Digital exposure report
slack.com
Good shape, with a few gaps worth closing this quarter.
Scanned: 2026-11-15 19:22 UTC
Partial coverage: the score is based on 95% of applicable check weight. 1 unverified check(s) are excluded, not counted as failures.
What to do first
- 1.
Limit what scripts your pages are allowed to run
This adds one layer of protection against injected scripts.
Who can fix it: Your website developer or web host
How to verify after the fix
curl -sIL https://slack.com/ | grep -i "Content-Security-Policy-Report-Only"
- 2.
Stop browsers from guessing file types
This removes one way a file could be treated as something it is not.
Who can fix it: Your website developer or web host
How to verify after the fix
curl -sIL https://slack.com/ | grep -i "X-Content-Type-Options"
A starting point, not a security guarantee.
What this grade means
- Tested hostname
- slack.com
- Website request
- GET https://slack.com/
- Scan time
- 2026-11-15 19:22:35 UTC
- Grading method
- Version 2How grading works
- Unverified or excluded checks
- DKIM — digital signature on email · Not detected (common selectors only)
This is a snapshot of the public configuration checks listed in this report. It does not verify the site's owner, business legitimacy, application security, or absence of vulnerabilities. It is not a security certification.
Score by category
| Email security | 25/25 | Spoofing email from this domain is hard. |
| Encryption & certificate | 25/25 | Traffic to the site is encrypted and the certificate is valid. |
| Browser protections | 19/30 | Some browser protections are missing. |
| DNS infrastructure | 15/15 | The domain's infrastructure is well hardened. |
Fix priorities
- 1.MediumCSP — protection from script injection · Hardening gap+5
- 2.LowX-Content-Type-Options · Hardening gap+4
- 3.LowPermissions-Policy · Hardening gap+2
To verify
Couldn't be confirmed from public data, so excluded from the score. Checking them clarifies your posture; it doesn't guarantee a score change.
- DKIM — digital signature on email
Findings
SPF — who may send mail for the domain
Passed · Severity: OK · 10/10An authorized sender list is defined and mail from other servers is rejected.
Valid SPF record with -all. 3 of the 10 allowed DNS lookups.
v=spf1 include:_spf.qualtrics.com include:mail.zendesk.com include:_spfextra.slack.com -all
$ dig +short TXT slack.com
DMARC — anti-spoofing policy
Passed · Severity: OK · 15/15Forged email in the company's name is blocked by mail servers.
Policy p=reject.
v=DMARC1;p=reject;fo=1:d:s;pct=100;rua=mailto:dmarc_agg@vali.email,mailto:0e5a5c34@inbox.ondmarc.com;ruf=mailto:0e5a5c34@inbox.ondmarc.com
$ dig +short TXT _dmarc.slack.com
DKIM — digital signature on email
Not detected (common selectors only) · Severity: OK · Not scoredNo DKIM key was found under the common selectors we probed. That doesn't mean DKIM is missing — selectors can't be listed from public DNS. Not scored.
A missing name for a probed selector (NXDOMAIN/NODATA) only means that selector isn't published. DKIM is marked unverified and excluded from the score. Check a sent message's Authentication-Results for dkim=pass and its s= selector.
Selectors checked: google, selector1, selector2, default, k1, s1, s2, dkim, mail, smtp — no key found google._domainkey: answer selector1._domainkey: answer selector2._domainkey: answer default._domainkey: answer k1._domainkey: answer s1._domainkey: answer s2._domainkey: answer dkim._domainkey: answer mail._domainkey: answer smtp._domainkey: answer
$ dig +short TXT google._domainkey.slack.com
MX — inbound mail routing
Passed · Severity: OK · unscoredMail exchangers are published for the domain.
5 MX record(s). This shows where inbound mail is routed, not whether mail is sent from the domain.
1 aspmx.l.google.com 5 alt1.aspmx.l.google.com 5 alt2.aspmx.l.google.com 10 aspmx2.googlemail.com 10 aspmx3.googlemail.com
$ dig +short MX slack.com
HTTPS available
Passed · Severity: OK · 10/10The site loads over an encrypted connection.
https://slack.com/ returned HTTP 200 (final URL: https://slack.com/). Client-side certificate validation passed.
HTTP 200 Final URL: https://slack.com/
$ curl -sIL https://slack.com/
HTTP → HTTPS redirect
Passed · Severity: OK · 7/7Visitors arriving at an unencrypted address are automatically sent to the secure version.
HTTP 301 → https://slack.com:443/
HTTP 301 Location: https://slack.com:443/
$ curl -sI http://slack.com/ | grep -iE "^(HTTP|location)"
SSL/TLS certificate validity
Passed · Severity: OK · 8/8The certificate was accepted by a validating TLS client at scan time.
Live TLS handshake succeeded. Latest issuance in CT logs: Let's Encrypt, expiring 2027-01-05 (50 days). CT shows issued certificates, not necessarily the one served — confirm dates with the verify command.
Live TLS handshake: certificate accepted CT logs (context only, not scored): Issuer: Let's Encrypt Valid from: 2026-10-07 Valid until: 2027-01-05 Names: *.slack.com, slack.com Based on Certificate Transparency logs; may not reflect the certificate currently served.
$ echo | openssl s_client -connect slack.com:443 -servername slack.com 2>/dev/null | openssl x509 -noout -issuer -dates
HSTS — enforce encryption in the browser
Passed · Severity: OK · 8/8Browsers are told to always use an encrypted connection to the site.
max-age=31536000 (365 days), includeSubDomains, preload. ≥ 180 days recommended.
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
$ curl -sIL https://slack.com/ | grep -i "Strict-Transport-Security"
CSP — protection from script injection
Needs attention · Severity: Medium · Hardening gap · 3/8A policy protecting against malicious scripts exists in monitoring mode only.
Only Content-Security-Policy-Report-Only was found — violations are reported but not blocked.
Content-Security-Policy-Report-Only: default-src 'self' 'self' https://a.slack-edge.com/ https://b.slack-edge.com/; script-src 'self' https://a.slack-edge.com/ https://b.slack-edge.com/ https://www.googletagmanager.com https://googleads.g.doubleclick.net https://snap.licdn.com https://www.redditstatic.com https://t.contentsquare.net https://tag.demandbase.com https://cdn.schemaapp.com https://trk.techtarget.com https://pi.pardot.com https://campaign.slackhq.com https://cdn.cookielaw.org https://geolocation.onetrust.com https://cdn.optimizely.com https://reveal.clearbit.com https://connect.facebook.com https://www.youtube.com https://c.salesforce.com https://*.sfdcstatic.com https://*.salesforceliveagent.com https://cdn.speedcurve.com https://suggestqueries.google.com 'nonce-DV33en8mmjCaubD4tnPzzTka' 'unsafe-hashes' 'sha256-GUpueGUVrcw+untrijipvFOtKP0qk0+9gXJmtL5n0q4=' 'sha256-B4AFXj4F5I7gyTm8Q/i9fq1czuaca3qF8KdTh5CX0GE=' 'strict-dynamic' 'unsafe-inline' 'unsafe-eval'; style-src 'self' https://a.slack-edge.com/ https://b.slack-edge.com/ https://cdn.cookielaw.org 'nonce-DV33en8mmjCaubD4tnPzzTka'; style-src-attr 'unsafe-inline'; font-src 'self' https://a.slack-edge.com/ https://b.slack-edge.com/ https://fonts.gstatic.com data:; img-src 'self' https://a.slack-edge.com/ https://b.slack-edge.com/ data: https://slack.com/ https://cdn.cookielaw.org https://lux.speedcurve.com https://d34u8crftukxnk.cloudfront.net https://d1kmis9bmaw00z.cloudfront.net https://d3lnqemdnbueq4.cloudfront.net https://assets.qualified.com https://images.company-target.com https://segments.company-target.com https://*.reddit.com https://www.googletagmanager.com https://www.google.com https://ad.doubleclick.net https://googleads.g.doubleclick.net https://www.googleadservices.com https://pagead2.googlesyndication.com https://px.ads.linkedin.com https://id.rlcdn.com; media-src 'self' https://a.slack-edge.com/ https://b.slack-edge.com/ https://d1kmis9bmaw00z.cloudfront.net https://d3lnqemdnbueq4.cloudfront.net https://assets.qualified.com https://static.olassets.com; connect-src 'self' https://a.slack-edge.com/ https://b.slack-edge.com/ https://slack.com/ https://cdn.cookielaw.org https://geolocation.onetrust.com https://privacyportal.onetrust.com https://*.onetrust.com https://logx.optimizely.com https://reveal.clearbit.com https://connect.facebook.com https://*.conviva.com https://lux.speedcurve.com https://*.salesforce-scrt.com https://*.salesforceliveagent.com https://*.sfdcstatic.com https://*.digital.salesforce.com https://*.my.site.com https://*.force.com https://api.company-target.com https://tag-logger.demandbase.com https://*.reddit.com https://*.pagesense.io https://d3ejip82vusf1l.cloudfront.net https://d3eipf02vusflt.cloudfront.net https://*.qualified.com wss://*.qualified.com https://analytics.google.com https://region1.analytics.google.com https://www.google-analytics.com https://stats.g.doubleclick.net https://www.google.com https://ad.doubleclick.net https://googleads.g.doubleclick.net https://www.googleadservices.com https://pagead2.googlesyndication.com https://px.ads.linkedin.com https://alb.reddit.com https://pixel-config.reddit.com https://*.contentsquare.net https://cdn.schemaapp.com https://data.schemaapp.com https://ibc-flow.techtarget.com; worker-src 'self' blob:; frame-src https://www.youtube.com https://www.youtube-nocookie.com https://open.spotify.com https://a11179690159.cdn.optimizely.com https://*.my.site.com https://*.force.com https://*.visualforce.com https://*.fls.doubleclick.net https://csxd.contentsquare.net https://s.company-target.com; object-src 'none'; base-uri 'self'; report-to csp-main; report-uri https://slackb.com/events/csp
$ curl -sIL https://slack.com/ | grep -i "Content-Security-Policy-Report-Only"
- First publish Content-Security-Policy-Report-Only — it blocks nothing, it only reports.
- Collect violations for a week or two and tune the policy to your legitimate sources.
- Switch to the Content-Security-Policy header and replace 'unsafe-inline' with a nonce or hash.
/* Content-Security-Policy-Report-Only: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'
Safety: This change is made in your server/CDN settings. Test on staging before production. An overly strict CSP will break scripts — that's why you start in Report-Only mode.
Clickjacking protection
Passed · Severity: OK · 5/5The site can't be embedded by foreign sites.
X-Frame-Options: SAMEORIGIN
X-Frame-Options: SAMEORIGIN
$ curl -sIL https://slack.com/ | grep -i "X-Frame-Options"
X-Content-Type-Options
Failed · Severity: Low · Hardening gap · 0/4The browser may interpret files as code unintentionally.
Missing X-Content-Type-Options: nosniff header (MIME sniffing).
X-Content-Type-Options: (missing)
$ curl -sIL https://slack.com/ | grep -i "X-Content-Type-Options"
- Add X-Content-Type-Options: nosniff to every response.
/* X-Content-Type-Options: nosniff
Safety: This change is made in your server/CDN settings. Test on staging before production.
Referrer-Policy
Passed · Severity: OK · 3/3Internal URLs don't leak to external sites.
Referrer-Policy: no-referrer
Referrer-Policy: no-referrer
$ curl -sIL https://slack.com/ | grep -i "Referrer-Policy"
Permissions-Policy
Needs attention · Severity: Low · Hardening gap · 0/2Access to sensitive features like the camera and location isn't restricted.
Missing Permissions-Policy header.
Permissions-Policy: (missing)
$ curl -sIL https://slack.com/ | grep -i "Permissions-Policy"
- Disable browser features the site doesn't need (camera, microphone, geolocation).
/* Permissions-Policy: camera=(), microphone=(), geolocation=()
Safety: This change is made in your server/CDN settings. Test on staging before production. Don't disable a feature the site actually uses.
Software version disclosure
Passed · Severity: OK · unscoredThe server doesn't disclose software versions.
No version numbers found in the Server / X-Powered-By headers.
server: cloudflare x-powered-by: (missing)
$ curl -sIL https://slack.com/ | grep -iE "^(server|x-powered-by)"
DNSSEC — signed DNS records
Passed · Severity: OK · 7/7The domain's records are digitally signed and hard to forge.
An AD (Authenticated Data) flag was returned by a validating resolver.
AD = true
$ dig +dnssec slack.com | grep -E "flags:.* ad"
CAA — who may issue certificates
Passed · Severity: OK · 5/5Only authorized certificate authorities can issue certificates for the domain.
CAA records: 0 iodef "mailto:hostmaster@slack-corp.com" | 0 issue "amazon.com" | 0 issue "digicert.com; account=455b15ed272bed097725c6ea50e89921fc57379c5338a29305c05771df65fff1" | 0 issue "letsencrypt.org; accounturi=https://acme-v02.api.letsencrypt.org/acme/acct/1532134906"
0 iodef "mailto:hostmaster@slack-corp.com" 0 issue "amazon.com" 0 issue "digicert.com; account=455b15ed272bed097725c6ea50e89921fc57379c5338a29305c05771df65fff1" 0 issue "letsencrypt.org; accounturi=https://acme-v02.api.letsencrypt.org/acme/acct/1532134906"
$ dig +short CAA slack.com
DNS server redundancy
Passed · Severity: OK · 3/3The domain is served by several DNS servers, so one server failing won't take it down.
4 NS servers.
ns-166.awsdns-20.com ns-606.awsdns-11.net ns-1493.awsdns-58.org ns-1901.awsdns-45.co.uk
$ dig +short NS slack.com
Indicative alignment
Best-practice mapping of public findings to common frameworks. Passive scanning tests public configuration only; it doesn't prove compliance or a violation.
- Google & Yahoo sender rules1 unverified
- PCI DSS v4.01 observed gaps
- NIS2 / vendor due diligenceNo gaps observed
- SOC 2 / ISO 27001 baseline2 observed gaps
Indicative alignment only, based on public configuration. It doesn't establish whether a framework applies to you, and it isn't legal advice, an audit or a certification.
Public DNS records
| A | slack.com | 3.129.123.235 | 3.130.95.182 | 3.134.44.134 | 3.142.111.40 | 3.143.19.65 | 3.143.53.1 | 18.216.36.190 | 18.221.229.81 | 3.22.139.176 |
| AAAA | slack.com | — |
| MX | slack.com | 1 aspmx.l.google.com | 5 alt1.aspmx.l.google.com | 5 alt2.aspmx.l.google.com | 10 aspmx2.googlemail.com | 10 aspmx3.googlemail.com |
| NS | slack.com | ns-166.awsdns-20.com | ns-606.awsdns-11.net | ns-1493.awsdns-58.org | ns-1901.awsdns-45.co.uk |
| TXT | slack.com | OSSRH-54733 | _0vidyxobp6x350odqhb4fo7fdxhmtq3 | spycloud-domain-verification=02e4c0be-cf43-44e4-beaf-4f99702ca632 | google-site-verification=2PK67oVPNyEtS1avSlr3PhH5nSiFuticbQv_bT4pM2k | google-site-verification=KqX3Ngw0XEjz_0GVx_xwFFlCoO-bskhqU_lxv0Q77mk | google-site-verification=QvelFPjIOe3Vavw0q-aAVYaAPKmWCRjmmVVEAjgfjQc | google-site-verification=efuXt5-oMr2CdNmVi6A9IO29KMKifpseD1qokxjWwcE | google-site-verification=kB1KvgpSk9YkHsFmsj1VPI5YmDvfKctPxnplhGjyqtE | google-site-verification=o2grd1TLmZZ8GrqbhVIFtzO2MRLTtSUpBBIBYfhQVCQ | google-site-verification=v-LLB__IhraaI7ZzuE3jvRFIm2vERPLzWoepAEZJtKQ | hubspot-developer-verification=OTE4NzYxYTgtMDUwZi00MzgzLTk2YTUtZDAwNjBlODg1MWM0 | v=spf1 include:_spf.qualtrics.com include:mail.zendesk.com include:_spfextra.slack.com -all |
| TXT | _dmarc.slack.com | v=DMARC1;p=reject;fo=1:d:s;pct=100;rua=mailto:dmarc_agg@vali.email,mailto:0e5a5c34@inbox.ondmarc.com;ruf=mailto:0e5a5c34@inbox.ondmarc.com |
| CAA | slack.com | 0 iodef "mailto:hostmaster@slack-corp.com" | 0 issue "amazon.com" | 0 issue "digicert.com; account=455b15ed272bed097725c6ea50e89921fc57379c5338a29305c05771df65fff1" | 0 issue "letsencrypt.org; accounturi=https://acme-v02.api.letsencrypt.org/acme/acct/1532134906" |
| DS | slack.com | 296 13 2 601d7ec07e7dee6e1ab6a3e5b2da170f8353375fea63af2b732faa5a22898ea0 |