ft.com

An authorized sender list is defined and mail from other servers is rejected.

Valid SPF record with -all. 7 of the 10 allowed DNS lookups.

v=spf1 include:_spf.google.com include:mktomail.com include:_spf.salesforce.com include:email.hivebrite.com include:spf.mandrillapp.com include:24982124.spf07.hubspotemail.net include:spf.alida.io -all

$ dig +short TXT ft.com

Forged email in the company's name is blocked by mail servers.

Policy p=reject.

v=DMARC1; p=reject; pct=100; rua=mailto:dmarc@ft.com; ruf=mailto:dmarc@ft.com

$ dig +short TXT _dmarc.ft.com

A DKIM public key is published. On its own this doesn't prove outgoing mail is signed or aligned with your From domain.

DKIM public key found for selector: google, s1, s2. Confirm signing with dkim=pass in a sent message's Authentication-Results.

google._domainkey: v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCge4SBUU2LDdTqGC/mDp7HemXB8IgADojo…
s1._domainkey: k=rsa; t=s; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC+0GqHvbMEmQJnh7pp8zsTmj8H3NALhnSEYl6k…
s2._domainkey: k=rsa; t=s; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDCe6X90c32x3YnI3BhRKaA6V8SRwWLin0NbR3Q…

$ dig +short TXT google._domainkey.ft.com

Mail exchangers are published for the domain.

2 MX record(s). This shows where inbound mail is routed, not whether mail is sent from the domain.

10 mxa.germany.inbound.cf-emailsecurity.net
10 mxb.germany.inbound.cf-emailsecurity.net

$ dig +short MX ft.com

The site loads over an encrypted connection.

https://ft.com/ returned HTTP 403 (final URL: https://www.ft.com/). Client-side certificate validation passed.

HTTP 403
Final URL: https://www.ft.com/

$ curl -sIL https://ft.com/

Visitors arriving at an unencrypted address are automatically sent to the secure version.

HTTP 301 → https://www.ft.com/

HTTP 301
Location: https://www.ft.com/

$ curl -sI http://ft.com/ | grep -iE "^(HTTP|location)"

The certificate was accepted by a validating TLS client at scan time.

Live TLS handshake succeeded. Latest issuance in CT logs: Amazon Trust Services, expiring 2027-05-13 (179 days). CT shows issued certificates, not necessarily the one served — confirm dates with the verify command.

Live TLS handshake: certificate accepted
CT logs (context only, not scored):
Issuer: Amazon Trust Services
Valid from: 2026-10-28
Valid until: 2027-05-13
Names: ft.com
Based on Certificate Transparency logs; may not reflect the certificate currently served.

$ echo | openssl s_client -connect ft.com:443 -servername ft.com 2>/dev/null | openssl x509 -noout -issuer -dates

Browsers are told to always use an encrypted connection to the site.

max-age=63072000 (730 days), includeSubDomains, preload. ≥ 180 days recommended.

Strict-Transport-Security: max-age=63072000; includeSubDomains; preload

$ curl -sIL https://ft.com/ | grep -i "Strict-Transport-Security"

Missing Content-Security-Policy header: this removes one layer of protection against script injection.

No Content-Security-Policy header found.

Content-Security-Policy: (missing)

$ curl -sIL https://ft.com/ | grep -i "Content-Security-Policy"

/*
  Content-Security-Policy-Report-Only: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'

The site can't be embedded by foreign sites.

X-Frame-Options: SAMEORIGIN

X-Frame-Options: SAMEORIGIN

$ curl -sIL https://ft.com/ | grep -i "X-Frame-Options"

The browser won't guess file types in a way that could execute code.

nosniff is set.

X-Content-Type-Options: nosniff

$ curl -sIL https://ft.com/ | grep -i "X-Content-Type-Options"

Internal URLs don't leak to external sites.

Referrer-Policy: same-origin

Referrer-Policy: same-origin

$ curl -sIL https://ft.com/ | grep -i "Referrer-Policy"

The site restricts access to sensitive browser features.

Permissions-Policy: accelerometer=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),magnetometer=(),microphone=(),payment=(),publickey-credential

Permissions-Policy: accelerometer=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=(),xr-spatial-tracking=*

$ curl -sIL https://ft.com/ | grep -i "Permissions-Policy"

The server doesn't disclose software versions.

No version numbers found in the Server / X-Powered-By headers.

server: cloudflare
x-powered-by: (missing)

$ curl -sIL https://ft.com/ | grep -iE "^(server|x-powered-by)"

The domain's records aren't signed, so in some scenarios users could be redirected to a forged server.

No DS record is published at the parent zone, so there's no DNSSEC chain of trust for this zone.

AD = false
DS ft.com: NODATA

$ dig +short DS ft.com

dig +dnssec ft.com SOA
delv ft.com

Only authorized certificate authorities can issue certificates for the domain.

CAA records: 0 iodef "mailto:cyber.security@ft.com" | 0 issue "amazon.com" | 0 issue "certainly.com" | 0 issue "digicert.com" | 0 issue "globalsign.com" | 0 issue "letsencrypt.org" | 0 issue "pki.goog; cansignhttpexchanges=yes" | 0 issuewild "amazon.com" | 0 issuewild "certainly.com" | 0 issuewild "digicert.com" | 0 issuewild "letsencrypt.org" | 0 issuewild "pki.goog; cansignhttpexchanges=yes"

0 iodef "mailto:cyber.security@ft.com"
0 issue "amazon.com"
0 issue "certainly.com"
0 issue "digicert.com"
0 issue "globalsign.com"
0 issue "letsencrypt.org"
0 issue "pki.goog; cansignhttpexchanges=yes"
0 issuewild "amazon.com"
0 issuewild "certainly.com"
0 issuewild "digicert.com"
0 issuewild "letsencrypt.org"
0 issuewild "pki.goog; cansignhttpexchanges=yes"

$ dig +short CAA ft.com

The domain is served by several DNS servers, so one server failing won't take it down.

4 NS servers.

ns-1447.awsdns-52.org
ns-1984.awsdns-56.co.uk
ns-52.awsdns-06.com
ns-530.awsdns-02.net

$ dig +short NS ft.com