Digital exposure report
github.com
Good shape, with a few gaps worth closing this quarter.
Scanned: 2026-11-15 19:12 UTC
Full coverage: every applicable check was assessed.
What to do first
- 1.
Turn on DNS signing for your domain
Signing helps resolvers detect forged answers about your domain.
Who can fix it: Your domain registrar or DNS provider
How to verify after the fix
dig +short DS github.com
- 2.
Turn off browser features your site does not use
This limits access to things like camera or location if a page is misused.
Who can fix it: Your website developer or web host
How to verify after the fix
curl -sIL https://github.com/ | grep -i "Permissions-Policy"
A starting point, not a security guarantee.
What this grade means
- Tested hostname
- github.com
- Website request
- GET https://github.com/
- Scan time
- 2026-11-15 19:12:26 UTC
- Grading method
- Version 2How grading works
- Unverified or excluded checks
- None. Every applicable check was assessed.
This is a snapshot of the public configuration checks listed in this report. It does not verify the site's owner, business legitimacy, application security, or absence of vulnerabilities. It is not a security certification.
Score by category
| Email security | 27/30 | Spoofing email from this domain is hard. |
| Encryption & certificate | 25/25 | Traffic to the site is encrypted and the certificate is valid. |
| Browser protections | 28/30 | The site instructs browsers to block common attacks. |
| DNS infrastructure | 8/15 | The domain's infrastructure works, but recommended hardening is missing. |
Fix priorities
- 1.MediumDNSSEC — signed DNS records · Hardening gap+7
- 2.LowPermissions-Policy · Hardening gap+2
Findings
SPF — who may send mail for the domain
Passed · Severity: OK · 9/10An authorized sender list is defined; mail from other servers is flagged as suspicious.
~all (softfail) — acceptable when combined with enforced DMARC. 8 of 10 DNS lookups.
v=spf1 ip4:192.30.252.0/22 include:spf.protection.outlook.com include:_netblocks.google.com include:_netblocks2.google.com include:mail.zendesk.com include:_spf.salesforce.com include:servers.mcsv.net include:mktomail.com include:sendgrid.net ip4:62.253.227.114 ip4:166.78.69.169 ip4:166.78.69.170 ip4:166.78.71.131 ~all
$ dig +short TXT github.com
DMARC — anti-spoofing policy
Passed · Severity: OK · 13/15Forged email in the company's name is sent to the spam folder.
Policy p=quarantine. p=quarantine — consider moving to p=reject.
v=DMARC1; p=quarantine; sp=reject; pct=100; rua=mailto:dmarc@github.com; ruf=mailto:dmarc@github.com; fo=1
$ dig +short TXT _dmarc.github.com
DKIM — digital signature on email
Passed · Severity: OK · 5/5A DKIM public key is published. On its own this doesn't prove outgoing mail is signed or aligned with your From domain.
DKIM public key found for selector: google, selector1, k1, s1, s2. Confirm signing with dkim=pass in a sent message's Authentication-Results.
google._domainkey: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAj6T5sl/RwdSqGoYWaWaFbS2UAeyP… selector1._domainkey: v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCxZC/z2cK+2s1f/ktzSDSeFzkfIHrjwtGF… k1._domainkey: k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDbNrX2cY/GUKIFx2G/1I00ftdAj713WP9AQ1xir85i8… s1._domainkey: k=rsa; t=s; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAyn3fMCVpb7ryIRKOGXhXVGYmsWUitNlS… s2._domainkey: k=rsa; t=s; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnNt2/H6bKs99C6DAaokPp62KN9mKaD20…
$ dig +short TXT google._domainkey.github.com
MX — inbound mail routing
Passed · Severity: OK · unscoredMail exchangers are published for the domain.
1 MX record(s). This shows where inbound mail is routed, not whether mail is sent from the domain.
0 github-com.mail.protection.outlook.com
$ dig +short MX github.com
HTTPS available
Passed · Severity: OK · 10/10The site loads over an encrypted connection.
https://github.com/ returned HTTP 200 (final URL: https://github.com/). Client-side certificate validation passed.
HTTP 200 Final URL: https://github.com/
$ curl -sIL https://github.com/
HTTP → HTTPS redirect
Passed · Severity: OK · 7/7Visitors arriving at an unencrypted address are automatically sent to the secure version.
HTTP 301 → https://github.com/
HTTP 301 Location: https://github.com/
$ curl -sI http://github.com/ | grep -iE "^(HTTP|location)"
SSL/TLS certificate validity
Passed · Severity: OK · 8/8The certificate was accepted by a validating TLS client at scan time.
Live TLS handshake succeeded. Latest issuance in CT logs: Sectigo, expiring 2027-01-27 (73 days). CT shows issued certificates, not necessarily the one served — confirm dates with the verify command.
Live TLS handshake: certificate accepted CT logs (context only, not scored): Issuer: Sectigo Valid from: 2026-10-30 Valid until: 2027-01-27 Names: github.com, www.github.com Based on Certificate Transparency logs; may not reflect the certificate currently served.
$ echo | openssl s_client -connect github.com:443 -servername github.com 2>/dev/null | openssl x509 -noout -issuer -dates
HSTS — enforce encryption in the browser
Passed · Severity: OK · 8/8Browsers are told to always use an encrypted connection to the site.
max-age=31536000 (365 days), includeSubDomains, preload. ≥ 180 days recommended.
Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
$ curl -sIL https://github.com/ | grep -i "Strict-Transport-Security"
CSP — protection from script injection
Passed · Severity: OK · 8/8The site restricts which scripts are allowed to run.
CSP is set without permissive sources in script-src.
Content-Security-Policy: default-src 'none'; base-uri 'self'; child-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com *.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com github.githubassets.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com proxy.individual.githubcopilot.com proxy.business.githubcopilot.com proxy.enterprise.githubcopilot.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net productionresultssa1.blob.core.windows.net productionresultssa2.blob.core.windows.net productionresultssa3.blob.core.windows.net productionresultssa4.blob.core.windows.net productionresultssa5.blob.core.windows.net productionresultssa6.blob.core.windows.net productionresultssa7.blob.core.windows.net productionresultssa8.blob.core.windows.net productionresultssa9.blob.core.windows.net productionresultssa10.blob.core.windows.net productionresultssa11.blob.core.windows.net productionresultssa12.blob.core.windows.net productionresultssa13.blob.core.windows.net productionresultssa14.blob.core.windows.net productionresultssa15.blob.core.windows.net productionresultssa16.blob.core.windows.net productionresultssa17.blob.core.windows.net productionresultssa18.blob.core.windows.net productionresultssa19.blob.core.windows.net productionresultssa30.blob.core.windows.net productionresultssa31.blob.core.windows.net productionresultssa32.blob.core.windows.net github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com wss://alive-staging.github.com api.githubcopilot.com api.individual.githubcopilot.com api.business.githubcopilot.com api.enterprise.githubcopilot.com wss://production-copilot-host.webpubsub.azure.com wss://production-copilot-host-centralus.webpubsub.azure.com wss://production-copilot-host-centralus-02.webpubsub.azure.com wss://production-copilot-host-westus.webpubsub.azure.com wss://production-copilot-host-westus3.webpubsub.azure.com wss://production-copilot-host-eastasia.webpubsub.azure.com wss://production-copilot-host-austriaeast.webpubsub.azure.com api.github.com/cmc_internal/api/ edge.fullstory.com rs.fullstory.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com copilot-workspace.githubnext.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com www.youtube-nocookie.com; img-src 'self' data: blob: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com private-avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com release-assets.githubusercontent.com secured-user-images.githubusercontent.com user-images.githubusercontent.com private-user-images.githubusercontent.com opengraph.githubassets.com repository-images.githubusercontent.com marketplace-screenshots.githubusercontent.com copilotprodattachments.blob.core.windows.net/github-production-copilot-attachments/ github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com explore-feed.github.com *.googleusercontent.com objects-origin.githubusercontent.com *.githubusercontent.com images.ctfassets.net/8aevphvgewt8/; manifest-src 'self'; media-src github.com user-images.githubusercontent.com secured-user-images.githubusercontent.com private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com github.githubassets.com assets.ctfassets.net/8aevphvgewt8/ videos.ctfassets.net/8aevphvgewt8/; script-src github.githubassets.com 'sha256-6AKuI+cDd1MoUL1u4eqrA9PXmnPAkOB4h7421hPUUm0='; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/
$ curl -sIL https://github.com/ | grep -i "Content-Security-Policy"
Clickjacking protection
Passed · Severity: OK · 5/5The site can't be embedded by foreign sites.
X-Frame-Options: deny frame-ancestors 'none'
X-Frame-Options: deny CSP frame-ancestors: 'none'
$ curl -sIL https://github.com/ | grep -i "X-Frame-Options"
X-Content-Type-Options
Passed · Severity: OK · 4/4The browser won't guess file types in a way that could execute code.
nosniff is set.
X-Content-Type-Options: nosniff
$ curl -sIL https://github.com/ | grep -i "X-Content-Type-Options"
Referrer-Policy
Passed · Severity: OK · 3/3Internal URLs don't leak to external sites.
Referrer-Policy: origin-when-cross-origin, strict-origin-when-cross-origin
Referrer-Policy: origin-when-cross-origin, strict-origin-when-cross-origin
$ curl -sIL https://github.com/ | grep -i "Referrer-Policy"
Permissions-Policy
Needs attention · Severity: Low · Hardening gap · 0/2Access to sensitive features like the camera and location isn't restricted.
Missing Permissions-Policy header.
Permissions-Policy: (missing)
$ curl -sIL https://github.com/ | grep -i "Permissions-Policy"
- Disable browser features the site doesn't need (camera, microphone, geolocation).
/* Permissions-Policy: camera=(), microphone=(), geolocation=()
Safety: This change is made in your server/CDN settings. Test on staging before production. Don't disable a feature the site actually uses.
Software version disclosure
Passed · Severity: OK · unscoredThe server doesn't disclose software versions.
No version numbers found in the Server / X-Powered-By headers.
server: cloudflare x-powered-by: (missing)
$ curl -sIL https://github.com/ | grep -iE "^(server|x-powered-by)"
DNSSEC — signed DNS records
Needs attention · Severity: Medium · Hardening gap · 0/7The domain's records aren't signed, so in some scenarios users could be redirected to a forged server.
No DS record is published at the parent zone, so there's no DNSSEC chain of trust for this zone.
AD = false DS github.com: NODATA
$ dig +short DS github.com
- Enable DNSSEC at your DNS provider (one click at most providers).
- Copy the DS record your provider generates to your domain registrar.
- Wait for propagation and verify with DNSViz.
dig +dnssec github.com SOA delv github.com
Safety: DNS changes are made only at your DNS provider. This tool only reads public data and changes nothing on the domain. A wrong DS record at the registrar will make the domain stop resolving — copy it exactly from the provider.
CAA — who may issue certificates
Passed · Severity: OK · 5/5Only authorized certificate authorities can issue certificates for the domain.
CAA records: 0 issue "digicert.com" | 0 issue "globalsign.com" | 0 issue "letsencrypt.org" | 0 issue "sectigo.com" | 0 issuewild "digicert.com" | 0 issuewild "letsencrypt.org" | 0 issuewild "sectigo.com"
0 issue "digicert.com" 0 issue "globalsign.com" 0 issue "letsencrypt.org" 0 issue "sectigo.com" 0 issuewild "digicert.com" 0 issuewild "letsencrypt.org" 0 issuewild "sectigo.com"
$ dig +short CAA github.com
DNS server redundancy
Passed · Severity: OK · 3/3The domain is served by several DNS servers, so one server failing won't take it down.
8 NS servers.
dns1.p08.nsone.net dns2.p08.nsone.net dns3.p08.nsone.net dns4.p08.nsone.net ns-1283.awsdns-32.org ns-1707.awsdns-21.co.uk ns-421.awsdns-52.com ns-520.awsdns-01.net
$ dig +short NS github.com
Indicative alignment
Best-practice mapping of public findings to common frameworks. Passive scanning tests public configuration only; it doesn't prove compliance or a violation.
- Google & Yahoo sender rulesNo gaps observed
- PCI DSS v4.0No gaps observed
- NIS2 / vendor due diligence1 observed gaps
- SOC 2 / ISO 27001 baselineNo gaps observed
Indicative alignment only, based on public configuration. It doesn't establish whether a framework applies to you, and it isn't legal advice, an audit or a certification.
Public DNS records
| A | github.com | 140.82.114.4 |
| AAAA | github.com | — |
| MX | github.com | 0 github-com.mail.protection.outlook.com |
| NS | github.com | dns1.p08.nsone.net | dns2.p08.nsone.net | dns3.p08.nsone.net | dns4.p08.nsone.net | ns-1283.awsdns-32.org | ns-1707.awsdns-21.co.uk | ns-421.awsdns-52.com | ns-520.awsdns-01.net |
| TXT | github.com | 00Dd0000000hHE0=1TBKg000000TN2r | MS=6BF03E6AF5CB689E315FB6199603BABF2C88D805 | MS=ms44452932 | MS=ms58704441 | TAILSCALE-xOzoDvFUzZr5YYVCQFuD | adobe-idp-site-verification=b92c9e999aef825edc36e0a3d847d2dbad5b2fc0e05c79ddd7a16139b48ecf4b | anthropic-domain-verification-4az7qn=if8YWuRRqwLycGJDooumzHtxm | apple-domain-verification=RyQhdzTl6Z6x8ZP4 | atlassian-domain-verification=jjgw98AKv2aeoYFxiL/VFaoyPkn3undEssTRuMg6C/3Fp/iqhkV4HVV7WjYlVeF8 | calendly-site-verification=at0DQARi7IZvJtXQAWhMqpmIzpvoBNF7aam5VKKxP | cursor-domain-verification-gtfwmt=1rfLOtiTngX5QSxD5HvNKTvm3 | docusign=087098e3-3d46-47b7-9b4e-8a23028154cd | facebook-domain-verification=39xu4jzl7roi7x0n93ldkxjiaarx50 | google-site-verification=82Le34Flgtd15ojYhHlGF_6g72muSjamlMVThBOJpks | google-site-verification=UTM-3akMgubp6tQtgEuAkYNYLyYAvpTnnSrDMWoDR3o | jamf-site-verification=XtaPNIYghF_e_xRDI8CjgQ | krisp-domain-verification=ZlyiK7XLhnaoUQb2hpak1PLY7dFkl1WE | loom-site-verification=f3787154f1154b7880e720a511ea664d | miro-verification=d2e174fdb00c71e0bcf58f8e58c3da2dd80dcfa9 | openai-domain-verification=dv-3nh33eQwdkotMIAzLrIDVZo1 | serval-domain-verification-ydryhj=qbkiEakpwEpTvHh5fIiCqtaue | shopify-verification-code=t1YPwcmvnxZyBycaCpk1MPyWoFs72o | stripe-verification=f88ef17321660a01bab1660454192e014defa29ba7b8de9633c69d6b4912217f | v=spf1 ip4:192.30.252.0/22 include:spf.protection.outlook.com include:_netblocks.google.com include:_netblocks2.google.com include:mail.zendesk.com include:_spf.salesforce.com include:servers.mcsv.net include:mktomail.com include:sendgrid.net ip4:62.253.227.114 ip4:166.78.69.169 ip4:166.78.69.170 ip4:166.78.71.131 ~all |
| TXT | _dmarc.github.com | v=DMARC1; p=quarantine; sp=reject; pct=100; rua=mailto:dmarc@github.com; ruf=mailto:dmarc@github.com; fo=1 |
| CAA | github.com | 0 issue "digicert.com" | 0 issue "globalsign.com" | 0 issue "letsencrypt.org" | 0 issue "sectigo.com" | 0 issuewild "digicert.com" | 0 issuewild "letsencrypt.org" | 0 issuewild "sectigo.com" |
| DS | github.com | — |