Executive summary
box.com
Good shape, with a few gaps worth closing this quarter.
Full coverage: every applicable check was assessed.
2026-11-15 19:34 UTC
Useful for your IT provider or a colleague. Anyone with the link can view the report.
Track your progress
Fix the findings, then come back and rescan. Your scan history is saved in this browser so you can see exactly what improved.
Spoofing email from this domain is hard.
Traffic to the site is encrypted and the certificate is valid.
Some browser protections are missing.
The domain's infrastructure is well hardened.
Help someone else check their domain
Share this public report with a colleague. They can review the evidence and check their own domain.
What to do first
- 1.
Tell browsers to always use the secure version
Helps browsers use HTTPS on future visits after they have received the policy.
Who can fix it: Your web host
How to verify after the fix
curl -sIL https://box.com/ | grep -i "Strict-Transport-Security"
- 2.
Limit what your site shares when visitors click links
This reduces how much page address detail is passed to other websites.
Who can fix it: Your website developer or web host
How to verify after the fix
curl -sIL https://box.com/ | grep -i "Referrer-Policy"
A starting point, not a security guarantee.
What this grade means
- Tested hostname
- box.com
- Website request
- GET https://box.com/ → https://www.box.com/
- Scan time
- 2026-11-15 19:34:33 UTC
- Grading method
- Version 2How grading works
- Unverified or excluded checks
- None. Every applicable check was assessed.
This is a snapshot of the public configuration checks listed in this report. It does not verify the site's owner, business legitimacy, application security, or absence of vulnerabilities. It is not a security certification.
Get the badge
Show the live grade for box.com in a README, docs or site footer. The badge links to the public report and refreshes every 24 hours.
Scan shown on this page: 2026-11-15 19:34:33 UTC. The badge may display a cached result for up to 24 hours. Open the linked report to check its scan time.
[](https://getmirror.online/report/box.com)<a href="https://getmirror.online/report/box.com"><img src="https://getmirror.online/badge/box.com.svg" alt="Domain Armor grade"></a>https://getmirror.online/badge/box.com.svgScan history
AI fix plan
Pick scans from this browser's history. The AI compares them, explains what changed and builds a prioritized, step-by-step plan.
Scans to analyze
0 of 6 selectedThe current scan is always included.
AI-generated from your scan results only. Review each step before applying it; nothing is sent to or changed on the domain.
Agent access & discovery signals
Optional and unscored — it never changes the grade. Reads up to three public files from this site (robots.txt, llms.txt and /.well-known/security.txt) and reuses the homepage headers already fetched. llms.txt is an emerging proposal, not an official standard. It is informational and does not affect the grade.
Technical detail
Click a check to see the public data, a verification command, a safe fix recommendation and documentation sources.
Email security
29/30Encryption & certificate
25/25Browser protections
18/30DNS infrastructure
15/15Public DNS records
| A | box.com | 74.112.186.157 |
| AAAA | box.com | 2620:117:bff0:12d:: |
| MX | box.com | 10 mxa-00172704.gslb.pphosted.com 10 mxb-00172704.gslb.pphosted.com |
| NS | box.com | dns1.p09.nsone.net dns2.p09.nsone.net dns3.p09.nsone.net dns4.p09.nsone.net ns01.box-ns.com ns02.box-ns.com ns03.box-ns.com ns04.box-ns.com |
| TXT | box.com | MS=ms77284419 00D600000007C2q=1TBUT00000000xh _ekctc4i0t2i82uxe4xittvln2jdo1ns asv=62e1f7ac21943b00bec6d263491f5afd apple-domain-verification=Q6ZbrwNpV5Nf6mMX status-page-domain-verification=pg69mfwsg50n docusign=c74e9bc1-e686-4549-a027-502ac2647988 1password-site-verification=UBIBTNGWFJBIJPPKGYJZQ4XNLA amazonses:w3BTGefFeXuqvvmfdFuGriN4u5DrNP9Ru7y6AqDfZ+Q= openai-domain-verification=dv-3pcNwVWmbuCazHeb2Hy9j26y detectify-verification=34418ef6d428fa589e0242009de86e7d mongodb-site-verification=a29HTYZEP557j7IUIaaUOzZm5HxbvY1a mongodb-site-verification=iXfoWZuaZFu9OYf003LE2n1PZfF20zew cursor-domain-verification-8n2hsc=a4pjEJLogybVKLzoKGqqNjMv2 onetrust-domain-verification=a153d3509dff42aa954e04fa87e2ee91 zoom-domain-verification=7741ebe2-17cb-41d6-b176-baf04b7705a6 anthropic-domain-verification-ede8t0=p69vPv6cbVNPGb8gkr3h5QCes logmein-verification-code=0acf05fe-c5b7-4ec9-9a9b-be3b191c7834 pendo-domain-verification=b9ef9d71-a87e-4adb-a96d-51c73f2d26d3 5d9f07a12f786083f86c9582e5aff6e3bb335b0f2fc387f0af9e76eb8e68b76e google-site-verification=AZmX_1q4RIqFdW_0j9dt63wGv_eehN7F555UnDfdGKk google-site-verification=A_i8cN9XRXZtfSZjRNN7JHPA_8H-D0uY9QqNTOY7Las google-site-verification=Dg1l9TgAq2lCkemvxJbiGH4wLxpkR10utcxOS9nt02o google-site-verification=LaeRMxQr903bnLCO_lQ1AmTBc-oKWTJGU_BFeBXBcKw google-site-verification=OPFD055ic5Z0Twt9Oh3Vc7JEzK6W0ZdlwJ1w49KnLAQ google-site-verification=e8_0EdcAu3Qp7xMpq10w8jg0a0thepvNICHOr3LMZS0 google-site-verification=ixberGbEpG-6o-WjOsKq3G8vwYzfJPk4-grr8JIiEy4 drift-domain-verification=69ba9345c1274754f39ffcd36db7f7c18a1fc04b98b234acc2575cfcd3ac5baf atlassian-domain-verification=RBsyK96btDKk5ogVdtgwr3DUdfWI2BMzn1vpPsdGEXEtYDvXzsTdM7ubFx7HVhZH paloaltonetworks-site-verification=e69cd908157ca263aebd6aa724d6f40903c62a390edeae2ffcb223a286e81ee0 v=spf1 ip4:74.112.184.0/22 ip4:107.152.16.0/20 ip4:204.14.232.0/22 ip4:202.129.242.0/25 ip4:34.211.27.153 ip4:54.70.65.68 include:_spf.google.com include:sendgrid.net include:_spf.mxhero.com include:_spf.q4press.com include:stspg-customer.com include:5608010.spf08.hubspotemail.net ~all |
| TXT | _dmarc.box.com | v=DMARC1; p=reject; fo=1; rua=mailto:dmarc_rua@emaildefense.proofpoint.com,mailto:reports@dmarc.cyber.dhs.gov; ruf=mailto:dmarc_ruf@emaildefense.proofpoint.com; |
| CAA | box.com | 0 issue "digicert.com" 0 issue "www.digicert.com" |
| DS | box.com | 48553 13 2 61b5bbf45317bade560d8a4e1d3e512a1d98be7d825b083aade28cf62d5915cf |