google.com

An authorized sender list is defined; mail from other servers is flagged as suspicious.

~all (softfail) — acceptable when combined with enforced DMARC. 1 of 10 DNS lookups.

v=spf1 include:_spf.google.com ~all

$ dig +short TXT google.com

Forged email in the company's name is blocked by mail servers.

Policy p=reject.

v=DMARC1; p=reject; rua=mailto:mailauth-reports@google.com

$ dig +short TXT _dmarc.google.com

No DKIM key was found under the common selectors we probed. That doesn't mean DKIM is missing — selectors can't be listed from public DNS. Not scored.

A missing name for a probed selector (NXDOMAIN/NODATA) only means that selector isn't published. DKIM is marked unverified and excluded from the score. Check a sent message's Authentication-Results for dkim=pass and its s= selector.

Selectors checked: google, selector1, selector2, default, k1, s1, s2, dkim, mail, smtp — no key found
google._domainkey: nxdomain
selector1._domainkey: nxdomain
selector2._domainkey: nxdomain
default._domainkey: nxdomain
k1._domainkey: nxdomain
s1._domainkey: nxdomain
s2._domainkey: nxdomain
dkim._domainkey: nxdomain
mail._domainkey: nxdomain
smtp._domainkey: nxdomain

$ dig +short TXT google._domainkey.google.com

Mail exchangers are published for the domain.

1 MX record(s). This shows where inbound mail is routed, not whether mail is sent from the domain.

10 smtp.google.com

$ dig +short MX google.com

The site loads over an encrypted connection.

https://google.com/ returned HTTP 429 (final URL: https://www.google.com/sorry/index?continue=https://google.com/&q=EgRoF_OYGPmM6NcGIikCrHjqs5WZA60_jqktPp2aa_QhNMJLURrK-drsm6ufM6E4ehYBFwvUrTICclJaAUNg2ufznv7M6Ntt). Client-side certificate validation passed.

HTTP 429
Final URL: https://www.google.com/sorry/index?continue=https://google.com/&q=EgRoF_OYGPmM6NcGIikCrHjqs5WZA60_jqktPp2aa_QhNMJLURrK-drsm6ufM6E4ehYBFwvUrTICclJaAUNg2ufznv7M6Ntt

$ curl -sIL https://google.com/

The site is also reachable over an unencrypted connection, so data may travel in plain text on public networks.

http://google.com/ returned HTTP 302 without redirecting to https:// (Location: http://www.google.com/sorry/index?continue=http://google.com/&q=EgRoF_OYGPmM6NcGIik1m_X90r6m_RkB9L-HyZzEYSzcV2J8J6B8eGvDllO9od6Z9er2Iuw5BzICclJaAUNgrNObweLFtvreAQ).

HTTP 302
Location: http://www.google.com/sorry/index?continue=http://google.com/&q=EgRoF_OYGPmM6NcGIik1m_X90r6m_RkB9L-HyZzEYSzcV2J8J6B8eGvDllO9od6Z9er2Iuw5BzICclJaAUNgrNObweLFtvreAQ

$ curl -sI http://google.com/ | grep -iE "^(HTTP|location)"

server {
  listen 80;
  server_name google.com www.google.com;
  return 301 https://$host$request_uri;
}

The certificate was accepted by a validating TLS client at scan time.

Live TLS handshake succeeded. Latest issuance in CT logs: Google Trust Services, expiring 2026-12-31 (45 days). CT shows issued certificates, not necessarily the one served — confirm dates with the verify command.

Live TLS handshake: certificate accepted
CT logs (context only, not scored):
Issuer: Google Trust Services
Valid from: 2026-10-02
Valid until: 2026-12-31
Names: *.aistudio.google.com, *.android.com, *.appengine.google.com, *.bdn.dev, *.cloud.google.com, *.crowdsource.google.com
Based on Certificate Transparency logs; may not reflect the certificate currently served.

$ echo | openssl s_client -connect google.com:443 -servername google.com 2>/dev/null | openssl x509 -noout -issuer -dates

Browsers aren't told to always use an encrypted connection, enabling interception attacks on public networks.

No Strict-Transport-Security header. Users are exposed to SSL stripping on the first request.

Strict-Transport-Security: (missing)

$ curl -sIL https://google.com/ | grep -i "Strict-Transport-Security"

/*
  Strict-Transport-Security: max-age=31536000; includeSubDomains

Missing Content-Security-Policy header: this removes one layer of protection against script injection.

No Content-Security-Policy header found.

Content-Security-Policy: (missing)

$ curl -sIL https://google.com/ | grep -i "Content-Security-Policy"

/*
  Content-Security-Policy-Report-Only: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'

Missing X-Frame-Options / frame-ancestors: this removes one layer of protection against clickjacking.

No valid X-Frame-Options and no frame-ancestors in the CSP.

X-Frame-Options: (missing)

$ curl -sIL https://google.com/ | grep -i "X-Frame-Options"

/*
  X-Frame-Options: SAMEORIGIN

The browser may interpret files as code unintentionally.

Missing X-Content-Type-Options: nosniff header (MIME sniffing).

X-Content-Type-Options: (missing)

$ curl -sIL https://google.com/ | grep -i "X-Content-Type-Options"

/*
  X-Content-Type-Options: nosniff

Internal URLs (including parameters) may leak to external sites.

Referrer-Policy is missing; the browser will use its default.

Referrer-Policy: (missing)

$ curl -sIL https://google.com/ | grep -i "Referrer-Policy"

/*
  Referrer-Policy: strict-origin-when-cross-origin

Access to sensitive features like the camera and location isn't restricted.

Missing Permissions-Policy header.

Permissions-Policy: (missing)

$ curl -sIL https://google.com/ | grep -i "Permissions-Policy"

/*
  Permissions-Policy: camera=(), microphone=(), geolocation=()

The server doesn't disclose software versions.

No version numbers found in the Server / X-Powered-By headers.

server: cloudflare
x-powered-by: (missing)

$ curl -sIL https://google.com/ | grep -iE "^(server|x-powered-by)"

The domain's records aren't signed, so in some scenarios users could be redirected to a forged server.

No DS record is published at the parent zone, so there's no DNSSEC chain of trust for this zone.

AD = false
DS google.com: NODATA

$ dig +short DS google.com

dig +dnssec google.com SOA
delv google.com

Only authorized certificate authorities can issue certificates for the domain.

CAA records: 0 issue "pki.goog"

0 issue "pki.goog"

$ dig +short CAA google.com

The domain is served by several DNS servers, so one server failing won't take it down.

4 NS servers.

ns4.google.com
ns2.google.com
ns1.google.com
ns3.google.com

$ dig +short NS google.com