Digital exposure report
meta.com
Good shape, with a few gaps worth closing this quarter.
Scanned: 2026-11-15 19:22 UTC
Partial coverage: the score is based on 95% of applicable check weight. 1 unverified check(s) are excluded, not counted as failures.
What to do first
- 1.
Turn on DNS signing for your domain
Signing helps resolvers detect forged answers about your domain.
Who can fix it: Your domain registrar or DNS provider
How to verify after the fix
dig +short DS meta.com
- 2.
Limit what your site shares when visitors click links
This reduces how much page address detail is passed to other websites.
Who can fix it: Your website developer or web host
How to verify after the fix
curl -sIL https://meta.com/ | grep -i "Referrer-Policy"
A starting point, not a security guarantee.
What this grade means
- Tested hostname
- meta.com
- Website request
- GET https://meta.com/ → https://www.meta.com/gb/
- Scan time
- 2026-11-15 19:22:34 UTC
- Grading method
- Version 2How grading works
- Unverified or excluded checks
- DKIM — digital signature on email · Not detected (common selectors only)
This is a snapshot of the public configuration checks listed in this report. It does not verify the site's owner, business legitimacy, application security, or absence of vulnerabilities. It is not a security certification.
Score by category
| Email security | 25/25 | Spoofing email from this domain is hard. |
| Encryption & certificate | 25/25 | Traffic to the site is encrypted and the certificate is valid. |
| Browser protections | 24/30 | The site instructs browsers to block common attacks. |
| DNS infrastructure | 8/15 | The domain's infrastructure works, but recommended hardening is missing. |
Fix priorities
- 1.MediumDNSSEC — signed DNS records · Hardening gap+7
- 2.LowReferrer-Policy · Hardening gap+3
- 3.LowCSP — protection from script injection · Hardening gap+3
To verify
Couldn't be confirmed from public data, so excluded from the score. Checking them clarifies your posture; it doesn't guarantee a score change.
- DKIM — digital signature on email
Findings
SPF — who may send mail for the domain
Passed · Severity: OK · 10/10An authorized sender list is defined and mail from other servers is rejected.
Valid SPF record with -all. 1 of the 10 allowed DNS lookups.
v=spf1 redirect=_spf.fb.com
$ dig +short TXT meta.com
DMARC — anti-spoofing policy
Passed · Severity: OK · 15/15Forged email in the company's name is blocked by mail servers.
Policy p=reject.
v=DMARC1; p=reject; pct=100; rua=mailto:a@dmarc.facebookmail.com
$ dig +short TXT _dmarc.meta.com
DKIM — digital signature on email
Not detected (common selectors only) · Severity: OK · Not scoredNo DKIM key was found under the common selectors we probed. That doesn't mean DKIM is missing — selectors can't be listed from public DNS. Not scored.
A missing name for a probed selector (NXDOMAIN/NODATA) only means that selector isn't published. DKIM is marked unverified and excluded from the score. Check a sent message's Authentication-Results for dkim=pass and its s= selector.
Selectors checked: google, selector1, selector2, default, k1, s1, s2, dkim, mail, smtp — no key found google._domainkey: nxdomain selector1._domainkey: nxdomain selector2._domainkey: nxdomain default._domainkey: nxdomain k1._domainkey: nxdomain s1._domainkey: nxdomain s2._domainkey: nxdomain dkim._domainkey: nxdomain mail._domainkey: nxdomain smtp._domainkey: nxdomain
$ dig +short TXT google._domainkey.meta.com
MX — inbound mail routing
Passed · Severity: OK · unscoredMail exchangers are published for the domain.
4 MX record(s). This shows where inbound mail is routed, not whether mail is sent from the domain.
10 mxa-00082601.gslb.pphosted.com 20 mx0b-00082601.pphosted.com 20 mx0a-00082601.pphosted.com 10 mxb-00082601.gslb.pphosted.com
$ dig +short MX meta.com
HTTPS available
Passed · Severity: OK · 10/10The site loads over an encrypted connection.
https://meta.com/ returned HTTP 200 (final URL: https://www.meta.com/gb/). Client-side certificate validation passed.
HTTP 200 Final URL: https://www.meta.com/gb/
$ curl -sIL https://meta.com/
HTTP → HTTPS redirect
Passed · Severity: OK · 7/7Visitors arriving at an unencrypted address are automatically sent to the secure version.
HTTP 301 → https://meta.com/
HTTP 301 Location: https://meta.com/
$ curl -sI http://meta.com/ | grep -iE "^(HTTP|location)"
SSL/TLS certificate validity
Passed · Severity: OK · 8/8The certificate was accepted by a validating TLS client at scan time.
Live TLS handshake succeeded. Latest issuance in CT logs: DigiCert, expiring 2027-02-13 (90 days). CT shows issued certificates, not necessarily the one served — confirm dates with the verify command.
Live TLS handshake: certificate accepted CT logs (context only, not scored): Issuer: DigiCert Valid from: 2026-11-15 Valid until: 2027-02-13 Names: *.meta.com, meta.com Based on Certificate Transparency logs; may not reflect the certificate currently served.
$ echo | openssl s_client -connect meta.com:443 -servername meta.com 2>/dev/null | openssl x509 -noout -issuer -dates
HSTS — enforce encryption in the browser
Passed · Severity: OK · 8/8Browsers are told to always use an encrypted connection to the site.
max-age=31536000 (365 days), includeSubDomains, preload. ≥ 180 days recommended.
Strict-Transport-Security: max-age=31536000; preload; includeSubDomains
$ curl -sIL https://meta.com/ | grep -i "Strict-Transport-Security"
CSP — protection from script injection
Needs attention · Severity: Low · Hardening gap · 5/8A script policy exists, but it's permissive and offers only partial protection.
script-src includes: 'unsafe-eval' — weakens XSS protection.
Content-Security-Policy: default-src 'self' *.facebook.com *.facebook.net;script-src 'self' 'nonce-25I7cMdD' *.fbcdn.net connect.facebook.net *.facebook.net *.oculus.com www.meta.com/3ds2/ddc/ www.meta.com/3ds2/challenge_complete/ 'unsafe-eval' gw.conversionsapigateway.com https://*.youtube.com https://applepay.cdn-apple.com/;style-src 'self' 'unsafe-inline' data: *.fbcdn.net 'unsafe-eval' *.oculus.com www.meta.com/3ds2/ddc/ www.meta.com/3ds2/challenge_complete/;connect-src blob: *.fbcdn.net www.meta.com *.www.meta.com wss://gateway.www.meta.com *.facebook.com/tr/ *.facebook.com/tr *.facebook.com/parallel-pxl/ *.facebook.com/parallel-pxl connect.facebook.net//log/error connect.facebook.net/log/error connect.facebook.net/signals/wasm/ graph.facebook.com/pdl_attribution/ secure.facebook.com/payments/generate_token *.oculus.com www.meta.com/3ds2/ddc/ www.meta.com/3ds2/challenge_complete/ gw.conversionsapigateway.com demo-1.conversionsapigateway.com;font-src data: *.fbcdn.net *.oculus.com www.meta.com/3ds2/ddc/ www.meta.com/3ds2/challenge_complete/;img-src 'self' blob: data: *.fbcdn.net *.fbsbx.com *.oculuscdn.com *.facebook.com/tr/ *.facebook.com/tr *.facebook.com/parallel-pxl/ *.facebook.com/parallel-pxl connect.facebook.net//log/error connect.facebook.net/log/error *.cdninstagram.com about.fb.com *.oculus.com www.meta.com/3ds2/ddc/ www.meta.com/3ds2/challenge_complete/ gw.conversionsapigateway.com https://*.ytimg.com *.youtube.com https://applepay.cdn-apple.com/;media-src blob: data: lookaside.fbsbx.com *.fbcdn.net *.cdninstagram.com *.oculuscdn.com;child-src blob: data: *.fbcdn.net;frame-src data: *.fbcdn.net *.facebook.com/tr/ *.facebook.com/tr *.facebook.com/parallel-pxl/ *.facebook.com/parallel-pxl connect.facebook.net//log/error connect.facebook.net/log/error www.facebook.com/plugins/wearables_social_context www.facebook.com/plugins/video.php www.meta.com/common/ *.www.meta.com/common/ *.fbsbx.com/ www.meta.com/tealium/ *.www.meta.com/tealium/ www.meta.com/payments/ *.www.meta.com/payments/ *.fbthirdpartypixel.com *.oculus.com www.meta.com/3ds2/ddc/ www.meta.com/3ds2/challenge_complete/ centinelapi.cardinalcommerce.com centinelapistag.cardinalcommerce.com client.cardinaltrusted.com cas.client.cardinaltrusted.com gw.conversionsapigateway.com https://www.affirm.com https://www.affirm.ca https://sandbox.affirm.com https://osm.klarnaservices.com https://www.klarna.com https://www.payments.klarna.com https://payments.klarna.com *.klarna.com https://*.youtube.com https://applepay.cdn-apple.com/;manifest-src 'self' data:;object-src 'self' data:;worker-src blob: data: *.fbcdn.net *.meta.com/static_resources/webworker_v1/init_script/ *.meta.com/static_resources/webworker/init_script/ *.meta.com/static_resources/sharedworker/init_script/;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?minimize=0;
$ curl -sIL https://meta.com/ | grep -i "Content-Security-Policy"
- First publish Content-Security-Policy-Report-Only — it blocks nothing, it only reports.
- Collect violations for a week or two and tune the policy to your legitimate sources.
- Switch to the Content-Security-Policy header and replace 'unsafe-inline' with a nonce or hash.
/* Content-Security-Policy-Report-Only: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'
Safety: This change is made in your server/CDN settings. Test on staging before production. An overly strict CSP will break scripts — that's why you start in Report-Only mode.
Clickjacking protection
Passed · Severity: OK · 5/5The site can't be embedded by foreign sites.
X-Frame-Options: DENY
X-Frame-Options: DENY
$ curl -sIL https://meta.com/ | grep -i "X-Frame-Options"
X-Content-Type-Options
Passed · Severity: OK · 4/4The browser won't guess file types in a way that could execute code.
nosniff is set.
X-Content-Type-Options: nosniff
$ curl -sIL https://meta.com/ | grep -i "X-Content-Type-Options"
Referrer-Policy
Failed · Severity: Low · Hardening gap · 0/3Internal URLs (including parameters) may leak to external sites.
Referrer-Policy is missing; the browser will use its default.
Referrer-Policy: (missing)
$ curl -sIL https://meta.com/ | grep -i "Referrer-Policy"
- Set Referrer-Policy: strict-origin-when-cross-origin.
/* Referrer-Policy: strict-origin-when-cross-origin
Safety: This change is made in your server/CDN settings. Test on staging before production.
Permissions-Policy
Passed · Severity: OK · 2/2The site restricts access to sensitive browser features.
Permissions-Policy: accelerometer=(self "https://glasseson-pd.fbsbx.com"), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(self "https://glasseson-pd.fbsbx.com"), ch-d
Permissions-Policy: accelerometer=(self "https://glasseson-pd.fbsbx.com"), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(self "https://glasseson-pd.fbsbx.com"), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(self), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self "https://*.fbsbx.com" "https://play.vidyard.com"), gamepad=(self), geolocation=(self), gyroscope=(self "https://glasseson-pd.fbsbx.com"), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(self "https://glasseson-pd.fbsbx.com"), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
$ curl -sIL https://meta.com/ | grep -i "Permissions-Policy"
Software version disclosure
Passed · Severity: OK · unscoredThe server doesn't disclose software versions.
No version numbers found in the Server / X-Powered-By headers.
server: cloudflare x-powered-by: (missing)
$ curl -sIL https://meta.com/ | grep -iE "^(server|x-powered-by)"
DNSSEC — signed DNS records
Needs attention · Severity: Medium · Hardening gap · 0/7The domain's records aren't signed, so in some scenarios users could be redirected to a forged server.
No DS record is published at the parent zone, so there's no DNSSEC chain of trust for this zone.
AD = false DS meta.com: NODATA
$ dig +short DS meta.com
- Enable DNSSEC at your DNS provider (one click at most providers).
- Copy the DS record your provider generates to your domain registrar.
- Wait for propagation and verify with DNSViz.
dig +dnssec meta.com SOA delv meta.com
Safety: DNS changes are made only at your DNS provider. This tool only reads public data and changes nothing on the domain. A wrong DS record at the registrar will make the domain stop resolving — copy it exactly from the provider.
CAA — who may issue certificates
Passed · Severity: OK · 5/5Only authorized certificate authorities can issue certificates for the domain.
CAA records: 0 issue "digicert.com; account=271b0beda0771d006aa3a6c11b05187d456d6c239b46cb5241196095b09c92af"
0 issue "digicert.com; account=271b0beda0771d006aa3a6c11b05187d456d6c239b46cb5241196095b09c92af"
$ dig +short CAA meta.com
DNS server redundancy
Passed · Severity: OK · 3/3The domain is served by several DNS servers, so one server failing won't take it down.
4 NS servers.
c.ns.facebook.com a.ns.facebook.com d.ns.facebook.com b.ns.facebook.com
$ dig +short NS meta.com
Indicative alignment
Best-practice mapping of public findings to common frameworks. Passive scanning tests public configuration only; it doesn't prove compliance or a violation.
- Google & Yahoo sender rules1 unverified
- PCI DSS v4.01 observed gaps
- NIS2 / vendor due diligence1 observed gaps
- SOC 2 / ISO 27001 baseline1 observed gaps
Indicative alignment only, based on public configuration. It doesn't establish whether a framework applies to you, and it isn't legal advice, an audit or a certification.
Public DNS records
| A | meta.com | 57.145.2.141 |
| AAAA | meta.com | 2a03:2880:f381:8d:face:b00c:0:2 |
| MX | meta.com | 10 mxa-00082601.gslb.pphosted.com | 20 mx0b-00082601.pphosted.com | 20 mx0a-00082601.pphosted.com | 10 mxb-00082601.gslb.pphosted.com |
| NS | meta.com | c.ns.facebook.com | a.ns.facebook.com | d.ns.facebook.com | b.ns.facebook.com |
| TXT | meta.com | liveramp-site-verification=7o_qYDez8Z-ZP1F8NGIxt7dgcBUOU4njB0_iDvl2_GM | wiz-domain-verification=49c8babe4e9832f92b48be99a2ff9f20e464f9fe03e12e1d25f961315688e1b0 | apple-domain-verification=jVVbKL4kbd6qwW9I3HaF82Pvx4Dw_ZLoP4fCfLN9VtA | 88d92136-5f42-4012-ae48-d6eb2b55db10 | mentimeter-16bdc82d-93be-47de-a6d4-fd6adb17c403 | manus-domain-verification-ccwyr4=xqSOkWFnTHeCFASkoQ5YW3VhF | airtable-verification=81b6197107c896de62ab91cf767f94a8 | openai-domain-verification=dv-aYIcEKTatV2YiUmh0KxVxHYt | flexera-domain-verification-kaxmydsxzfbicdfr | google-site-verification=mCIIkbiX5oDurbChBmsJFS9T8Qm7a7WldZkrq57X-eE | live-kit-domain-verification-2x1j14=hNyF5wtnRVMj7WslM06htRUlh | shopify-verification-code=JUzxnVutn7DU5rUiF8j0Q9mlCOdU2h | lucidchart-verification=YWykPZR9OAfOMLreWjllpom6N | SFMC--IBmbMl8WsU-Dj1SIZj7RCsKChznFkO3raDqol6l | R0METvdRK3nQWdKcRgc6tUud-lJefoVG | perplexity-ai-domain-verification-jzzrvg=KghiEJzer9K0EUTqUvCJfM4FI | airtable-verification=e5ea432248c225409579034427e268a9 | airtable-verification=b2eb6311898506343df24da9c49c8f39 | cursor-domain-verification-cd09k5=Ptq7dEvh3q5u7jQpZgfJdov8D | gamma-domain-verification-zgq5h4=OgSeTkAEhYH7u8jgIcEws1F3b | elevenlabs=JM_cDh_L6SUGrL_3im6KtdDonBDsX9jiv5f_BarPOC8 | work-os-admin-danger-domain-verification-z234gj=5PLdzZxCrKuv7wv0DE3XSig4p | linear-domain-verification=sxhfmp46dir3 | anthropic-domain-verification-vb762t=ezl2XXGyq8tXMTx0oArON1hm7 | 2678481 | amazon-business-verification=38d8ff3ff8bcc0a9521fbcbc3fbeaaf62b40e76dc5fe28602707a1caa75e093c | smartsheet-site-validation=UxvM1DM07tqKMCws2PpHGqCRqbnvX_sS | stripe-verification=739B2DF1319B373225C1D41F1C5FB9EB45CB3EB33ED798FCDF3AEAEAC12C9CBC | rep-data-domain-verification-6zaxkr=71T2nsEMoEtKsFprPbV9MThs9 | slack-domain-verification=0BD3JdNG4KXfQalAcVxN5d3VHeHLe0nYNYAYcxm9 | bluebeam-verification=ndxhnuqs84dkpsrlyj8v8hwikmaudw | verification_token=1W1nnDZ3CdD8xBvOEC7zzvLYI | dust-domain-verification-98xyt7=10CFebRuinJsIZ3GBaR3odOk | zoom-domain-verification=4b2ef4e1-6dee-4483-9869-9bef353fd147 | atlassian-domain-verification=CvZmRJmM9sx250sAzSzZ6pVinoosIPNmnhGqfKcnYi5mVuYyaWzVUNMk6x69g770 | e1602cc4-c094-4810-9ba1-487b9c171d0a | atlassian-domain-verification=I7HLjLnlhJiDT58wzrru2Pd/2cRWa3AKlgCjDPOO43GMP7H0QuafH6eBts3D1GaP | canva-site-verification=iQtpnfmzYgLxP8uf_0fN3A | d9895a85-87c3-4c89-a47f-f62da6172abf | krisp-domain-verification=Qo1RXvowjIIJwtkuCGLXn9rb42ouFiD1 | stripe-verification=3556f4515d122d1dfc498139862bb8759fc73dc9172ce8e75ccacfb31886424a | mixpanel-domain-verify=9cfd2929-c7bb-4d49-a81a-419bf4c14ebe | masv=sLRNYzsZOaYnCZDQulTexcyzRkYNUJlF | bitrise-verification=abf0a61c07a7d976-rH78UI9wM4ed | rzp-site-verification=224114166287f72512718dbdf148433b | bWV0YQ== | airtable-verification=16d7d6b6aea82b1831e664e377bf20cb | parkable-domain-verification=BEBNZLmadNNXu5J3gl7zZcRytRbvwTlmAFAtQuGel4E= | mentimeter-8599dcd1-e0da-4326-882e-7570e7c942fb | SFMC-QntGqBQWJQgWAmziYTSMLC_RFK-QY0XoDqCb59qo | google-site-verification=HR4Xo3vzMUlBppYoVbkYJ9cTG2rHaFYsCDyy8w1Tlqk | v=spf1 redirect=_spf.fb.com | openai-domain-verification=dv-9VWR0XUv3Tg6cTv9njNqbwN8 | rep-data-domain-verification-vgh5br=f7JlbZ6f7uQjaVUVsrkIL0dZm | hubspot-developer-verification=MTkyYjRkNmYtODk4Ny00NmVjLWE1MWUtMzZjZTMxNWQ2ZmEx | MS=ms62716295 | smartsheet-site-validation=czIYUcozQp6VyDu8DMpnjSGZAulejP36 | meshy-verification=019ba48cb37a7d60ae664246433708b0 | flexera-domain-verification-vcvotrexfxpeibla | intercom-domain-validation=dc8938df-ba79-4019-8809-1b836c9117c4 | censys-domain-verification=Yo-juPBT_qmJ-qe2cmh9ytUXJhAPx0fy3l8UfLW6iFkG |
| TXT | _dmarc.meta.com | v=DMARC1; p=reject; pct=100; rua=mailto:a@dmarc.facebookmail.com |
| CAA | meta.com | 0 issue "digicert.com; account=271b0beda0771d006aa3a6c11b05187d456d6c239b46cb5241196095b09c92af" |
| DS | meta.com | — |