Back to results

Digital exposure report

servicenow.com

Low exposure. The domain is well protected in most areas checked.

Scanned: 2026-11-15 19:22 UTC

Partial coverage: the score is based on 52% of applicable check weight. 8 unverified check(s) are excluded, not counted as failures.

A
100/100

What to do first

Nothing urgent. Your basics look fine.

A starting point, not a security guarantee.

What this grade means

Tested hostname
servicenow.com
Website request
GET https://servicenow.com/ → https://www.servicenow.com/
Scan time
2026-11-15 19:22:44 UTC
Grading method
Version 2How grading works
Unverified or excluded checks
  • HTTPS available · Unverified
  • SSL/TLS certificate validity · Unverified
  • HSTS — enforce encryption in the browser · Unverified
  • CSP — protection from script injection · Unverified
  • Clickjacking protection · Unverified
  • X-Content-Type-Options · Unverified
  • Referrer-Policy · Unverified
  • Permissions-Policy · Unverified

This is a snapshot of the public configuration checks listed in this report. It does not verify the site's owner, business legitimacy, application security, or absence of vulnerabilities. It is not a security certification.

Score by category

Email security30/30Spoofing email from this domain is hard.
Encryption & certificate7/7Traffic to the site is encrypted and the certificate is valid.
Browser protections—Nothing in this category could be verified from public data.
DNS infrastructure15/15The domain's infrastructure is well hardened.

To verify

Couldn't be confirmed from public data, so excluded from the score. Checking them clarifies your posture; it doesn't guarantee a score change.

  • HTTPS available
  • SSL/TLS certificate validity
  • CSP — protection from script injection
  • HSTS — enforce encryption in the browser
  • Clickjacking protection
  • X-Content-Type-Options
  • Referrer-Policy
  • Permissions-Policy

Findings

SPF — who may send mail for the domain

Passed · Severity: OK · 10/10

An authorized sender list is defined and mail from other servers is rejected.

Valid SPF record with -all. 1 of the 10 allowed DNS lookups.

Source data: DNS TXT servicenow.com
v=spf1 redirect=8sfr6god._spf._d.mim.ec
$ dig +short TXT servicenow.com
Documentation: RFC 7208 — SPF (https://www.rfc-editor.org/rfc/rfc7208) · M3AAWG — Email Authentication Best Practices (https://www.m3aawg.org/sites/default/files/m3aawg-email-authentication-recommended-best-practices-09-2020.pdf)

DMARC — anti-spoofing policy

Passed · Severity: OK · 15/15

Forged email in the company's name is blocked by mail servers.

Policy p=reject.

Source data: DNS TXT _dmarc.servicenow.com
v=DMARC1; p=reject; sp=reject; rua=mailto:f11ce6c582f6261@rep.dmarcanalyzer.com; ruf=mailto:f11ce6c582f6261@for.dmarcanalyzer.com; fo=1;
$ dig +short TXT _dmarc.servicenow.com
Documentation: RFC 7489 — DMARC (https://www.rfc-editor.org/rfc/rfc7489) · dmarc.org — FAQ (https://dmarc.org/resources/frequently-asked-questions/)

DKIM — digital signature on email

Passed · Severity: OK · 5/5

A DKIM public key is published. On its own this doesn't prove outgoing mail is signed or aligned with your From domain.

DKIM public key found for selector: k1, s1, s2, dkim. Confirm signing with dkim=pass in a sent message's Authentication-Results.

Source data: DNS TXT <selector>._domainkey.servicenow.com
k1._domainkey: k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDbNrX2cY/GUKIFx2G/1I00ftdAj713WP9AQ1xir85i8…
s1._domainkey: k=rsa; t=s; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxtNbYwvgrBiEWoXqyvSyVjzHcLkWRoZm…
s2._domainkey: k=rsa; t=s; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC7k4yHOF1dn0ZmcWmp5VPeQCswajmO2v5v6kju…
dkim._domainkey: k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDDzpFrEAH9dbkLukLvwesHGWRDc+JCBkvzQYTpptOR+…
$ dig +short TXT k1._domainkey.servicenow.com
Documentation: RFC 6376 — DKIM (https://www.rfc-editor.org/rfc/rfc6376) · M3AAWG — Email Authentication Best Practices (https://www.m3aawg.org/sites/default/files/m3aawg-email-authentication-recommended-best-practices-09-2020.pdf)

MX — inbound mail routing

Passed · Severity: OK · unscored

Mail exchangers are published for the domain.

2 MX record(s). This shows where inbound mail is routed, not whether mail is sent from the domain.

Source data: DNS MX servicenow.com
10 us-smtp-inbound-1.mimecast.com
10 us-smtp-inbound-2.mimecast.com
$ dig +short MX servicenow.com
Documentation: RFC 7505 — Null MX (https://www.rfc-editor.org/rfc/rfc7505) · RFC 5321 §5.1 — Locating the target host (https://www.rfc-editor.org/rfc/rfc5321#section-5.1)

HTTPS available

Unverified · Severity: OK · Not scored

HTTPS couldn't be confirmed: the request timed out or the connection failed. This isn't treated as a security failure.

Requesting https://servicenow.com/ didn't complete (HTTP 520). Timeouts and transport errors may be transient; the check is excluded from the score.

Source data: HTTPS GET https://servicenow.com/
HTTP 520
$ curl -svI https://servicenow.com/ 2>&1 | grep -E "SSL|HTTP|expire"
Documentation: OWASP — Transport Layer Security Cheat Sheet (https://cheatsheetseries.owasp.org/cheatsheets/Transport_Layer_Security_Cheat_Sheet.html) · Mozilla — Server Side TLS (https://wiki.mozilla.org/Security/Server_Side_TLS)

HTTP → HTTPS redirect

Passed · Severity: OK · 7/7

Visitors arriving at an unencrypted address are automatically sent to the secure version.

HTTP 301 → https://servicenow.com

Source data: HTTP GET http://servicenow.com/ (redirects not followed)
HTTP 301
Location: https://servicenow.com
$ curl -sI http://servicenow.com/ | grep -iE "^(HTTP|location)"
Documentation: OWASP — Transport Layer Security Cheat Sheet (https://cheatsheetseries.owasp.org/cheatsheets/Transport_Layer_Security_Cheat_Sheet.html) · RFC 6797 — HSTS (https://www.rfc-editor.org/rfc/rfc6797)

SSL/TLS certificate validity

Unverified · Severity: OK · Not scored

The certificate couldn't be checked live because the HTTPS connection didn't complete. CT log data alone isn't used to score validity or expiry.

No live TLS evidence was obtained. CT entries are shown as context only. Not scored.

Source data: Certificate Transparency logs (certspotter) for servicenow.com
CT logs (context only, not scored):
Issuer: DigiCert
Valid from: 2026-11-05
Valid until: 2027-05-22
Names: account.servicenow.com, accounts.servicenow.com, blog.servicenow.com, blogs.servicenow.com, brandcenter.servicenow.com, cdn.servicenow.com
Based on Certificate Transparency logs; may not reflect the certificate currently served.
$ echo | openssl s_client -connect servicenow.com:443 -servername servicenow.com 2>/dev/null | openssl x509 -noout -issuer -dates
Documentation: Certificate Transparency (https://certificate.transparency.dev/) · Let's Encrypt — Docs (https://letsencrypt.org/docs/) · Mozilla — Server Side TLS (https://wiki.mozilla.org/Security/Server_Side_TLS)

HSTS — enforce encryption in the browser

Unverified · Severity: OK · Not scored

Couldn't be checked — no usable HTTPS response was obtained. Not scored.

No response with headers was received, so this header wasn't evaluated and is excluded from the score.

Source data: Response headers from https://www.servicenow.com/
No HTTPS response received
$ curl -sIL https://servicenow.com/
Documentation: MDN — Strict-Transport-Security (https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Strict-Transport-Security) · RFC 6797 — HSTS (https://www.rfc-editor.org/rfc/rfc6797) · OWASP — HTTP Headers Cheat Sheet (https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html)

CSP — protection from script injection

Unverified · Severity: OK · Not scored

Couldn't be checked — no usable HTTPS response was obtained. Not scored.

No response with headers was received, so this header wasn't evaluated and is excluded from the score.

Source data: Response headers from https://www.servicenow.com/
No HTTPS response received
$ curl -sIL https://servicenow.com/
Documentation: MDN — Content Security Policy (https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP) · OWASP — CSP Cheat Sheet (https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html)

Clickjacking protection

Unverified · Severity: OK · Not scored

Couldn't be checked — no usable HTTPS response was obtained. Not scored.

No response with headers was received, so this header wasn't evaluated and is excluded from the score.

Source data: Response headers from https://www.servicenow.com/
No HTTPS response received
$ curl -sIL https://servicenow.com/
Documentation: MDN — X-Frame-Options (https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-Frame-Options) · OWASP — Clickjacking Defense (https://cheatsheetseries.owasp.org/cheatsheets/Clickjacking_Defense_Cheat_Sheet.html)

X-Content-Type-Options

Unverified · Severity: OK · Not scored

Couldn't be checked — no usable HTTPS response was obtained. Not scored.

No response with headers was received, so this header wasn't evaluated and is excluded from the score.

Source data: Response headers from https://www.servicenow.com/
No HTTPS response received
$ curl -sIL https://servicenow.com/
Documentation: MDN — X-Content-Type-Options (https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-Content-Type-Options) · OWASP — HTTP Headers Cheat Sheet (https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html)

Referrer-Policy

Unverified · Severity: OK · Not scored

Couldn't be checked — no usable HTTPS response was obtained. Not scored.

No response with headers was received, so this header wasn't evaluated and is excluded from the score.

Source data: Response headers from https://www.servicenow.com/
No HTTPS response received
$ curl -sIL https://servicenow.com/
Documentation: MDN — Referrer-Policy (https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Referrer-Policy) · OWASP — HTTP Headers Cheat Sheet (https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html)

Permissions-Policy

Unverified · Severity: OK · Not scored

Couldn't be checked — no usable HTTPS response was obtained. Not scored.

No response with headers was received, so this header wasn't evaluated and is excluded from the score.

Source data: Response headers from https://www.servicenow.com/
No HTTPS response received
$ curl -sIL https://servicenow.com/
Documentation: MDN — Permissions-Policy (https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Permissions-Policy) · OWASP — HTTP Headers Cheat Sheet (https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html)

DNSSEC — signed DNS records

Passed · Severity: OK · 7/7

The domain's records are digitally signed and hard to forge.

An AD (Authenticated Data) flag was returned by a validating resolver.

Source data: DNS-over-HTTPS (Cloudflare / Google): AD flag and DS record at the parent
AD = true
$ dig +dnssec servicenow.com | grep -E "flags:.* ad"
Documentation: RFC 4033 — DNSSEC (https://www.rfc-editor.org/rfc/rfc4033) · ICANN — DNSSEC: what and why (https://www.icann.org/resources/pages/dnssec-what-is-it-why-important-2019-03-05-en)

CAA — who may issue certificates

Passed · Severity: OK · 5/5

Only authorized certificate authorities can issue certificates for the domain.

CAA records: 0 issue "amazon.com" | 0 issue "digicert.com" | 0 issue "entrust.net" | 0 issue "letsencrypt.org" | 0 issue "pki.goog"

Source data: DNS CAA servicenow.com
0 issue "amazon.com"
0 issue "digicert.com"
0 issue "entrust.net"
0 issue "letsencrypt.org"
0 issue "pki.goog"
$ dig +short CAA servicenow.com
Documentation: RFC 8659 — CAA (https://www.rfc-editor.org/rfc/rfc8659)

DNS server redundancy

Passed · Severity: OK · 3/3

The domain is served by several DNS servers, so one server failing won't take it down.

6 NS servers.

Source data: DNS NS servicenow.com
a1-65.akam.net
a11-66.akam.net
a12-67.akam.net
a13-64.akam.net
a24-65.akam.net
a26-66.akam.net
$ dig +short NS servicenow.com
Documentation: RFC 2182 — Secondary DNS server operation (https://www.rfc-editor.org/rfc/rfc2182)

Indicative alignment

Best-practice mapping of public findings to common frameworks. Passive scanning tests public configuration only; it doesn't prove compliance or a violation.

  • Google & Yahoo sender rulesNo gaps observed
  • PCI DSS v4.05 unverified
  • NIS2 / vendor due diligence3 unverified
  • SOC 2 / ISO 27001 baseline6 unverified

Indicative alignment only, based on public configuration. It doesn't establish whether a framework applies to you, and it isn't legal advice, an audit or a certification.

Public DNS records

Aservicenow.com54.69.183.231
AAAAservicenow.com—
MXservicenow.com10 us-smtp-inbound-1.mimecast.com | 10 us-smtp-inbound-2.mimecast.com
NSservicenow.coma1-65.akam.net | a11-66.akam.net | a12-67.akam.net | a13-64.akam.net | a24-65.akam.net | a26-66.akam.net
TXTservicenow.comMS=ms70563485 | matillion:servicenow-com-saml | 00D0Y000000YH5k=1TBSo00000008AT | _2etlut4benbom5gnx2496bxmtk87i98 | _632riug7fd15qln60ft35pag5yvni8y | _bpbhsyb2jupyqltsqdjhszr7at6kpmt | _krll17ji19iu2w39jai8yd035tep4jw | d0qfrdybddn0mhd1hxghj3g9lyh7bx1h | 3a84dc17-f498-4b2b-a050-16fcb2a4f16d | v=spf1 redirect=8sfr6god._spf._d.mim.ec | apple-domain-verification=8Ktb46akHliox09O | apple-domain-verification=PBiFCvTxGHJKonK7 | docusign=679ba08f-29d5-410a-b0b1-874848b06d43 | docusign=7e0d53f8-4551-4d53-a663-94da71c63b7e | docusign=f516a2d6-6fc2-4152-a19f-b1025c0f4fd7 | jamf-site-verification=arbZHaRSVr9-N7ApLMcGJg | autodesk-domain-verification=sFtHaSp9os-BQ2eU_SYV | airtable-verification=93e34b507ed4a3c5df47d872d579a674 | amazonses:rqGNRQuklbGEAi6lDPzHNo5G26BbhUo38JDQCP+sppM= | openai-domain-verification=dv-KazGb9dCl4c3DI4YcVTZXqL0 | docker-verification=fde3af9f-2690-4080-a58f-92b1c4b1e193 | miro-verification=02e724937b726db0f5b05dd9e992c3e8ab936edf | twilio-domain-verification=19157b466831ec745ef435e6d3d83f8a | anthropic-domain-verification-850tvb=OQXZlgSADSMaGucnm6a8HS9P1 | anthropic-domain-verification-fv0z7f=egIHbtj4VTCblwZaWV1M1db1k | auctor-ai-domain-verification-310kkg=zjolo9UcVOiMTKwlXGBZ3DyD6 | auctor-ai-domain-verification-5gnjxa=AC0zQNiNu89nhIo2T3iOp5jWs | 0FAD63F4B45A3420CC4F71462AA9A21E539A5D44C20DC5236ADE59435286AAC8 | 623ba5debd9c3ba8e84d6fbf614af85432b75ad7019bddaafe356000b789567b | webexdomainverification.2BIAB=7c28fc2d-a8ab-4d7b-a33f-6772764f6773 | windsurf-verification=5_l9Qd472RehvrIPaoB7dBcjewPaGuBYKbkmbntB-N0= | windsurf-verification=GyGX7_gOi8tN7fSv-X391FueiLuPVoKYLUZtSmOyUhQ= | google-site-verification=5N55RvjRLGM0Nkyx1pdnCCJAjtmHE4FjNpbJNQbrADk | google-site-verification=DGePEwkifuMrps1ISqaBy9_md3_BmO0_QSZRltqCzFM | google-site-verification=ZJvFWYHAsJ4jtbKSZgMHXtQzhJbqZTs31Jt6MODa5sg | h1-domain-verification=rMXpSDx7KYLsyf1LSJkyZGMPqg3iPEKUs4bgwEPnp9ntLE3b | neat-pulse-domain-verification-PQXDV1N=25281da9-e493-4c73-b46f-a070479fa9b2 | stripe-verification=81511f9478fdbb0f63829eeba398cb240c4a1421b16e139a97fa0c312a791102 | XLQuFahIHhdwUv4XbSTaZiSi/jTlMooG48jNi4/YgU5/DMx8P5gWzarvJcOv8U/8ueCr2ztqQZzQxhd8N3vOWw== | ewtMUtYyLn8qW1QqKXUB/1clZ0K6+nGsTOplIWhSiZRulmLul0EtWYdUeIRUlrf5KLwGcNiQ1B3IR5HDe+HBZA== | wiz-domain-verification=57d50cd758469cc188e861403aec0049c9538ff1daf824d79835992cfda20d8d | Dynatrace-site-verification=9569c3c6-abbd-482e-99ad-34d88cc6e34a__np28kc5ehofs75co0dngeo95e8 | adobe-idp-site-verification=3c123bfe1c92d02595eef6eae0ffe2905d56394c121c67309a74dfc7d683771c | figma-domain-verification=8b2a94f2ee6ed1918977e240e8e8745160f0dad9f17e64adef7511aeb02423ef-1768243769 | DirectFedAuthUrl=https://servicenow.okta.com/app/servicenow_pwcresearchcreditsolutionnew_1/exk261od2pbOMh6Mo0h8/sso/saml
TXT_dmarc.servicenow.comv=DMARC1; p=reject; sp=reject; rua=mailto:f11ce6c582f6261@rep.dmarcanalyzer.com; ruf=mailto:f11ce6c582f6261@for.dmarcanalyzer.com; fo=1;
CAAservicenow.com0 issue "amazon.com" | 0 issue "digicert.com" | 0 issue "entrust.net" | 0 issue "letsencrypt.org" | 0 issue "pki.goog"
DSservicenow.com35660 8 2 a9084d1c9cbfe3d5849434ac31cfbd78eff0863e967d9f2cdcc3ef018994a695
Passive check only: reading public DNS records, Certificate Transparency logs and ordinary GET requests to the homepage over HTTPS and HTTP. No changes were made to the scanned domain. Results are an indication and do not replace a professional security assessment.

Check your own domain