severity: OK · unscored

Mail exchangers are published for the domain.

2 MX record(s). This shows where inbound mail is routed, not whether mail is sent from the domain.

Source data: DNS MX docusign.com

10 mxa-00567a01.gslb.pphosted.com
10 mxb-00567a01.gslb.pphosted.com

$ dig +short MX docusign.com

Documentation: RFC 7505 — Null MX (https://www.rfc-editor.org/rfc/rfc7505) · RFC 5321 §5.1 — Locating the target host (https://www.rfc-editor.org/rfc/rfc5321#section-5.1)

HTTPS available

Passed · Severity: OK · 10/10

The site loads over an encrypted connection.

https://docusign.com/ returned HTTP 200 (final URL: https://www.docusign.com/). Client-side certificate validation passed.

Source data: HTTPS GET https://docusign.com/

HTTP 200
Final URL: https://www.docusign.com/

$ curl -sIL https://docusign.com/

Documentation: OWASP — Transport Layer Security Cheat Sheet (https://cheatsheetseries.owasp.org/cheatsheets/Transport_Layer_Security_Cheat_Sheet.html) · Mozilla — Server Side TLS (https://wiki.mozilla.org/Security/Server_Side_TLS)

HTTP → HTTPS redirect

Passed · Severity: OK · 7/7

Visitors arriving at an unencrypted address are automatically sent to the secure version.

HTTP 301 → https://docusign.com/

Source data: HTTP GET http://docusign.com/ (redirects not followed)

HTTP 301
Location: https://docusign.com/

$ curl -sI http://docusign.com/ | grep -iE "^(HTTP|location)"

Documentation: OWASP — Transport Layer Security Cheat Sheet (https://cheatsheetseries.owasp.org/cheatsheets/Transport_Layer_Security_Cheat_Sheet.html) · RFC 6797 — HSTS (https://www.rfc-editor.org/rfc/rfc6797)

SSL/TLS certificate validity

Passed · Severity: OK · 8/8

The certificate was accepted by a validating TLS client at scan time.

Live TLS handshake succeeded. Latest issuance in CT logs: DigiCert, expiring 2027-02-23 (100 days). CT shows issued certificates, not necessarily the one served — confirm dates with the verify command.

Source data: Certificate Transparency logs (certspotter) for docusign.com

Live TLS handshake: certificate accepted
CT logs (context only, not scored):
Issuer: DigiCert
Valid from: 2026-02-24
Valid until: 2027-02-23
Names: docusign.ca, docusign.co.uk, docusign.com, docusign.com.au, docusign.com.br, docusign.com.es
Based on Certificate Transparency logs; may not reflect the certificate currently served.

$ echo | openssl s_client -connect docusign.com:443 -servername docusign.com 2>/dev/null | openssl x509 -noout -issuer -dates

Documentation: Certificate Transparency (https://certificate.transparency.dev/) · Let's Encrypt — Docs (https://letsencrypt.org/docs/) · Mozilla — Server Side TLS (https://wiki.mozilla.org/Security/Server_Side_TLS)

HSTS — enforce encryption in the browser

Passed · Severity: OK · 7/8

Browsers are told to always use an encrypted connection to the site.

max-age=31536000 (365 days), no includeSubDomains. ≥ 180 days recommended.

Source data: Response headers from https://www.docusign.com/

Strict-Transport-Security: max-age=31536000

$ curl -sIL https://docusign.com/ | grep -i "Strict-Transport-Security"

Documentation: MDN — Strict-Transport-Security (https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Strict-Transport-Security) · RFC 6797 — HSTS (https://www.rfc-editor.org/rfc/rfc6797) · OWASP — HTTP Headers Cheat Sheet (https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html)

CSP — protection from script injection

Needs attention · Severity: Medium · Hardening gap · 3/8

A policy protecting against malicious scripts exists in monitoring mode only.

Only Content-Security-Policy-Report-Only was found — violations are reported but not blocked.

Source data: Response headers from https://www.docusign.com/

Content-Security-Policy-Report-Only: default-src 'self' https://pref.docusign.com https://apps.docusign.com https://events.docusign.com https://momentum.docusign.com https://dsucustomers.docusign.com https://account.docusign.com https://account-d.docusign.com https://ecom.docusign.com https://support.docusign.com https://developers.docusign.com https://community.docusign.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://p.mdb.tools https://identity.mdb.tools https://sierra.chat:443 https://sierra.chat https://*.cloudfront.net https://cdn.jsdelivr.net https://cdn.prod.website-files.com https://cdnjs.cloudflare.com https://unpkg.com https://cdn4.mxpnl.com https://s.yimg.com https://tags.srv.stackadapt.com:443 https://cdn.yellowmessenger.com https://docusign-api.arkoselabs.com https://trk.techtarget.com https://cdn.optimizely.com https://www.googletagmanager.com https://players.brightcove.net https://cdn3.optimizely.com https://cdn.cookielaw.org https://vjs.zencdn.net https://cdn.sift.com https://tags.srv.stackadapt.com https://js.driftt.com https://connect.facebook.net https://snap.licdn.com https://bat.bing.com https://tag.demandbase.com https://www.knotch-cdn.com https://js.adsrvr.org https://rs.fullstory.com https://edge.fullstory.com https://googleads.g.doubleclick.net https://protect.docusign.net https://protect-d.docusign.net https://app.gatedcontent.com https://img.en25.com https://track.docusign.com https://www.google.com https://www.gstatic.com https://browser.sentry-cdn.com https://app.guideflow.com https://zn0oqzbba3l7g5ph4-docusign.siteintercept.qualtrics.com https://siteintercept.qualtrics.com https://80e3c780877f.cdn4.forter.com https://sadmin.brightcove.com https://platform.twitter.com https://bam.nr-data.net https://static.ads-twitter.com https://www.redditstatic.com https://chat.docusign.net https://sdk.inbenta.io https://apps.usw2.pure.cloud https://api-cdn.usw2.pure.cloud https://cdn.taboola.com https://trc.taboola.com https://www.influ2.com https://t.influ2.com/ https://hermes.docusign.com; script-src-elem 'self' 'unsafe-inline' 'unsafe-eval' blob: https://sierra.chat:443 https://sierra.chat https://*.cloudfront.net https://cdn.jsdelivr.net https://cdn.prod.website-files.com https://cdnjs.cloudflare.com https://cdn4.mxpnl.com https://s.yimg.com https://tags.srv.stackadapt.com:443 https://cdn.yellowmessenger.com https://docusign-api.arkoselabs.com https://trk.techtarget.com https://cdn.optimizely.com https://www.googletagmanager.com https://players.brightcove.net https://cdn3.optimizely.com https://cdn.cookielaw.org https://vjs.zencdn.net https://cdn.sift.com https://tags.srv.stackadapt.com https://tags.srv.stackadapt.com:443/events.js https://tags.srv.stackadapt.com/events.js https://js.driftt.com https://connect.facebook.net https://snap.licdn.com https://bat.bing.com https://tag.demandbase.com https://www.knotch-cdn.com https://js.adsrvr.org https://rs.fullstory.com https://edge.fullstory.com https://googleads.g.doubleclick.net https://protect.docusign.net https://protect-d.docusign.net https://app.gatedcontent.com https://img.en25.com https://track.docusign.com https://www.google.com https://www.gstatic.com https://browser.sentry-cdn.com https://app.guideflow.com https://zn0oqzbba3l7g5ph4-docusign.siteintercept.qualtrics.com https://siteintercept.qualtrics.com https://80e3c780877f.cdn4.forter.com https://sadmin.brightcove.com https://platform.twitter.com https://bam.nr-data.net https://static.ads-twitter.com https://www.redditstatic.com https://chat.docusign.net https://sdk.inbenta.io https://apps.usw2.pure.cloud https://api-cdn.usw2.pure.cloud https://cdn.taboola.com https://trc.taboola.com https://www.influ2.com https://t.influ2.com/ https://hermes.docusign.com https://identity.mdb.tools https://p.mdb.tools https://connect.facebook.net/en_US/fbevents.js https://cdn.yellowmessenger.com/plugin/widget-v2/latest/dist/main.min.js https://cdn.taboola.com/libtrc/unip/1790969/tfa.js https://cdn.sift.com/s.js https://bat.bing.com/bat.js https://www.influ2.com/tracker; style-src 'self' 'unsafe-inline' https://sierra.chat:443 https://sierra.chat https://cdn.prod.website-files.com https://cdn.yellowmessenger.com https://tags.srv.stackadapt.com https://app.gatedcontent.com https://www.gstatic.com https://app.guideflow.com https://sdk.inbenta.io; img-src 'self' data: blob: https://assets-global.website-files.com https://*.cloudfront.net https://sp.analytics.yahoo.com https://ecom.docusign.com https://cdn.prod.website-files.com https://connect.facebook.net https://r4-ym-uploads.s3-us-west-2.amazonaws.com https://r4.app.yellow.ai https://cdn.yellowmessenger.com https://www.google.com.ar https://www.google.co.kr https://www.google.co.nz https://www.google.com.hk https://www.google.com.pe https://translate.google.com https://www.google.co.id https://www.google.co.cr https://www.google.com.my https://www.google.cl https://www.googleadservices.com https://www.google.de https://www.google.it https://www.google.co.jp https://www.google.co.za https://www.google.es https://www.google.com.sg https://www.google.com.co https://www.google.co.uk https://www.google.co.in https://www.google.nl https://www.google.com.ph https://www.google.com.au https://www.google.ca https://www.google.com.br https://www.google.com https://www.google.com.mx https://www.google.fr https://secure.adnxs.com https://attr.ml-api.io https://attr-td.ml-api.io https://images.ctfassets.net https://cdn.bfldr.com https://metrics.brightcove.com https://cf-images.us-east-1.prod.boltdns.net https://hexagon-analytics.com https://s.ml-attr.com https://cdn.cookielaw.org https://id.rlcdn.com https://px.ads.linkedin.com https://frontdoor.knotch.it https://dsum-sec.casalemedia.com https://partners.tremorhub.com https://pixel.rubiconproject.com https://www.facebook.com https://segments.company-target.com https://www.linkedin.com https://px4.ads.linkedin.com https://bat.bing.com https://track.docusign.com https://www.gstatic.com https://storage.googleapis.com https://imagedelivery.net https://app.gatedcontent.com https://images.esign.docusign.com https://www.googletagmanager.com https://t.co https://analytics.twitter.com https://analytics.google.com https://alb.reddit.com https://googleads.g.doubleclick.net https://stats.g.doubleclick.net https://img-taboola.com https://trc.taboola.com https://t.influ2.com https://i.liadm.com https://match.adsrvr.org https://r4.app.yellow.ai; font-src 'self' data: https://sierra.chat:443 https://sierra.chat https://cdn.prod.website-files.com https://images.simplycodes.com https://stylesheets.pixiebrix.com https://cdn.jsdelivr.net https://cdn.yellowmessenger.com https://fonts.gstatic.com https://docucdn-a.akamaihd.net https://cdn.inbenta.io https://use.typekit.net https://api-cdn.usw2.pure.cloud https://api-cdn.usw2.pure.cloud; connect-src 'self' https://api.iterable.com https://api.sitelytics.tech https://p.mdb.tools https://sierra.chat:443 https://sierra.chat https://api-js.mixpanel.com https://api.mixpanel.com https://cdn.prod.website-files.com https://s.yimg.com https://cdn4.forter.com https://a9b3895076a445bdaf9a9aada0ab7287-80e3c780877f.cdn.forter.com https://31ff10b411e04c66a144663da6b34da5-80e3c780877f.cdn.forter.com https://3dcb810e88774d429c6dba71bbee8c34-80e3c780877f.cdn.forter.com https://tag.demandbase.com https://cdn.yellowmessenger.com https://autocomplete.demandbase.com https://segments.company-target.com https://ibc-flow.techtarget.com https://ingesteer.services-prod.nsvcs.net https://www.googletagmanager.com https://www.google.com.co https://www.google.com.mx https://www.google.co.uk https://www.google.es https://www.google.com.br https://www.google.com.sg https://www.google.com.in https://www.google.com.ph https://www.google.ca https://www.google.com.au https://rum.optimizely.com wss://r4.cloud.yellow.ai https://cdn8.forter.com https://12e748c623734740a09ab181abb7a3a1-80e3c780877f.cdn.forter.com https://cdn3.forter.com https://r4.cloud.yellow.ai https://siteperformancetest.net https://wtp.siteperformancetest.net https://privacyportal.onetrust.com https://region1.analytics.google.com https://stats.g.doubleclick.net https://telemetry-s.docusign.net https://telemetry.dev.docusign.net https://www.facebook.com https://www.google-analytics.com https://manifest.prod.boltdns.net https://frontdoor.knotch.it https://bat.bing.com https://bat.bing.net https://ingest.insights.ninetailed.co https://cdn.jsdelivr.net https://unpkg.com https://assets.ctfassets.net https://edge.api.brightcove.com https://house-fastly-signed-us-east-1-prod.brightcovecdn.com https://cdn.cookielaw.org https://telemetry.docusign.net https://geolocation.onetrust.com https://www.google.com https://experience.ninetailed.co https://edge.fullstory.com https://tags.srv.stackadapt.com https://api.company-target.com https://configs.knotch.com https://px.ads.linkedin.com https://rs.fullstory.com https://tag-logger.demandbase.com https://carddealer.knotch.com https://analytics.google.com https://insight.adsrvr.org https://logx.optimizely.com https://app.gatedcontent.com https://guideflow-api-eu-5cv4uu2lra-ew.a.run.app https://protect.docusign.net https://protect-d.docusign.net https://s566810826.t.eloqua.com https://insights.gatedcontent.com https://siteintercept.qualtrics.com https://cdn0.forter.com https://a.docusign.com https://datacollector.docusign.com https://datacollector-demo.docusign.com https://docusign-api.arkoselabs.com https://account.docusign.com https://account-d.docusign.com https://geo.docusign.com https://syndication.twitter.com https://pixel-config.reddit.com https://www.redditstatic.com https://www.googleadservices.com https://api.inbenta.io https://api-gcu1.inbenta.io https://apps.usw2.pure.cloud https://api-cdn.usw2.pure.cloud https://psb.taboola.com https://pips.taboola.com https://cds.taboola.com https://trc-events.taboola.com https://t.influ2.com https://www.influ2.com; frame-src 'self' https://www.youtube.com https://players.brightcove.net https://js.driftt.com https://www.googletagmanager.com https://s.company-target.com https://insight.adsrvr.org https://match.adsrvr.org https://pixel.rubiconproject.com https://cm.g.doubleclick.net https://ib.adnxs.com https://td.doubleclick.net https://www.google.com https://app.guideflow.com https://platform.twitter.com https://chat.docusign.net https://a275532918.cdn.optimizely.com https://app.netlify.com https://apps.usw2.pure.cloud https://api-cdn.usw2.pure.cloud https://hermes.docusign.com https://tsdtocl.com https://docusign-api.arkoselabs.com; media-src 'self' blob: https://manifest.prod.boltdns.net https://house-fastly-signed-us-east-1-prod.brightcovecdn.com https://videos.ctfassets.net https://house-fastly-signed-us-east-1-prod.brightcovecdn.com https://house-fastly-signed-us-east-1-prod.brightcovecdn.com:443 https://manifest.prod.boltdns.net; worker-src 'self' blob:; base-uri 'self'; form-action 'self' https://trial.docusign.com https://ecomservices.docusign.com https://na.account.docusign.com https://app.gatedcontent.com https://datacollector.docusign.com https://datacollector-demo.docusign.com https://docusign-api.arkoselabs.com https://account.docusign.com https://account-d.docusign.com https://protect.docusign.net https://protect-d.docusign.net https://track.docusign.com; object-src 'self' https://players.brightcove.net; report-to csp-endpoint

$ curl -sIL https://docusign.com/ | grep -i "Content-Security-Policy-Report-Only"

Fix recommendation (effort: Complex)

First publish Content-Security-Policy-Report-Only — it blocks nothing, it only reports.
Collect violations for a week or two and tune the policy to your legitimate sources.
Switch to the Content-Security-Policy header and replace 'unsafe-inline' with a nonce or hash.

/*
  Content-Security-Policy-Report-Only: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'

Safety: This change is made in your server/CDN settings. Test on staging before production. An overly strict CSP will break scripts — that's why you start in Report-Only mode.

Documentation: MDN — Content Security Policy (https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP) · OWASP — CSP Cheat Sheet (https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html)

Clickjacking protection

Failed · Severity: Medium · Hardening gap · 0/5

Missing X-Frame-Options / frame-ancestors: this removes one layer of protection against clickjacking.

No valid X-Frame-Options and no frame-ancestors in the CSP.

Source data: Response headers from https://www.docusign.com/

X-Frame-Options: (missing)

$ curl -sIL https://docusign.com/ | grep -i "X-Frame-Options"

Fix recommendation (effort: Easy)

Add X-Frame-Options: SAMEORIGIN (or DENY if the site is never embedded anywhere).
Also set frame-ancestors in the CSP — the modern alternative.

/*
  X-Frame-Options: SAMEORIGIN

Safety: This change is made in your server/CDN settings. Test on staging before production. If partners embed the site in an iframe, add them to frame-ancestors instead of using DENY.

Documentation: MDN — X-Frame-Options (https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-Frame-Options) · OWASP — Clickjacking Defense (https://cheatsheetseries.owasp.org/cheatsheets/Clickjacking_Defense_Cheat_Sheet.html)

X-Content-Type-Options

Passed · Severity: OK · 4/4

The browser won't guess file types in a way that could execute code.

nosniff is set.

Source data: Response headers from https://www.docusign.com/

X-Content-Type-Options: nosniff

$ curl -sIL https://docusign.com/ | grep -i "X-Content-Type-Options"

Documentation: MDN — X-Content-Type-Options (https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-Content-Type-Options) · OWASP — HTTP Headers Cheat Sheet (https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html)

Referrer-Policy

Failed · Severity: Low · Hardening gap · 0/3

Internal URLs (including parameters) may leak to external sites.

Referrer-Policy is missing; the browser will use its default.

Source data: Response headers from https://www.docusign.com/

Referrer-Policy: (missing)

$ curl -sIL https://docusign.com/ | grep -i "Referrer-Policy"

Fix recommendation (effort: Easy)

Set Referrer-Policy: strict-origin-when-cross-origin.

/*
  Referrer-Policy: strict-origin-when-cross-origin

Safety: This change is made in your server/CDN settings. Test on staging before production.

Documentation: MDN — Referrer-Policy (https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Referrer-Policy) · OWASP — HTTP Headers Cheat Sheet (https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html)

Permissions-Policy

Needs attention · Severity: Low · Hardening gap · 0/2

Access to sensitive features like the camera and location isn't restricted.

Missing Permissions-Policy header.

Source data: Response headers from https://www.docusign.com/

Permissions-Policy: (missing)

$ curl -sIL https://docusign.com/ | grep -i "Permissions-Policy"

Fix recommendation (effort: Easy)

Disable browser features the site doesn't need (camera, microphone, geolocation).

/*
  Permissions-Policy: camera=(), microphone=(), geolocation=()

Safety: This change is made in your server/CDN settings. Test on staging before production. Don't disable a feature the site actually uses.

Documentation: MDN — Permissions-Policy (https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Permissions-Policy) · OWASP — HTTP Headers Cheat Sheet (https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html)

Software version disclosure

Passed · Severity: OK · unscored

The server doesn't disclose software versions.

No version numbers found in the Server / X-Powered-By headers.

Source data: Response headers from https://www.docusign.com/

server: cloudflare
x-powered-by: (missing)

$ curl -sIL https://docusign.com/ | grep -iE "^(server|x-powered-by)"

Documentation: OWASP — HTTP Headers Cheat Sheet (https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html)

DNSSEC — signed DNS records

Passed · Severity: OK · 7/7

The domain's records are digitally signed and hard to forge.

An AD (Authenticated Data) flag was returned by a validating resolver.

Source data: DNS-over-HTTPS (Cloudflare / Google): AD flag and DS record at the parent

AD = true

$ dig +dnssec docusign.com | grep -E "flags:.* ad"

Documentation: RFC 4033 — DNSSEC (https://www.rfc-editor.org/rfc/rfc4033) · ICANN — DNSSEC: what and why (https://www.icann.org/resources/pages/dnssec-what-is-it-why-important-2019-03-05-en)

CAA — who may issue certificates

Needs attention · Severity: Low · Hardening gap · 0/5

Any certificate authority can issue a certificate for the domain, raising the risk of mis-issuance.

No CAA records found. RFC 8659 lets the domain owner restrict which CAs are authorized.

Source data: DNS CAA docusign.com

(no CAA records found)

$ dig +short CAA docusign.com

Fix recommendation (effort: Easy)

Identify which certificate authority issued your current certificate (see the certificate check).
Publish CAA for that authority only, and add iodef to receive alerts.

docusign.com.  CAA  0 issue "letsencrypt.org"
docusign.com.  CAA  0 iodef "mailto:security@docusign.com"

Safety: DNS changes are made only at your DNS provider. This tool only reads public data and changes nothing on the domain. If your CDN issues certificates on your behalf, include it too — otherwise certificate renewal will fail.

Documentation: RFC 8659 — CAA (https://www.rfc-editor.org/rfc/rfc8659)

DNS server redundancy

Passed · Severity: OK · 3/3

The domain is served by several DNS servers, so one server failing won't take it down.

5 NS servers.

Source data: DNS NS docusign.com

a1-246.akam.net
a10-65.akam.net
a11-66.akam.net
a14-67.akam.net
a24-64.akam.net

$ dig +short NS docusign.com

Documentation: RFC 2182 — Secondary DNS server operation (https://www.rfc-editor.org/rfc/rfc2182)

Indicative alignment

Best-practice mapping of public findings to common frameworks. Passive scanning tests public configuration only; it doesn't prove compliance or a violation.

Google & Yahoo sender rulesNo gaps observed
PCI DSS v4.02 observed gaps
NIS2 / vendor due diligence1 observed gaps
SOC 2 / ISO 27001 baseline2 observed gaps

Indicative alignment only, based on public configuration. It doesn't establish whether a framework applies to you, and it isn't legal advice, an audit or a certification.

Public DNS records

A	docusign.com	3.33.186.135 \| 15.197.167.90
AAAA	docusign.com	—
MX	docusign.com	10 mxa-00567a01.gslb.pphosted.com \| 10 mxb-00567a01.gslb.pphosted.com
NS	docusign.com	a1-246.akam.net \| a10-65.akam.net \| a11-66.akam.net \| a14-67.akam.net \| a24-64.akam.net
TXT	docusign.com	MS=ms67859169 \| MS=ms75680623 \| 1qrrz3xy28s3kb9mxsdwzmy2833rjr8d \| 3b9t4qnlb14b3j4f1zk8b6zkbhjl24sz \| 7cb4c0f6185b4c069917a859c6018188 \| _1n3zuex515pwaz9ux57pdo76zu6mw8p \| _7je1xuhn68icu22h534578y7d1d9jpg \| _g5xgrrxwbnpsohyhqy1gtb935rmb0q2 \| _ntm9vxjredwhj592dazupru4ypjuexq \| _x2tjmfhsbtiixj6uei9the03696pl86 \| _x9lx42qvkft4lvx5xnbrpf4ffa11cye \| nm7y5n5w3r41kh0mgm0hhfx0w22ml5pc \| mandrill_verify.Vnq0HszA1CepkTznip_FYA \| apple-domain-verification=L5oOwEIjTPfCi6qy \| 7kvhIewSmfzYT6xQKHexezvzAlieUeUZTnbhet91q10= \| SFMC-uwMHeqLPPYzwqQhUlD0eB8l0YUdd__hku8JPxB5g \| docusign=07cc1948-4667-458d-8221-2d01c6ec0423 \| docusign=9c3ea3d7-4aee-40a1-82df-ed91479a4356 \| jamf-site-verification=2t94XG2CN8VMI8lcBkkIjQ \| canva-site-verification=lKl3pnMYLTq05XjpXd-aRg \| bw=xnUy9wiC25MaMkPcRxA8xYZJztXH2PNy3k1fep88y4W5 \| traction-guest=94540d95-8b19-47a0-a6dc-cb43746fb4b6 \| bugcrowd-verification=a9aee6c6b285fc3c8a0a9429a51a56c6 \| docker-verification=8619c622-33ca-4c2e-823a-1ac5f9a40666 \| miro-verification=3bbe2265b6aac85cdf0d62480f55aa1f98d0f111 \| facebook-domain-verification=xmeljmwmkulb55922d6figl3y5byep \| mixpanel-domain-verify=0b9a84b6-63de-429c-8019-4b63be01fb1b \| snowflake-verification=62ea4659-01a0-1000-8010-0000000003eb \| aws-securityagent-domain-verification=MYSYu1yv9PFsmRPgAKGk5A \| onetrust-domain-verification=49280882734744dcabbfaadeb3461b2c \| onetrust-domain-verification=6bc567834121445384b6077cb6e8afef \| anthropic-domain-verification-kv28r4=ZfVCousFdYb80mnXy7VPHYL06 \| zoom-domain-verification = 6b92f302-c1a7-4e4f-8ec9-8eaf257af12b \| slack-domain-verification=xKnCUoFDpdlXja9hJNPLKHX0FLCKe0sdykBNbVnA \| google-site-verification=5q70TaAamSBg8f2gexe3fcEFgEqhyqclV0-4VgkbI7s \| google-site-verification=AGfUvVkjL9meSSNuLA75PmgTGHLYmykqTT7Ce-g88rY \| google-site-verification=BQe950Ny4H12LPrq3nX463djdqDtDcuZQF3k3-d6NxU \| google-site-verification=CM-L3d16YNO0e15SsBdJGPDKx0_1crb8vTm5vkLmC6k \| google-site-verification=FN0j932YtodsUHk8u5CSrN-WC3i4_VwZ-xa5ym7awdQ \| google-site-verification=IWgC1RiG-IsEUfC5AFNQzXVUHJO2BR7-xVTipEIQlec \| google-site-verification=ZzNmIdIl627l_6ar2mV4pSqhvFJtkYcfLZ962k1KRnY \| google-site-verification=gpZenQNezQEr73t2yLMsnF_gry0YgJzgpkYq6W5DGIQ \| apple-domain-verification=8u0Ek-_5Lp8mxGcRBVAKiKfGhvkXH3HEiEY4-LeBnls \| apple-domain-verification=LAB8xhMNFmSTMJwu7SSTUsZpOu22-rpPp9B9Rrcnsoo \| apple-domain-verification=_ZvKL6PpEZPpi48b9rUJSq6TrM_-RizDYjh_i4v6038 \| apple-domain-verification=fjunviKNr6WBcthwM7i9spdmv49RO24wosccHUsQk2g \| h1-domain-verification=pHHzEmL9oApG4ggd2wLDoA6azwUfzKruNcd7v5iPB3jP5ujK \| mgverify=38a3538020c90a4c88374e1efa5070d6391495967d03e54c10041cecf79972bd \| hubspot-developer-verification=MDBhOGRhNWUtNTk2MS00MzE3LTg4ZDUtZGJhNDg1NDJhYTQz \| hubspot-developer-verification=MDJiNTY5MjMtNWNhZi00ZDhmLTgxMzQtYzc5OTY0NTQ4ZmEz \| hubspot-developer-verification=MGIxNzNjZGYtNmUyZS00MWMzLTg5OGMtMDQ3MTY4N2RmZDY1 \| hubspot-developer-verification=MGYzYjkxYWItMWNiMy00MTIyLWFlYzItZWEzZDVkNjdmMzM4 \| stripe-verification=27C29C0CFD9F712A57B1297FAB27767A9E5B4F602E742CF0895FBEA1DBD470F3 \| drift-domain-verification=3541dd3ad16ae6eddffcc507951754ada8b86ead750ec5c0b15c121d6d551714 \| adobe-idp-site-verification=86c7121fb82e768f19ab6e628c528aa9134334f2e9c7b86a0a3c68f1cf378902 \| cisco-ci-domain-verification=3d468b9e2cd00e2567c38675a66c3a06c78b818c6ce596796357e0630e672bab \| atlassian-domain-verification=WXKa5/VcaS3xJ9EEfRIwU5FnU4Y1/qPXrimoN79BmpnAHMTBGDo6buWMhCegZVQb \| atlassian-domain-verification=jtsHBHsm9NkNrMUyu8WV1v8OW5ktqP/CFZJJF6vAd0BTyGxz3/l5xcBIakVIvZGK \| dell-technologies-domain-verification=docusign.com_31ef6946-1e18-4eaa-a1df-b5416c91e315_1758706056 \| v=spf1 include:%{ir}.%{v}.%{d}.spf.has.pphosted.com ip4:205.220.176.129 ip4:205.220.164.129 ip4:205.220.166.129 ip4:205.220.177.61 include:_spf.google.com -all
TXT	_dmarc.docusign.com	v=DMARC1; p=reject; sp=reject; adkim=r; aspf=r; rua=mailto:dmarc_rua@emaildefense.proofpoint.com; ruf=mailto:dmarc_ruf@emaildefense.proofpoint.com; fo=1;
CAA	docusign.com	—
DS	docusign.com	34436 8 2 50fae3e425bde1306e5c270700b32cb2c146cac9fb635567b81ac7fbe575c3e1

What to do first

What this grade means

Score by category

Fix priorities

Findings

SPF — who may send mail for the domain

DMARC — anti-spoofing policy

DKIM — digital signature on email

MX — inbound mail routing

HTTPS available

HTTP → HTTPS redirect

SSL/TLS certificate validity

HSTS — enforce encryption in the browser

CSP — protection from script injection

Clickjacking protection

X-Content-Type-Options

Referrer-Policy

Permissions-Policy

Software version disclosure

DNSSEC — signed DNS records

CAA — who may issue certificates

DNS server redundancy

Indicative alignment

Public DNS records

Check your own domain