Domain Armor
Domain scores
D69/100

Executive summary

gitlab.com

High exposure. Significant weaknesses put the brand, customers and email at risk.

Full coverage: every applicable check was assessed.

2026-11-15 19:34 UTC

Print report / PDF

Useful for your IT provider or a colleague. Anyone with the link can view the report.

Track your progress

Fix the findings, then come back and rescan. Your scan history is saved in this browser so you can see exactly what improved.

Email security29/30
Good

Spoofing email from this domain is hard.

Encryption & certificate25/25
Good

Traffic to the site is encrypted and the certificate is valid.

Browser protections7/30
Critical

Several browser hardening headers are missing, which removes layers of protection against script injection and framing.

DNS infrastructure8/15
Needs attention

The domain's infrastructure works, but recommended hardening is missing.

Help someone else check their domain

Share this public report with a colleague. They can review the evidence and check their own domain.

Get the report badge

What to do first

  1. 1.

    Limit what scripts your pages are allowed to run

    This adds one layer of protection against injected scripts.

    Who can fix it: Your website developer or web host

    How to verify after the fix

    curl -sIL https://gitlab.com/ | grep -i "Content-Security-Policy"
  2. 2.

    Turn on DNS signing for your domain

    Signing helps resolvers detect forged answers about your domain.

    Who can fix it: Your domain registrar or DNS provider

    How to verify after the fix

    dig +short DS gitlab.com

A starting point, not a security guarantee.

What this grade means

Tested hostname
gitlab.com
Website request
GET https://gitlab.com/ → https://about.gitlab.com/
Scan time
2026-11-15 19:34:32 UTC
Grading method
Version 2How grading works
Unverified or excluded checks
None. Every applicable check was assessed.

This is a snapshot of the public configuration checks listed in this report. It does not verify the site's owner, business legitimacy, application security, or absence of vulnerabilities. It is not a security certification.

Get the badge

Domain Armor grade

Show the live grade for gitlab.com in a README, docs or site footer. The badge links to the public report and refreshes every 24 hours.

Scan shown on this page: ⁦2026-11-15 19:34:32 UTC⁩. The badge may display a cached result for up to 24 hours. Open the linked report to check its scan time.

Markdown
[![Domain Armor grade](https://getmirror.online/badge/gitlab.com.svg)](https://getmirror.online/report/gitlab.com)
HTML
<a href="https://getmirror.online/report/gitlab.com"><img src="https://getmirror.online/badge/gitlab.com.svg" alt="Domain Armor grade"></a>
Badge URL
https://getmirror.online/badge/gitlab.com.svg

Scan history

AI fix plan

Pick scans from this browser's history. The AI compares them, explains what changed and builds a prioritized, step-by-step plan.

Scans to analyze

0 of 6 selected

The current scan is always included.

AI-generated from your scan results only. Review each step before applying it; nothing is sent to or changed on the domain.

Agent access & discovery signals

Optional and unscored — it never changes the grade. Reads up to three public files from this site (robots.txt, llms.txt and /.well-known/security.txt) and reuses the homepage headers already fetched. llms.txt is an emerging proposal, not an official standard. It is informational and does not affect the grade.

Technical detail

Click a check to see the public data, a verification command, a safe fix recommendation and documentation sources.

Email security

29/30

Encryption & certificate

25/25

Browser protections

7/30

DNS infrastructure

8/15

Public DNS records

Agitlab.com
172.65.251.78
AAAAgitlab.com
2606:4700:90:0:f22e:fbec:5bed:a9b9
MXgitlab.com
1 aspmx.l.google.com
10 alt3.aspmx.l.google.com
10 alt4.aspmx.l.google.com
5 alt1.aspmx.l.google.com
5 alt2.aspmx.l.google.com
NSgitlab.com
diva.ns.cloudflare.com
jermaine.ns.cloudflare.com
TXTgitlab.com
MS=ms60523131
MS=ms83893381
_globalsign-domain-verification=4azHJ7gL04Dr8r2VR0txu7OrWg7uZpU6v7LOHVP1b3
adobe-idp-site-verification=5a5e001556a2c0595ed571d2a1f7b5f8a749a00742853e035eb909bdd31622b8
apple-domain-verification=UNUD9vY0Jp9z5TjO
asv=3f763643512ad5bdcc0d42caea1b3951
atlassian-domain-verification=jDVDxUSCDYQHl7am9SOdsXCrPMLIsqNVali02wn0GxbAt6Pd2xqePpvkMeP5Gx4k
decagon-domain-verification-cmrbvs=Lb6bOM0iABwwrWBstDaKWS3U8
docusign=1a7d6818-2cf5-4956-a9fb-c3d2e9a578dd
drift-domain-verification=fa583cfff88c496bcc62651057550656a98ab3e689c314255a1a6ae848e3e56d
gitlab-pages-verification-code=5228e61c992af7e65f5f5160f0587fb4
google-site-verification=6Cb3PPpoMp6-xRavXf2HZz03s7pplQeG5MiUaPGIu_Q
google-site-verification=QiG7NTIWpedorFi71mMN7OVe2Fo_yA6RclsxO8stOa8
google-site-verification=XDRo7LEOqv6OV0RfGDFh7G2XgpzdycygGJBqde334q4
google-site-verification=iWR2UGQb3MvVY83zY47ZFrGFVFLG6ADfpjqchlQjnok
google-site-verification=lnPjOx5EAxmESH8FSn4colWVMAxe18K4ZIopDB1IEDY
google-site-verification=uT9dAMjaTlnkbC0VnN5flFWp0Bsze7zHObWjZwkd2p8
google-site-verification=vPPg6DGiVgf5vhzQg5zGISLao6-07-lVzzpqvmCFe5Y
jamf-site-verification=nRPNM9HJGzWzUkvBtgvBrg
mgverify=2dd945066758840fe3bfbd9ccf90e2c6000458f13345baa576338880dcc86658
mgverify=9549a96a4bc9886fbf483bcd56872eaf2b5b9e690d264024041cf446664cb114
onetrust-domain-verification=84b59aa2659244d486b0b86f5db073dd
onetrust-domain-verification=af5b5fda116e45a9b4c4abcd9e571923
openai-domain-verification=dv-Uq90dak9n7LidGh0WsdFOOUu
serval-domain-verification-rahzqw=w9adwbCM3CJ9BrXnAleSWuMqz
smartsheet-site-validation=wTADkxxpf97DU9ZxO4RuFpZJyRvP7MRm
stripe-verification=E331E16D59119AEFB547211475C2E225C1BF6EB8CB885D300536B2852EAD3D74
uber-domain-verification=38ba2b7b-5ae3-4694-9701-086b20ea3d36
v=MCPv1; k=ed25519; p=MmZM6XexKcX4jiWqHtn3M0av9Q7HDmonAdP6PqktwX0=
v=spf1 include:%{i}._ip.%{h}._ehlo.%{d}._spf.vali.email ~all
verification_token=8FqT6wRlbrh3HQcHHiKudS5Ru
zapier-domain-verification-challenge=a1d665be-8176-4ada-9707-4332dfa7a2cc
TXT_dmarc.gitlab.com
v=DMARC1; p=reject; pct=100; rua=mailto:dmarc_agg@vali.email;
CAAgitlab.com
0 iodef "mailto:security@gitlab.com"
0 issue "amazon.com"
0 issue "amazonaws.com"
0 issue "amazontrust.com"
0 issue "awstrust.com"
0 issue "comodoca.com"
0 issue "digicert.com; cansignhttpexchanges=yes"
0 issue "globalsign.com"
0 issue "letsencrypt.org"
0 issue "pki.goog; cansignhttpexchanges=yes"
0 issue "sectigo.com"
0 issue "ssl.com"
0 issuewild "comodoca.com"
0 issuewild "digicert.com; cansignhttpexchanges=yes"
0 issuewild "letsencrypt.org"
0 issuewild "pki.goog; cansignhttpexchanges=yes"
0 issuewild "ssl.com"
DSgitlab.com—