Digital exposure report
instagram.com
Good shape, with a few gaps worth closing this quarter.
Scanned: 2026-11-15 19:22 UTC
Partial coverage: the score is based on 95% of applicable check weight. 1 unverified check(s) are excluded, not counted as failures.
What to do first
- 1.
Turn on DNS signing for your domain
Signing helps resolvers detect forged answers about your domain.
Who can fix it: Your domain registrar or DNS provider
How to verify after the fix
dig +short DS instagram.com
- 2.
Limit what your site shares when visitors click links
This reduces how much page address detail is passed to other websites.
Who can fix it: Your website developer or web host
How to verify after the fix
curl -sIL https://instagram.com/ | grep -i "Referrer-Policy"
A starting point, not a security guarantee.
What this grade means
- Tested hostname
- instagram.com
- Website request
- GET https://instagram.com/ → https://www.instagram.com/
- Scan time
- 2026-11-15 19:22:37 UTC
- Grading method
- Version 2How grading works
- Unverified or excluded checks
- DKIM — digital signature on email · Not detected (common selectors only)
This is a snapshot of the public configuration checks listed in this report. It does not verify the site's owner, business legitimacy, application security, or absence of vulnerabilities. It is not a security certification.
Score by category
| Email security | 25/25 | Spoofing email from this domain is hard. |
| Encryption & certificate | 25/25 | Traffic to the site is encrypted and the certificate is valid. |
| Browser protections | 24/30 | The site instructs browsers to block common attacks. |
| DNS infrastructure | 8/15 | The domain's infrastructure works, but recommended hardening is missing. |
Fix priorities
- 1.MediumDNSSEC — signed DNS records · Hardening gap+7
- 2.LowReferrer-Policy · Hardening gap+3
- 3.LowCSP — protection from script injection · Hardening gap+3
To verify
Couldn't be confirmed from public data, so excluded from the score. Checking them clarifies your posture; it doesn't guarantee a score change.
- DKIM — digital signature on email
Findings
SPF — who may send mail for the domain
Passed · Severity: OK · 10/10An authorized sender list is defined and mail from other servers is rejected.
Valid SPF record with -all. 2 of the 10 allowed DNS lookups.
v=spf1 include:facebookmail.com include:_spf.fb.com -all
$ dig +short TXT instagram.com
DMARC — anti-spoofing policy
Passed · Severity: OK · 15/15Forged email in the company's name is blocked by mail servers.
Policy p=reject.
v=DMARC1; p=reject; rua=mailto:a@dmarc.facebookmail.com; pct=100
$ dig +short TXT _dmarc.instagram.com
DKIM — digital signature on email
Not detected (common selectors only) · Severity: OK · Not scoredNo DKIM key was found under the common selectors we probed. That doesn't mean DKIM is missing — selectors can't be listed from public DNS. Not scored.
A missing name for a probed selector (NXDOMAIN/NODATA) only means that selector isn't published. DKIM is marked unverified and excluded from the score. Check a sent message's Authentication-Results for dkim=pass and its s= selector.
Selectors checked: google, selector1, selector2, default, k1, s1, s2, dkim, mail, smtp — no key found google._domainkey: nxdomain selector1._domainkey: nxdomain selector2._domainkey: nxdomain default._domainkey: nxdomain k1._domainkey: nxdomain s1._domainkey: nxdomain s2._domainkey: nxdomain dkim._domainkey: nxdomain mail._domainkey: nxdomain smtp._domainkey: nxdomain
$ dig +short TXT google._domainkey.instagram.com
MX — inbound mail routing
Passed · Severity: OK · unscoredMail exchangers are published for the domain.
4 MX record(s). This shows where inbound mail is routed, not whether mail is sent from the domain.
20 mx0b-00082601.pphosted.com 10 mxa-00082601.gslb.pphosted.com 10 mxb-00082601.gslb.pphosted.com 20 mx0a-00082601.pphosted.com
$ dig +short MX instagram.com
HTTPS available
Passed · Severity: OK · 10/10The site loads over an encrypted connection.
https://instagram.com/ returned HTTP 200 (final URL: https://www.instagram.com/). Client-side certificate validation passed.
HTTP 200 Final URL: https://www.instagram.com/
$ curl -sIL https://instagram.com/
HTTP → HTTPS redirect
Passed · Severity: OK · 7/7Visitors arriving at an unencrypted address are automatically sent to the secure version.
HTTP 301 → https://instagram.com/
HTTP 301 Location: https://instagram.com/
$ curl -sI http://instagram.com/ | grep -iE "^(HTTP|location)"
SSL/TLS certificate validity
Passed · Severity: OK · 8/8The certificate was accepted by a validating TLS client at scan time.
Live TLS handshake succeeded. Latest issuance in CT logs: DigiCert, expiring 2027-01-02 (48 days). CT shows issued certificates, not necessarily the one served — confirm dates with the verify command.
Live TLS handshake: certificate accepted CT logs (context only, not scored): Issuer: DigiCert Valid from: 2026-10-04 Valid until: 2027-01-02 Names: *.cdninstagram.com, *.igsonar.com, *.instagram.com, cdninstagram.com, igsonar.com, instagram.com Based on Certificate Transparency logs; may not reflect the certificate currently served.
$ echo | openssl s_client -connect instagram.com:443 -servername instagram.com 2>/dev/null | openssl x509 -noout -issuer -dates
HSTS — enforce encryption in the browser
Passed · Severity: OK · 8/8Browsers are told to always use an encrypted connection to the site.
max-age=31536000 (365 days), includeSubDomains, preload. ≥ 180 days recommended.
Strict-Transport-Security: max-age=31536000; preload; includeSubDomains
$ curl -sIL https://instagram.com/ | grep -i "Strict-Transport-Security"
CSP — protection from script injection
Needs attention · Severity: Low · Hardening gap · 5/8A script policy exists, but it's permissive and offers only partial protection.
script-src includes: 'unsafe-eval' — weakens XSS protection.
Content-Security-Policy: default-src *.facebook.com *.fbcdn.net *.instagram.com blob:;script-src *.instagram.com static.cdninstagram.com z-p42-static.cdninstagram.com https://instagram.com https://*.www.instagram.com https://*.cdninstagram.com wss://www.instagram.com blob: *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'nonce-fShLYh3y' 'self' 'unsafe-eval' https://*.google-analytics.com https://translate.google.com https://apis.google.com https://accounts.google.com;style-src *.instagram.com static.cdninstagram.com z-p42-static.cdninstagram.com https://*.www.instagram.com data: blob: 'unsafe-inline' *.fbcdn.net *.facebook.com https://accounts.google.com;connect-src *.instagram.com wss://edge-chat.instagram.com connect.facebook.net https://instagram.com https://*.www.instagram.com https://*.graph.instagram.com https://*.i.instagram.com https://*.od.instagram.com https://i.threads.net https://i.threads.com https://*.od.threads.net https://*.od.threads.com wss://www.instagram.com blob: *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* ws://localhost:* *.cdninstagram.com wss://*.instagram.com:* 'self' *.ipification.com https://accounts.google.com https://meta.privacy-gateway.cloudflare.com/relay;font-src *.instagram.com static.cdninstagram.com z-p42-static.cdninstagram.com data: *.fbcdn.net *.intern.facebook.com *.facebook.com https://*.cdninstagram.com https://fonts.gstatic.com;img-src *.instagram.com *.facebook.com *.fbcdn.net data: *.cdninstagram.com *.whatsapp.net blob: https://*.threads.net https://*.threads.com *.fbsbx.com android-webview-video-poster: *.oculuscdn.com *.giphy.com *.tenor.co *.tenor.com www.googleadservices.com *.doubleclick.net *.google.com *.google.co.uk https://www.gstatic.com https://*.google-analytics.com;media-src *.facebook.com *.fbcdn.net *.instagram.com *.cdninstagram.com *.fbsbx.com data: blob: https://*.giphy.com *.tenor.co *.tenor.com;child-src *.facebook.com *.fbcdn.net *.instagram.com data: blob:;frame-src https://instagram.com https://connect.facebook.net *.instagram.com *.facebook.com *.fbsbx.com fbsbx.com data: *.ipification.com www.googleadservices.com *.doubleclick.net *.google.com *.google.co.uk;manifest-src *.facebook.com *.fbcdn.net *.instagram.com data: blob:;object-src *.facebook.com *.fbcdn.net *.instagram.com data: blob:;block-all-mixed-content;upgrade-insecure-requests;
$ curl -sIL https://instagram.com/ | grep -i "Content-Security-Policy"
- First publish Content-Security-Policy-Report-Only — it blocks nothing, it only reports.
- Collect violations for a week or two and tune the policy to your legitimate sources.
- Switch to the Content-Security-Policy header and replace 'unsafe-inline' with a nonce or hash.
/* Content-Security-Policy-Report-Only: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'
Safety: This change is made in your server/CDN settings. Test on staging before production. An overly strict CSP will break scripts — that's why you start in Report-Only mode.
Clickjacking protection
Passed · Severity: OK · 5/5The site can't be embedded by foreign sites.
X-Frame-Options: DENY
X-Frame-Options: DENY
$ curl -sIL https://instagram.com/ | grep -i "X-Frame-Options"
X-Content-Type-Options
Passed · Severity: OK · 4/4The browser won't guess file types in a way that could execute code.
nosniff is set.
X-Content-Type-Options: nosniff
$ curl -sIL https://instagram.com/ | grep -i "X-Content-Type-Options"
Referrer-Policy
Failed · Severity: Low · Hardening gap · 0/3Internal URLs (including parameters) may leak to external sites.
Referrer-Policy is missing; the browser will use its default.
Referrer-Policy: (missing)
$ curl -sIL https://instagram.com/ | grep -i "Referrer-Policy"
- Set Referrer-Policy: strict-origin-when-cross-origin.
/* Referrer-Policy: strict-origin-when-cross-origin
Safety: This change is made in your server/CDN settings. Test on staging before production.
Permissions-Policy
Passed · Severity: OK · 2/2The site restricts access to sensitive browser features.
Permissions-Policy: accelerometer=(self "https://www.fbsbx.com"), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(self "https://www.fbsbx.com"), ch-device-memory=(), c
Permissions-Policy: accelerometer=(self "https://www.fbsbx.com"), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(self "https://www.fbsbx.com"), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(self), gyroscope=(self "https://www.fbsbx.com"), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(self), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self "https://*.facebook.com" "https://facebook.com"), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
$ curl -sIL https://instagram.com/ | grep -i "Permissions-Policy"
Software version disclosure
Passed · Severity: OK · unscoredThe server doesn't disclose software versions.
No version numbers found in the Server / X-Powered-By headers.
server: cloudflare x-powered-by: (missing)
$ curl -sIL https://instagram.com/ | grep -iE "^(server|x-powered-by)"
DNSSEC — signed DNS records
Needs attention · Severity: Medium · Hardening gap · 0/7The domain's records aren't signed, so in some scenarios users could be redirected to a forged server.
No DS record is published at the parent zone, so there's no DNSSEC chain of trust for this zone.
AD = false DS instagram.com: NODATA
$ dig +short DS instagram.com
- Enable DNSSEC at your DNS provider (one click at most providers).
- Copy the DS record your provider generates to your domain registrar.
- Wait for propagation and verify with DNSViz.
dig +dnssec instagram.com SOA delv instagram.com
Safety: DNS changes are made only at your DNS provider. This tool only reads public data and changes nothing on the domain. A wrong DS record at the registrar will make the domain stop resolving — copy it exactly from the provider.
CAA — who may issue certificates
Passed · Severity: OK · 5/5Only authorized certificate authorities can issue certificates for the domain.
CAA records: 0 issue "digicert.com; account=271b0beda0771d006aa3a6c11b05187d456d6c239b46cb5241196095b09c92af"
0 issue "digicert.com; account=271b0beda0771d006aa3a6c11b05187d456d6c239b46cb5241196095b09c92af"
$ dig +short CAA instagram.com
DNS server redundancy
Passed · Severity: OK · 3/3The domain is served by several DNS servers, so one server failing won't take it down.
4 NS servers.
a.ns.instagram.com d.ns.instagram.com b.ns.instagram.com c.ns.instagram.com
$ dig +short NS instagram.com
Indicative alignment
Best-practice mapping of public findings to common frameworks. Passive scanning tests public configuration only; it doesn't prove compliance or a violation.
- Google & Yahoo sender rules1 unverified
- PCI DSS v4.01 observed gaps
- NIS2 / vendor due diligence1 observed gaps
- SOC 2 / ISO 27001 baseline1 observed gaps
Indicative alignment only, based on public configuration. It doesn't establish whether a framework applies to you, and it isn't legal advice, an audit or a certification.
Public DNS records
| A | instagram.com | 57.145.2.34 |
| AAAA | instagram.com | 2a03:2880:f381:22:face:b00c:0:4420 |
| MX | instagram.com | 20 mx0b-00082601.pphosted.com | 10 mxa-00082601.gslb.pphosted.com | 10 mxb-00082601.gslb.pphosted.com | 20 mx0a-00082601.pphosted.com |
| NS | instagram.com | a.ns.instagram.com | d.ns.instagram.com | b.ns.instagram.com | c.ns.instagram.com |
| TXT | instagram.com | nEXgIFIbDifAKlSMQvAhly5SA-vpsAkm5wiOdwdkrzY | hyWdekepiNsp/V9b1JCR+wZDdzbESurl4GqY+FLMfiN+7aeFaway0Art+kNDHeL5OnGZipNeV/iIC+lOONSQVQ== | google-site-verification=_iQgLr68Rdg7YnN2PqOljSG5dnWOFUUXISF9R77fs5c | adobe-idp-site-verification=367fda82-a8bb-46cf-9cff-0062d452d229 | ms=ms86975275 | _yvfspgyfwcjnwgopowc9qjme14c32od | 4cbb1b68-601f-4801-8e7f-e8f68a4a41dd | slack-domain-verification=2Sz3t8oHDaRB4aVudl36MIwEdb1XSR751nZGiDFv | facebook-domain-verification=hksvhmzcutq39t1kgpmlx11kt8314q | google-site-verification=GGtId51KFyq0hqX2xNvt1u0P9Xp0C7k6pp9do49fCNw | v=spf1 include:facebookmail.com include:_spf.fb.com -all |
| TXT | _dmarc.instagram.com | v=DMARC1; p=reject; rua=mailto:a@dmarc.facebookmail.com; pct=100 |
| CAA | instagram.com | 0 issue "digicert.com; account=271b0beda0771d006aa3a6c11b05187d456d6c239b46cb5241196095b09c92af" |
| DS | instagram.com | — |