Digital exposure report
wellsfargo.com
Good shape, with a few gaps worth closing this quarter.
Scanned: 2026-11-15 19:22 UTC
Partial coverage: the score is based on 95% of applicable check weight. 1 unverified check(s) are excluded, not counted as failures.
What to do first
- 1.
Turn on DNS signing for your domain
Signing helps resolvers detect forged answers about your domain.
Who can fix it: Your domain registrar or DNS provider
How to verify after the fix
dig +short DS wellsfargo.com
- 2.
Choose which companies may issue certificates for your domain
This reduces the chance of a certificate being issued by a provider you did not choose.
Who can fix it: Your domain registrar or DNS provider
How to verify after the fix
dig +short CAA wellsfargo.com
A starting point, not a security guarantee.
What this grade means
- Tested hostname
- wellsfargo.com
- Website request
- GET https://wellsfargo.com/ → https://www.wellsfargo.com/
- Scan time
- 2026-11-15 19:22:43 UTC
- Grading method
- Version 2How grading works
- Unverified or excluded checks
- DKIM — digital signature on email · Not detected (common selectors only)
This is a snapshot of the public configuration checks listed in this report. It does not verify the site's owner, business legitimacy, application security, or absence of vulnerabilities. It is not a security certification.
Score by category
| Email security | 24/25 | Spoofing email from this domain is hard. |
| Encryption & certificate | 25/25 | Traffic to the site is encrypted and the certificate is valid. |
| Browser protections | 25/30 | The site instructs browsers to block common attacks. |
| DNS infrastructure | 3/15 | The domain's infrastructure lacks basic protections. |
Fix priorities
- 1.MediumDNSSEC — signed DNS records · Hardening gap+7
- 2.LowCAA — who may issue certificates · Hardening gap+5
- 3.LowReferrer-Policy · Hardening gap+3
- 4.LowPermissions-Policy · Hardening gap+2
To verify
Couldn't be confirmed from public data, so excluded from the score. Checking them clarifies your posture; it doesn't guarantee a score change.
- DKIM — digital signature on email
Findings
SPF — who may send mail for the domain
Passed · Severity: OK · 9/10An authorized sender list is defined; mail from other servers is flagged as suspicious.
~all (softfail) — acceptable when combined with enforced DMARC. 1 of 10 DNS lookups.
v=spf1 include:%{ir}.%{v}.%{d}.spf.has.pphosted.com ~all$ dig +short TXT wellsfargo.com
DMARC — anti-spoofing policy
Passed · Severity: OK · 15/15Forged email in the company's name is blocked by mail servers.
Policy p=reject.
v=DMARC1; p=reject; fo=1; rua=mailto:dmarc_rua@emaildefense.proofpoint.com,mailto:tn1d3s4FQU@dmarc.inboxmonster.com; ruf=mailto:dmarc-ruf@wellsfargo.com;
$ dig +short TXT _dmarc.wellsfargo.com
DKIM — digital signature on email
Not detected (common selectors only) · Severity: OK · Not scoredNo DKIM key was found under the common selectors we probed. That doesn't mean DKIM is missing — selectors can't be listed from public DNS. Not scored.
A missing name for a probed selector (NXDOMAIN/NODATA) only means that selector isn't published. DKIM is marked unverified and excluded from the score. Check a sent message's Authentication-Results for dkim=pass and its s= selector.
Selectors checked: google, selector1, selector2, default, k1, s1, s2, dkim, mail, smtp — no key found google._domainkey: nxdomain selector1._domainkey: nxdomain selector2._domainkey: nxdomain default._domainkey: nxdomain k1._domainkey: nxdomain s1._domainkey: nxdomain s2._domainkey: nxdomain dkim._domainkey: nxdomain mail._domainkey: nxdomain smtp._domainkey: nxdomain
$ dig +short TXT google._domainkey.wellsfargo.com
MX — inbound mail routing
Passed · Severity: OK · unscoredMail exchangers are published for the domain.
4 MX record(s). This shows where inbound mail is routed, not whether mail is sent from the domain.
10 mxa-00004003.gslb.pphosted.com 10 mxb-00004003.gslb.pphosted.com 20 mx0a-00004003.pphosted.com 20 mx0b-00004003.pphosted.com
$ dig +short MX wellsfargo.com
HTTPS available
Passed · Severity: OK · 10/10The site loads over an encrypted connection.
https://wellsfargo.com/ returned HTTP 200 (final URL: https://www.wellsfargo.com/). Client-side certificate validation passed.
HTTP 200 Final URL: https://www.wellsfargo.com/
$ curl -sIL https://wellsfargo.com/
HTTP → HTTPS redirect
Passed · Severity: OK · 7/7Visitors arriving at an unencrypted address are automatically sent to the secure version.
HTTP 301 → https://wellsfargo.com/
HTTP 301 Location: https://wellsfargo.com/
$ curl -sI http://wellsfargo.com/ | grep -iE "^(HTTP|location)"
SSL/TLS certificate validity
Passed · Severity: OK · 8/8The certificate was accepted by a validating TLS client at scan time.
Live TLS handshake succeeded. Latest issuance in CT logs: DigiCert, expiring 2027-05-30 (196 days). CT shows issued certificates, not necessarily the one served — confirm dates with the verify command.
Live TLS handshake: certificate accepted CT logs (context only, not scored): Issuer: DigiCert Valid from: 2026-11-13 Valid until: 2027-05-30 Names: wellsfargo.com Based on Certificate Transparency logs; may not reflect the certificate currently served.
$ echo | openssl s_client -connect wellsfargo.com:443 -servername wellsfargo.com 2>/dev/null | openssl x509 -noout -issuer -dates
HSTS — enforce encryption in the browser
Passed · Severity: OK · 8/8Browsers are told to always use an encrypted connection to the site.
max-age=31536000 (365 days), includeSubDomains. ≥ 180 days recommended.
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
$ curl -sIL https://wellsfargo.com/ | grep -i "Strict-Transport-Security"
CSP — protection from script injection
Passed · Severity: OK · 8/8The site restricts which scripts are allowed to run.
CSP is set without permissive sources in script-src.
Content-Security-Policy: default-src 'none'; form-action 'self' *.wellsfargo.com *.wellsfargo.com:* ; connect-src 'self' https://*.wellsfargo.com https://*.wellsfargo.com:* https://*.schemaapp.com https://*.rlcdn.com https://*.medallia.com https://*.kampyle.com https://*.adobedc.net https://www.google-analytics.com https://*.doubleclick.net https://*.eum-appdynamics.com https://*.demdex.net https://www.sjwoe.com https://www.mczbf.com https://s.yimg.com https://*.nuance.com https://*.wf.com https://*.google.com https://*.onetrust.com; img-src 'self' data: https://*.wellsfargomedia.com https://*.wellsfargo.com https://*.wellsfargo.com:* https://*.wfinterface.com https://*.wfinterface.com:* https://*.analytics.yahoo.com https://*.everesttech.net https://*.linkedin.com https://*.g.doubleclick.net https://*.google.com https://*.demdex.net https://*.nuance.com https://*.eum-appdynamics.com https://*.virtualearth.net https://www.facebook.com https://cx.atdmt.com https://track.linksynergy.com https://s.amazon-adsystem.com https://ct.pinterest.com https://trc.taboola.com https://p.adsymptotic.com https://products.gobankingrates.com https://bttrack.com https://b.videoamp.com https://fcmatch.youtube.com https://www.googleadservices.com https://2549153.fls.doubleclick.net https://ad.doubleclick.net https://www.google-analytics.com https://idsync.rlcdn.com https://s.amazon-adsystem.com https://resources.digital-cloud-prem.medallia.com https://udc-neb.kampyle.com https://wellsfargoprod.prod.fire.glass https://*.mworld.com https://*.postrelease.com; object-src 'self' https://*.wellsfargo.com https://*.wellsfargo.com:* https://*.wfinterface.com https://*.wfinterface.com:*; child-src 'self' *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:* https://*.demdex.net https://*.nuance.com https://*.advanced-web-analytics.com https://iframe.arkoselabs.com https://*.doubleclick.net https://*.wf.com; font-src 'self' data: https://*.wellsfargomedia.com https://*.wellsfargo.com https://*.wellsfargo.com:*; style-src 'self' 'unsafe-inline' *.wellsfargo.com *.wellsfargo.com:* https://*.wfinterface.com https://*.wfinterface.com:* https://*.nuance.com; script-src 'nonce-0b151223e8bb42ec6ed7a20501ca80cd' 'nonce-a7ddd9c6-41b4-4285-a2cc-b934e05d62d6' 'self' *.wellsfargo.com *.wellsfargo.com:* *.wfinterface.com *.wfinterface.com:* https://cdn.schemaapp.com https://*.nuance.com;media-src 'self' *.wellsfargo.com *.wellsfargomedia.com; frame-ancestors 'self' *.wellsfargo.com; base-uri 'none'; report-uri https://ort.wellsfargo.com/securereporting/reporting/v1/csp;worker-src blob:
$ curl -sIL https://wellsfargo.com/ | grep -i "Content-Security-Policy"
Clickjacking protection
Passed · Severity: OK · 5/5The site can't be embedded by foreign sites.
X-Frame-Options: SAMEORIGIN frame-ancestors 'self' *.wellsfargo.com
X-Frame-Options: SAMEORIGIN CSP frame-ancestors: 'self' *.wellsfargo.com
$ curl -sIL https://wellsfargo.com/ | grep -i "X-Frame-Options"
X-Content-Type-Options
Passed · Severity: OK · 4/4The browser won't guess file types in a way that could execute code.
nosniff is set.
X-Content-Type-Options: nosniff
$ curl -sIL https://wellsfargo.com/ | grep -i "X-Content-Type-Options"
Referrer-Policy
Failed · Severity: Low · Hardening gap · 0/3Internal URLs (including parameters) may leak to external sites.
Referrer-Policy is missing; the browser will use its default.
Referrer-Policy: (missing)
$ curl -sIL https://wellsfargo.com/ | grep -i "Referrer-Policy"
- Set Referrer-Policy: strict-origin-when-cross-origin.
/* Referrer-Policy: strict-origin-when-cross-origin
Safety: This change is made in your server/CDN settings. Test on staging before production.
Permissions-Policy
Needs attention · Severity: Low · Hardening gap · 0/2Access to sensitive features like the camera and location isn't restricted.
Missing Permissions-Policy header.
Permissions-Policy: (missing)
$ curl -sIL https://wellsfargo.com/ | grep -i "Permissions-Policy"
- Disable browser features the site doesn't need (camera, microphone, geolocation).
/* Permissions-Policy: camera=(), microphone=(), geolocation=()
Safety: This change is made in your server/CDN settings. Test on staging before production. Don't disable a feature the site actually uses.
Software version disclosure
Passed · Severity: OK · unscoredThe server doesn't disclose software versions.
No version numbers found in the Server / X-Powered-By headers.
server: cloudflare x-powered-by: (missing)
$ curl -sIL https://wellsfargo.com/ | grep -iE "^(server|x-powered-by)"
DNSSEC — signed DNS records
Needs attention · Severity: Medium · Hardening gap · 0/7The domain's records aren't signed, so in some scenarios users could be redirected to a forged server.
No DS record is published at the parent zone, so there's no DNSSEC chain of trust for this zone.
AD = false DS wellsfargo.com: NODATA
$ dig +short DS wellsfargo.com
- Enable DNSSEC at your DNS provider (one click at most providers).
- Copy the DS record your provider generates to your domain registrar.
- Wait for propagation and verify with DNSViz.
dig +dnssec wellsfargo.com SOA delv wellsfargo.com
Safety: DNS changes are made only at your DNS provider. This tool only reads public data and changes nothing on the domain. A wrong DS record at the registrar will make the domain stop resolving — copy it exactly from the provider.
CAA — who may issue certificates
Needs attention · Severity: Low · Hardening gap · 0/5Any certificate authority can issue a certificate for the domain, raising the risk of mis-issuance.
No CAA records found. RFC 8659 lets the domain owner restrict which CAs are authorized.
(no CAA records found)
$ dig +short CAA wellsfargo.com
- Identify which certificate authority issued your current certificate (see the certificate check).
- Publish CAA for that authority only, and add iodef to receive alerts.
wellsfargo.com. CAA 0 issue "letsencrypt.org" wellsfargo.com. CAA 0 iodef "mailto:security@wellsfargo.com"
Safety: DNS changes are made only at your DNS provider. This tool only reads public data and changes nothing on the domain. If your CDN issues certificates on your behalf, include it too — otherwise certificate renewal will fail.
DNS server redundancy
Passed · Severity: OK · 3/3The domain is served by several DNS servers, so one server failing won't take it down.
7 NS servers.
a24-66.akam.net edns1.ultradns.biz edns1.ultradns.com edns1.ultradns.org a2-64.akam.net a1-189.akam.net edns1.ultradns.net
$ dig +short NS wellsfargo.com
Indicative alignment
Best-practice mapping of public findings to common frameworks. Passive scanning tests public configuration only; it doesn't prove compliance or a violation.
- Google & Yahoo sender rules1 unverified
- PCI DSS v4.0No gaps observed
- NIS2 / vendor due diligence2 observed gaps
- SOC 2 / ISO 27001 baselineNo gaps observed
Indicative alignment only, based on public configuration. It doesn't establish whether a framework applies to you, and it isn't legal advice, an audit or a certification.
Public DNS records
| A | wellsfargo.com | 23.215.11.243 | 23.215.11.242 |
| AAAA | wellsfargo.com | — |
| MX | wellsfargo.com | 10 mxa-00004003.gslb.pphosted.com | 10 mxb-00004003.gslb.pphosted.com | 20 mx0a-00004003.pphosted.com | 20 mx0b-00004003.pphosted.com |
| NS | wellsfargo.com | a24-66.akam.net | edns1.ultradns.biz | edns1.ultradns.com | edns1.ultradns.org | a2-64.akam.net | a1-189.akam.net | edns1.ultradns.net |
| TXT | wellsfargo.com | MS=ms55239285 | XKNBNPXX3FGJAJI4IGHIWBRYY6IBLYJKA9TFFIQU | SFMC-RBMdi4jKmGLzx309qUUmF_jRLq0ZhtELtiy7L3Qh | docusign=182ba0bd-f7cc-423a-b69f-6597f3418125 | docusign=fa86331e-ce88-4150-9e03-49999c4542a5 | v=spf1 include:%{ir}.%{v}.%{d}.spf.has.pphosted.com ~all | mongodb-site-verification=jqcFvnzHPnWaB8kuVRCCbrQN1zJQRPQT | mongodb-site-verification=pdRPv2gbrHzIqdzHpPtCUwOMZBHgPbIQ | facebook-domain-verification=5m0hrk0snw5sgvxwxdump2kob1wm5u | poppulo-domain-verification=a43ab4c6-cf0c-408d-892c-910d39b46aec | slack-domain-verification=TZylPJmHnWc38hjAZndFjbqpORzFahh0CXOLCYBI | yahoo-verification-key=obqVt160b6+HxLHztMj4LYjtSIXf2WUl7wuBDv+AZpE= | google-site-verification=I_ja-LuIqEJ76WNc4saij8AC-JrnkDqe3--MBdH2LHU | google-site-verification=JhIekmpe90l9Nsvux7qqfwNmrhbJDI1xKSXsMWlXzYs | apple-domain-verification=fjpdn_0YZHIPxbMISJedC6zNIlntneK35XOgGcoDH_M | liveramp-site-verification=eTqekxddhK8on3hD12UkjC56Be8HZGRuzGG9BwQxfRM | hcp-domain-verification=bed540868e214034c62df7863b2f90e7b217905a6c69831138e93312bcca62c2 | cisco-ci-domain-verification=60939a4d2f539880950cf4f6cd4e97b18a07e85391ff5671f2b7045b2be84f9 | cisco-ci-domain-verification=27d3d23d53cbc01f28bb1e90d2772e1ef8671ef1306d8a6aea2dd98b16973b99 | cisco-ci-domain-verification=611fc9e560697d73912de2f3755da55f7277c7811d44297c0a0a567a21e7a249 | atlassian-domain-verification=3iSn26f6aafKa7o1mfwsx1tZl9Ach7BhUpRmglO24La1WPXoyanfEd3zs1Y0VqiL |
| TXT | _dmarc.wellsfargo.com | v=DMARC1; p=reject; fo=1; rua=mailto:dmarc_rua@emaildefense.proofpoint.com,mailto:tn1d3s4FQU@dmarc.inboxmonster.com; ruf=mailto:dmarc-ruf@wellsfargo.com; |
| CAA | wellsfargo.com | — |
| DS | wellsfargo.com | — |