reddit.com

An authorized sender list is defined and mail from other servers is rejected.

Valid SPF record with -all. 1 of the 10 allowed DNS lookups.

v=spf1 include:spf0.reddit.com -all

$ dig +short TXT reddit.com

Forged email in the company's name is blocked by mail servers.

Policy p=reject.

v=DMARC1; p=reject; fo=1; ruf=mailto:reddit@us.cp-dmarc.com; rua=mailto:reddit@us.cp-dmarc.com

$ dig +short TXT _dmarc.reddit.com

A DKIM public key is published. On its own this doesn't prove outgoing mail is signed or aligned with your From domain.

DKIM public key found for selector: google, k1. Confirm signing with dkim=pass in a sent message's Authentication-Results.

google._domainkey: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA6ZYw3MUh1+iOwP8bjjx65zHaDEX8…
k1._domainkey: k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDGHmcH3+sPXeY29B20lSMak+vaxGNOtyNAyxTcG7jRv…

$ dig +short TXT google._domainkey.reddit.com

Mail exchangers are published for the domain.

5 MX record(s). This shows where inbound mail is routed, not whether mail is sent from the domain.

1 aspmx.l.google.com
10 aspmx2.googlemail.com
10 aspmx3.googlemail.com
5 alt1.aspmx.l.google.com
5 alt2.aspmx.l.google.com

$ dig +short MX reddit.com

The site loads over an encrypted connection.

https://reddit.com/ returned HTTP 200 (final URL: https://www.reddit.com/). Client-side certificate validation passed.

HTTP 200
Final URL: https://www.reddit.com/

$ curl -sIL https://reddit.com/

Visitors arriving at an unencrypted address are automatically sent to the secure version.

HTTP 301 → https://reddit.com/

HTTP 301
Location: https://reddit.com/

$ curl -sI http://reddit.com/ | grep -iE "^(HTTP|location)"

The certificate was accepted by a validating TLS client at scan time.

Live TLS handshake succeeded. Latest issuance in CT logs: DigiCert, expiring 2027-02-16 (93 days). CT shows issued certificates, not necessarily the one served — confirm dates with the verify command.

Live TLS handshake: certificate accepted
CT logs (context only, not scored):
Issuer: DigiCert
Valid from: 2026-08-21
Valid until: 2027-02-16
Names: *.reddit.com, reddit.com
Based on Certificate Transparency logs; may not reflect the certificate currently served.

$ echo | openssl s_client -connect reddit.com:443 -servername reddit.com 2>/dev/null | openssl x509 -noout -issuer -dates

Browsers are told to always use an encrypted connection to the site.

max-age=31536000 (365 days), includeSubDomains. ≥ 180 days recommended.

Strict-Transport-Security: max-age=31536000; includeSubdomains

$ curl -sIL https://reddit.com/ | grep -i "Strict-Transport-Security"

The site restricts which scripts are allowed to run.

CSP is set without permissive sources in script-src.

Content-Security-Policy: default-src 'none'; script-src 'nonce-f3f2e108-7c61-4655-9bb9-d203d2805944'; style-src 'unsafe-inline'; img-src https://www.redditstatic.com; form-action 'self';

$ curl -sIL https://reddit.com/ | grep -i "Content-Security-Policy"

The site can't be embedded by foreign sites.

X-Frame-Options: SAMEORIGIN

X-Frame-Options: SAMEORIGIN

$ curl -sIL https://reddit.com/ | grep -i "X-Frame-Options"

The browser won't guess file types in a way that could execute code.

nosniff is set.

X-Content-Type-Options: nosniff

$ curl -sIL https://reddit.com/ | grep -i "X-Content-Type-Options"

Internal URLs (including parameters) may leak to external sites.

Referrer-Policy is missing; the browser will use its default.

Referrer-Policy: (missing)

$ curl -sIL https://reddit.com/ | grep -i "Referrer-Policy"

/*
  Referrer-Policy: strict-origin-when-cross-origin

Access to sensitive features like the camera and location isn't restricted.

Missing Permissions-Policy header.

Permissions-Policy: (missing)

$ curl -sIL https://reddit.com/ | grep -i "Permissions-Policy"

/*
  Permissions-Policy: camera=(), microphone=(), geolocation=()

The server doesn't disclose software versions.

No version numbers found in the Server / X-Powered-By headers.

server: cloudflare
x-powered-by: (missing)

$ curl -sIL https://reddit.com/ | grep -iE "^(server|x-powered-by)"

The domain's records aren't signed, so in some scenarios users could be redirected to a forged server.

No DS record is published at the parent zone, so there's no DNSSEC chain of trust for this zone.

AD = false
DS reddit.com: NODATA

$ dig +short DS reddit.com

dig +dnssec reddit.com SOA
delv reddit.com

Only authorized certificate authorities can issue certificates for the domain.

CAA records: 0 issue "digicert.com; cansignhttpexchanges=yes" | 0 issue "pki.goog"

0 issue "digicert.com; cansignhttpexchanges=yes"
0 issue "pki.goog"

$ dig +short CAA reddit.com

The domain is served by several DNS servers, so one server failing won't take it down.

4 NS servers.

ns-1029.awsdns-00.org
ns-1887.awsdns-43.co.uk
ns-378.awsdns-47.com
ns-557.awsdns-05.net

$ dig +short NS reddit.com