Executive summary
monday.com
Moderate exposure. There are gaps an attacker could exploit — fix them soon.
Full coverage: every applicable check was assessed.
2026-11-15 19:34 UTC
Useful for your IT provider or a colleague. Anyone with the link can view the report.
Track your progress
Fix the findings, then come back and rescan. Your scan history is saved in this browser so you can see exactly what improved.
Spoofing email from this domain is hard.
Traffic to the site is encrypted and the certificate is valid.
Several browser hardening headers are missing, which removes layers of protection against script injection and framing.
The domain's infrastructure lacks basic protections.
Help someone else check their domain
Share this public report with a colleague. They can review the evidence and check their own domain.
What to do first
- 1.
Limit what scripts your pages are allowed to run
This adds one layer of protection against injected scripts.
Who can fix it: Your website developer or web host
How to verify after the fix
curl -sIL https://monday.com/ | grep -i "Content-Security-Policy"
- 2.
Turn on DNS signing for your domain
Signing helps resolvers detect forged answers about your domain.
Who can fix it: Your domain registrar or DNS provider
How to verify after the fix
dig +short DS monday.com
A starting point, not a security guarantee.
What this grade means
- Tested hostname
- monday.com
- Website request
- GET https://monday.com/
- Scan time
- 2026-11-15 19:34:36 UTC
- Grading method
- Version 2How grading works
- Unverified or excluded checks
- None. Every applicable check was assessed.
This is a snapshot of the public configuration checks listed in this report. It does not verify the site's owner, business legitimacy, application security, or absence of vulnerabilities. It is not a security certification.
Get the badge
Show the live grade for monday.com in a README, docs or site footer. The badge links to the public report and refreshes every 24 hours.
Scan shown on this page: 2026-11-15 19:34:36 UTC. The badge may display a cached result for up to 24 hours. Open the linked report to check its scan time.
[](https://getmirror.online/report/monday.com)<a href="https://getmirror.online/report/monday.com"><img src="https://getmirror.online/badge/monday.com.svg" alt="Domain Armor grade"></a>https://getmirror.online/badge/monday.com.svgScan history
AI fix plan
Pick scans from this browser's history. The AI compares them, explains what changed and builds a prioritized, step-by-step plan.
Scans to analyze
0 of 6 selectedThe current scan is always included.
AI-generated from your scan results only. Review each step before applying it; nothing is sent to or changed on the domain.
Agent access & discovery signals
Optional and unscored — it never changes the grade. Reads up to three public files from this site (robots.txt, llms.txt and /.well-known/security.txt) and reuses the homepage headers already fetched. llms.txt is an emerging proposal, not an official standard. It is informational and does not affect the grade.
Technical detail
Click a check to see the public data, a verification command, a safe fix recommendation and documentation sources.
Email security
30/30Encryption & certificate
25/25Browser protections
12/30DNS infrastructure
3/15Public DNS records
| A | monday.com | 104.16.50.19 104.16.51.19 |
| AAAA | monday.com | 2606:4700::6810:3313 2606:4700::6810:3213 |
| MX | monday.com | 1 aspmx.l.google.com 5 alt1.aspmx.l.google.com 5 alt2.aspmx.l.google.com 10 alt3.aspmx.l.google.com 10 alt4.aspmx.l.google.com |
| NS | monday.com | constellix.monday.com dns1.p07.nsone.net dns2.p07.nsone.net dns3.p07.nsone.net dns4.p07.nsone.net |
| TXT | monday.com | 7eao3afhbfufihathi844rn358 _globalsign-domain-verification=BahbT-Pu-HaLP9bBimZ0MGe-4CPc4Z_MXqKNUajBmF adobe-idp-site-verification=4a28a23002525aa8753c0a2a357f51ef3f88e857a089e6fc6e8179f6eca41653 anthropic-domain-verification-7g1axa=M1DWcuK61kzur9Gn16FH1FQNi apple-domain-verification=XL5Cmgm331M1eZGz beautifulai-site-verification=6531bb52-92f4-4931-a399-2907c725296c canva-site-verification=3_y3K-pY2-bPLnD23w8RdA cdn.webflow.com cursor-domain-verification-1xymmd=vm9B3XrmUMV0SSwVgFXQAKYHQ docker-verification=cd63d0a2-9fdd-4b16-bc02-babb1c9dae29 docusign=affdaf1d-fd52-4ca5-8f2d-5ba2debb128d dropbox-domain-verification=r5115zqzmzgf elevenlabs=61T18dFUEz-WuMs1hvAF0RSZNdgUYSRhsssP1jVNOEI elevenlabs=ewclOwDbWZUXERArdQ0vX-GUQ7Mt1liqOGHifSHA0wc figma-domain-verification=adf325984b2bb689173f38050abbdc5cbe781d3eacbb763b5032a8c2260e10a4-1745913843 google-site-verification=6P6mJfBrzLvoWAoLHqZiY6jgegKc19yFPPRLCN0hmYY google-site-verification=EcOWxIvJU1AbZ7Ojie7CKDckYL68XEXJBjWpo8vnAdQ google-site-verification=FlNiDEkQx36N0yQMm9eYCzKaj0b4zIPh01SvjwwBszI google-site-verification=H4Xx4Zs7Rlw619-1_dAwIuDABlcol2sqDyy_osry2-k google-site-verification=HFPU_u65hrQqsibk4ix1_quR9LSeDJHcobqkcJYTwO0 google-site-verification=N2fpLCJKj0w18Kyzc5KRzBNcNLNDMsv13Z_ZrSajJUA google-site-verification=NZAcN9LNegey2zKeweVhqQMiEczWq_uyLy2IsHVsung google-site-verification=VsTahGqY9YdwqKn3S6S4DavBWaljbBZJQ5B2B-n3tgc google-site-verification=_HZouyhvd28tqL5X__njeoghZ2UjhfcWby4hy2z1jsA google-site-verification=_HiigzB4s_c0MxwdBQWnCgBkPOBGp_lUSQ7pcXs76UI google-site-verification=fqzKhYZp7j7AxbL_CmBZqGUhnnM1wuz0oNQ0s_l_ylg google-site-verification=oVfnMhLYdphBoisBFCGWDvZTTxn8seP0v6EXQGussig google-site-verification=qpYNsSVs6h2JpVjxBwwz3wWZR8dx5IlQZtCQlHZ97i4 google-site-verification=t4sSFFAW6HC1LD6wI6650xQAMxeNCJHfE3BP32HLAEk hcp-domain-verification=360dbb75eff2be58322f5fdcb2cf2e05a76f60524561b3fa3b773970e8ff7b64 hubspot-domain-verification=OTIxYTA0OWItMzgxOS00MmE2LWE4YmYtN2Q0Yjc2MzUxYWY0 jamf-site-verification=ybi4W8--nfpX1Xoxv6LPGQ miro-verification=62b9a03f81cbd8af7a2f6dadd0cd6a653f354962 mixpanel-domain-verify=1eedebdc-3c17-447c-b145-3340e1889cc7 nja1lpovlt3kh1nv76etqa23q8 openai-domain-verification=dv-mpxGzSiHdsMGFdHJp3gBIRL4 sprout-social-1c7c86e8-63c1-4997-8ace-3778a4b551c5 status-page-domain-verification=nmq10qvxvpzt stripe-verification=21F36C47B2BA565463218E5061EB784E53B9097F05F6280AB45FDBAC8A8606A8 stripe-verification=2861A1653DFC42A7567FA14B057D41CC17534C2263A325E23630AE59241A2D9E stripe-verification=75F06D584F5FEC058E13065C8DF6FD03B21E8DEB02EB75B30D41DBB1F649D981 stripe-verification=A912728709AB229C9B12D18E8FED421FA446155CF3C60EA9E133D9D4DEF1434D stripe-verification=C041A5DEAE672153FDA8AFCB2EE2961470D6D7560514B2996F7F3790784D874B uber-domain-verification=4e0eaac6-d2ba-4063-bede-4b576990c94a v=MCPv1; k=ed25519; p=uzK9AAUvFHRpQePWvFIPnLiFMUwK8jyYFFMt4AESZ1c= v=spf1 include:servers.mcsv.net include:_spf.google.com include:_spf.qemailserver.com include:_spf.salesforce.com include:mail.zendesk.com include:_spf.getresponse.com ip4:192.92.97.253 ip4:167.89.101.197 ip4:205.201.137.64 ip4:149.72.206.224 ip4:149.72.28.207 ip4:149.72.33.113 ip4:159.183.114.208 ip4:167.89.101.197 ip4:167.89.101.203 ip4:167.89.105.198 ip4:167.89.105.2 ip4:168.245.109.80 ip4:168.245.70.46 ip4:198.61.254.181 ip4:159.183.224.123 ip4:185.250.239.27 ip4:159.183.229.241 -all zapier-domain-verification-challenge=167fa904-929d-449d-a49a-bdca5d4c41c9 zoom-domain-verification=ZOOM_verify_bce521f6f9fb4d52b7ac42eca6bf0383 zoom-domain-verification=f03a7524-e68c-11ee-bd3d-0242ac120002 |
| TXT | _dmarc.monday.com | v=DMARC1; p=reject; rua=mailto:dmarc-reports@mailsec.monday.com |
| CAA | monday.com | — |
| DS | monday.com | — |