Automated public DNS and web checks; results may be incomplete. These are passive observations, not an assessment of the organization.

D67/100

Executive summary

bankofamerica.com

High exposure. Significant weaknesses put the brand, customers and email at risk.

Partial coverage: the score is based on 95% of applicable check weight. 1 unverified check(s) are excluded, not counted as failures.

2026-11-15 18:20 UTC

Print report / PDF

Useful for your IT provider or a colleague. Anyone with the link can view the report.

Track your progress

Fix the findings, then come back and rescan. Your scan history is saved in this browser so you can see exactly what improved.

Email security24/25

Good83% coverage

Spoofing email from this domain is hard.

Encryption & certificate25/25

Good

Traffic to the site is encrypted and the certificate is valid.

Browser protections0/30

Critical

Several browser hardening headers are missing, which removes layers of protection against script injection and framing.

DNS infrastructure15/15

Good

The domain's infrastructure is well hardened.

Help someone else check their domain

Share this public report with a colleague. They can review the evidence and check their own domain.

Get the report badge

What to do first

1.
Tell browsers to always use the secure version
Helps browsers use HTTPS on future visits after they have received the policy.
Who can fix it: Your web host
How to verify after the fix
```
curl -sIL https://bankofamerica.com/ | grep -i "Strict-Transport-Security"
```
2.
Limit what scripts your pages are allowed to run
This adds one layer of protection against injected scripts.
Who can fix it: Your website developer or web host
How to verify after the fix
```
curl -sIL https://bankofamerica.com/ | grep -i "Content-Security-Policy"
```

A starting point, not a security guarantee.

What this grade means

Tested hostname: bankofamerica.com
Website request: GET https://bankofamerica.com/ → https://www.bankofamerica.com/
Scan time: 2026-11-15 18:20:06 UTC
Grading method: Version 2How grading works
Unverified or excluded checks: DKIM — digital signature on email · Not detected (common selectors only)

This is a snapshot of the public configuration checks listed in this report. It does not verify the site's owner, business legitimacy, application security, or absence of vulnerabilities. It is not a security certification.

Get the badge

Show the live grade for bankofamerica.com in a README, docs or site footer. The badge links to the public report and refreshes every 24 hours.

Scan shown on this page: ⁦2026-11-15 18:20:06 UTC⁩. The badge may display a cached result for up to 24 hours. Open the linked report to check its scan time.

Markdown

[![Domain Armor grade](https://getmirror.online/badge/bankofamerica.com.svg)](https://getmirror.online/report/bankofamerica.com)

HTML

<a href="https://getmirror.online/report/bankofamerica.com"><img src="https://getmirror.online/badge/bankofamerica.com.svg" alt="Domain Armor grade"></a>

Badge URL

https://getmirror.online/badge/bankofamerica.com.svg

Scan history

AI fix plan

Pick scans from this browser's history. The AI compares them, explains what changed and builds a prioritized, step-by-step plan.

Scans to analyze

0 of 6 selected

D67/10011/15/26, 06:20 PMCurrent

The current scan is always included.

AI-generated from your scan results only. Review each step before applying it; nothing is sent to or changed on the domain.

Technical detail

Click a check to see the public data, a verification command, a safe fix recommendation and documentation sources.

Email security

24/25

Encryption & certificate

25/25

Browser protections

0/30

DNS infrastructure

15/15

Public DNS records

A	bankofamerica.com	3.173.21.90 3.173.22.90 3.173.23.90
AAAA	bankofamerica.com	—
MX	bankofamerica.com	10 mxa-0000ec05.gslb.pphosted.com 10 mxb-0000ec05.gslb.pphosted.com
NS	bankofamerica.com	a.ns-bac.com b.ns-bac.org c.ns-bac.net d.ns-bac.info e.ns-boa.biz f.ns-boa.us g.ns-bac.com
TXT	bankofamerica.com	MS=ms26780064 00D0b000000De84=1TBKW000000GmaA 00D1D000000jT9H=1TBDR0000008OIt 00D210000002QLf=1TBDl0000008OKR 00D2g0000000ZPI=1TBD1000000003M 00D300000000K1b=1TBKZ0000004CFQ 00D300000000Lsb=1TBHp0000008OIF 00D300000005zGi=1TBKe000000oLob 00D3000000071D4=1TBKX0000008OLJ 00D30000000nW2o=1TBKd000000000B 00D30000000nqfl=1TBHt000000CaRH 00D30000001FXpf=1TBHt000000000Q 00D30000001H1Cv=1TBHt000000000B 00D30000001H88T=1TBKX000000Gmb7 00D30000001HRSt=1TBKe000000blLi 00D36000000rZom=1TBHq0000004C9D 00D37000000J5Lh=1TBKb000000TN74 00D3K0000008lCp=1TBDc0000008OM2 00D400000007EoN=1TBKY000000fxU2 00D46000000aATr=1TBKk0000000007 00D4C0000008x25=1TBD10000004CCb 00D52000000JPHM=1TBDU000000Gma9 00D60000000KTAU=1TBKZ000000001T 00D700000009PLP=1TBKe0000004C9D 00D750000000NEs=1TBDh0000004CB9 00D7g0000005BwN=1TBD70000004CB9 00D8I0000016LkC=1TBDa000000000a 00DD50000009T2F=1TBD50000004CCI 00DDE0000045mMg=1TBDE000000CaRH 00DDG00000NAncy=1TBDG0000008OKX 00DDL00000D40CM=1TBDL000000001O 00DDU00000081t1=1TBDU000000GmaU 00DDY0000000PuC=1TBDY0000004C9D 00DDc0000005CbI=1TBDc0000004CEs 00DDk000000E4pS=1TBDk0000008ONA 00DDn00000122RU=1TBDn0000004C9E 00DDn0000014WHa=1TBDn000000XZAR 00DDn0000014WMF=1TBDn0000000006 00DE0000000ZaqE=1TBHt000000XZEJ 00DHo000007ESQH=1TBHo000000sXtb 00Dd0000000fllf=1TBKh000000Kynr B2B8A4C34008BEF0023A22BE8CA6A799 C88C9B78D75886CF03030263D6E5D6AC _mue2mr9ttx0pb28iu4vju44fyivlze2 79HRM45BZQL4W6DODHCJ08ICCEPI4ZZ95OPF1PODC N73NW9KHOCFO1J30DG9M0U52P3KJYN458U7T7MOAO apple-domain-verification=8NQqHRIawsPLpi0W apple-domain-verification=d7eRv0GK7kdI6vEs apple-domain-verification=rELhhF8gjKgBEMuH ccisso=4d9729b7-b770-4856-947d-935d1b4dca9c docusign=7d338bac-902f-4792-8cdb-89a34b44ccf6 docusign=7f619a20-e6e1-47ba-88e2-5ffde1224228 facebook-domain-verification=vzgeob2q58bgtl7degzq855tbt3nld onetrust-domain-verification=e788a6ac2ccb43818ec10f692be6c065 webexdomainverification.=28c49c72-742e-4204-a733-18e8a8982a47 webexdomainverification.=9caf3cdf-4b7a-4806-8346-9a9591002ef3 webexdomainverification.AU51=01da9742-a899-4543-b134-6dba5c7669f0 webexdomainverification.BV9Q=6a8ae93e-8405-4430-91c6-1095ff8ab83a webexdomainverification.D04F=58ac4583-65d7-4b3d-89e2-2657f01be854 webexdomainverification.D182=d3bd60b7-b138-488e-9ce4-bb6a965bd46c webexdomainverification.DMQQ=2397072c-14ba-446b-af2b-b7d82b0c3d84 webexdomainverification.DPFR=fc6d9245-b5e5-456d-a469-6332595f0a02 webexdomainverification.EPKA=0bb7fd7a-0b2a-4645-ab25-62a5a06a68f1 webexdomainverification.KK43=938a1277-bf6a-441d-949c-c22f81ce00e0 webexdomainverification.KK48=150225ca-a113-4206-9228-4e3460b52486 webexdomainverification.1TKBV=0b486704-ef66-4735-96f0-8b4af777b303 webexdomainverification.1TKU2=55bfd798-3032-4b19-9e4d-1a3cdc9f83dd webexdomainverification.7VRFC=41f26899-9147-46be-927a-64a4921bce12 webexdomainverification.8BOEU=a4a75bdf-0a9d-419b-bad5-09ed7837a3a4 apple-domain-verification=_tTrLth1tZlC6XJXF7Ot2qt-U0o_cPfdE1qif1tDlDo XP24tQeCoyIoYKFUDBai/TAmSrkfqDi8E276kwIOINKuXcgwMZwhckPM+6x5egH7+IV5OFBRNkdgRIHmbQ4Usw== v=spf1 ip4:171.161.41.178 ip4:171.159.227.167 ip4:171.161.147.155 include:spf-0000ec15.pphosted.com ~all
TXT	_dmarc.bankofamerica.com	v=DMARC1; p=reject; fo=1; rua=mailto:auth.report_ns@bankofamerica.com; ruf=mailto:bankofamerica@ruf.agari.com
CAA	bankofamerica.com	0 issue "amazon.com" 0 issue "digicert.com" 0 issue "pki.goog" 0 issue "sectigo.com" 0 issue "ssl.com" 0 issue "thaidigitalid.com" 0 issuevmc "digicert.com"
DS	bankofamerica.com	2516 8 2 bdb1607a1869fd5b4f0be0602360aedd836769989d649454277d5d9fe742e705

Fix priorities

Sorted by risk: severity first, confirmed issues before hardening gaps, then effort and score impact.

1HighHSTS — enforce encryption in the browserHardening gap+8
2MediumClickjacking protectionHardening gap+5
3MediumCSP — protection from script injectionHardening gap+8
4LowX-Content-Type-OptionsHardening gap+4
5LowReferrer-PolicyHardening gap+3
6LowPermissions-PolicyHardening gap+2

To verify

Couldn't be confirmed from public data, so excluded from the score. Checking them clarifies your posture; it doesn't guarantee a score change.

DKIM — digital signature on email

Indicative alignment

Best-practice mapping of public findings to common frameworks. Passive scanning tests public configuration only; it doesn't prove compliance or a violation.

Google & Yahoo sender rulesIncomplete evidence · 1 unverified
SPF, DKIM and DMARC are required for bulk senders to Gmail and Yahoo; missing them risks rejected or spam-foldered mail.
PCI DSS v4.03 observed gaps
TLS, certificate and browser-header protections relate to PCI DSS v4.0 requirements 4.2 and 6.4 for payment pages.
HSTS — enforce encryption in the browser CSP — protection from script injection Clickjacking protection
NIS2 / vendor due diligence1 observed gaps
Vendor risk reviews under NIS2/DORA and cyber-insurance questionnaires check these public signals.
HSTS — enforce encryption in the browser
SOC 2 / ISO 27001 baseline4 observed gaps
Baseline external hygiene commonly expected in SOC 2 and ISO 27001 audits.
HSTS — enforce encryption in the browser CSP — protection from script injection Clickjacking protection X-Content-Type-Options

Indicative alignment only, based on public configuration. It doesn't establish whether a framework applies to you, and it isn't legal advice, an audit or a certification.

Head-to-head vs competitor

How do you stack up against competitors?

The check reads public data only and makes no changes to the domain. Recommendations are intended for the domain owner.

Is your domain as secure? Scan it free, no sign-up

All pre-scanned domains

bankofamerica.com

High exposure. Significant weaknesses put the brand, customers and email at risk.

Partial coverage: the score is based on 95% of applicable check weight. 1 unverified check(s) are excluded, not counted as failures.

2026-11-15 18:20 UTC

Useful for your IT provider or a colleague. Anyone with the link can view the report.

What to do first

Tell browsers to always use the secure version

Helps browsers use HTTPS on future visits after they have received the policy.

Who can fix it: Your web host

How to verify after the fix

curl -sIL https://bankofamerica.com/ | grep -i "Strict-Transport-Security"

Limit what scripts your pages are allowed to run

This adds one layer of protection against injected scripts.

Who can fix it: Your website developer or web host

How to verify after the fix

curl -sIL https://bankofamerica.com/ | grep -i "Content-Security-Policy"

What this grade means

Tested hostname

bankofamerica.com

Website request

GET https://bankofamerica.com/ → https://www.bankofamerica.com/

Scan time

2026-11-15 18:20:06 UTC

Grading method

Version 2How grading works

Unverified or excluded checks

DKIM — digital signature on email · Not detected (common selectors only)

Technical detail

Click a check to see the public data, a verification command, a safe fix recommendation and documentation sources.

Email security

24/25

Encryption & certificate

25/25

Browser protections

0/30

DNS infrastructure

15/15

Public DNS records

A	bankofamerica.com	3.173.21.90 3.173.22.90 3.173.23.90
AAAA	bankofamerica.com	—
MX	bankofamerica.com	10 mxa-0000ec05.gslb.pphosted.com 10 mxb-0000ec05.gslb.pphosted.com
NS	bankofamerica.com	a.ns-bac.com b.ns-bac.org c.ns-bac.net d.ns-bac.info e.ns-boa.biz f.ns-boa.us g.ns-bac.com
TXT	bankofamerica.com	MS=ms26780064 00D0b000000De84=1TBKW000000GmaA 00D1D000000jT9H=1TBDR0000008OIt 00D210000002QLf=1TBDl0000008OKR 00D2g0000000ZPI=1TBD1000000003M 00D300000000K1b=1TBKZ0000004CFQ 00D300000000Lsb=1TBHp0000008OIF 00D300000005zGi=1TBKe000000oLob 00D3000000071D4=1TBKX0000008OLJ 00D30000000nW2o=1TBKd000000000B 00D30000000nqfl=1TBHt000000CaRH 00D30000001FXpf=1TBHt000000000Q 00D30000001H1Cv=1TBHt000000000B 00D30000001H88T=1TBKX000000Gmb7 00D30000001HRSt=1TBKe000000blLi 00D36000000rZom=1TBHq0000004C9D 00D37000000J5Lh=1TBKb000000TN74 00D3K0000008lCp=1TBDc0000008OM2 00D400000007EoN=1TBKY000000fxU2 00D46000000aATr=1TBKk0000000007 00D4C0000008x25=1TBD10000004CCb 00D52000000JPHM=1TBDU000000Gma9 00D60000000KTAU=1TBKZ000000001T 00D700000009PLP=1TBKe0000004C9D 00D750000000NEs=1TBDh0000004CB9 00D7g0000005BwN=1TBD70000004CB9 00D8I0000016LkC=1TBDa000000000a 00DD50000009T2F=1TBD50000004CCI 00DDE0000045mMg=1TBDE000000CaRH 00DDG00000NAncy=1TBDG0000008OKX 00DDL00000D40CM=1TBDL000000001O 00DDU00000081t1=1TBDU000000GmaU 00DDY0000000PuC=1TBDY0000004C9D 00DDc0000005CbI=1TBDc0000004CEs 00DDk000000E4pS=1TBDk0000008ONA 00DDn00000122RU=1TBDn0000004C9E 00DDn0000014WHa=1TBDn000000XZAR 00DDn0000014WMF=1TBDn0000000006 00DE0000000ZaqE=1TBHt000000XZEJ 00DHo000007ESQH=1TBHo000000sXtb 00Dd0000000fllf=1TBKh000000Kynr B2B8A4C34008BEF0023A22BE8CA6A799 C88C9B78D75886CF03030263D6E5D6AC _mue2mr9ttx0pb28iu4vju44fyivlze2 79HRM45BZQL4W6DODHCJ08ICCEPI4ZZ95OPF1PODC N73NW9KHOCFO1J30DG9M0U52P3KJYN458U7T7MOAO apple-domain-verification=8NQqHRIawsPLpi0W apple-domain-verification=d7eRv0GK7kdI6vEs apple-domain-verification=rELhhF8gjKgBEMuH ccisso=4d9729b7-b770-4856-947d-935d1b4dca9c docusign=7d338bac-902f-4792-8cdb-89a34b44ccf6 docusign=7f619a20-e6e1-47ba-88e2-5ffde1224228 facebook-domain-verification=vzgeob2q58bgtl7degzq855tbt3nld onetrust-domain-verification=e788a6ac2ccb43818ec10f692be6c065 webexdomainverification.=28c49c72-742e-4204-a733-18e8a8982a47 webexdomainverification.=9caf3cdf-4b7a-4806-8346-9a9591002ef3 webexdomainverification.AU51=01da9742-a899-4543-b134-6dba5c7669f0 webexdomainverification.BV9Q=6a8ae93e-8405-4430-91c6-1095ff8ab83a webexdomainverification.D04F=58ac4583-65d7-4b3d-89e2-2657f01be854 webexdomainverification.D182=d3bd60b7-b138-488e-9ce4-bb6a965bd46c webexdomainverification.DMQQ=2397072c-14ba-446b-af2b-b7d82b0c3d84 webexdomainverification.DPFR=fc6d9245-b5e5-456d-a469-6332595f0a02 webexdomainverification.EPKA=0bb7fd7a-0b2a-4645-ab25-62a5a06a68f1 webexdomainverification.KK43=938a1277-bf6a-441d-949c-c22f81ce00e0 webexdomainverification.KK48=150225ca-a113-4206-9228-4e3460b52486 webexdomainverification.1TKBV=0b486704-ef66-4735-96f0-8b4af777b303 webexdomainverification.1TKU2=55bfd798-3032-4b19-9e4d-1a3cdc9f83dd webexdomainverification.7VRFC=41f26899-9147-46be-927a-64a4921bce12 webexdomainverification.8BOEU=a4a75bdf-0a9d-419b-bad5-09ed7837a3a4 apple-domain-verification=_tTrLth1tZlC6XJXF7Ot2qt-U0o_cPfdE1qif1tDlDo XP24tQeCoyIoYKFUDBai/TAmSrkfqDi8E276kwIOINKuXcgwMZwhckPM+6x5egH7+IV5OFBRNkdgRIHmbQ4Usw== v=spf1 ip4:171.161.41.178 ip4:171.159.227.167 ip4:171.161.147.155 include:spf-0000ec15.pphosted.com ~all
TXT	_dmarc.bankofamerica.com	v=DMARC1; p=reject; fo=1; rua=mailto:auth.report_ns@bankofamerica.com; ruf=mailto:bankofamerica@ruf.agari.com
CAA	bankofamerica.com	0 issue "amazon.com" 0 issue "digicert.com" 0 issue "pki.goog" 0 issue "sectigo.com" 0 issue "ssl.com" 0 issue "thaidigitalid.com" 0 issuevmc "digicert.com"
DS	bankofamerica.com	2516 8 2 bdb1607a1869fd5b4f0be0602360aedd836769989d649454277d5d9fe742e705

Indicative alignment

Best-practice mapping of public findings to common frameworks. Passive scanning tests public configuration only; it doesn't prove compliance or a violation.

Google & Yahoo sender rulesIncomplete evidence · 1 unverified

SPF, DKIM and DMARC are required for bulk senders to Gmail and Yahoo; missing them risks rejected or spam-foldered mail.

PCI DSS v4.03 observed gaps

TLS, certificate and browser-header protections relate to PCI DSS v4.0 requirements 4.2 and 6.4 for payment pages.

HSTS — enforce encryption in the browser CSP — protection from script injection Clickjacking protection

NIS2 / vendor due diligence1 observed gaps

Vendor risk reviews under NIS2/DORA and cyber-insurance questionnaires check these public signals.

HSTS — enforce encryption in the browser

SOC 2 / ISO 27001 baseline4 observed gaps

Baseline external hygiene commonly expected in SOC 2 and ISO 27001 audits.

HSTS — enforce encryption in the browser CSP — protection from script injection Clickjacking protection X-Content-Type-Options

Indicative alignment only, based on public configuration. It doesn't establish whether a framework applies to you, and it isn't legal advice, an audit or a certification.

bankofamerica.com

Track your progress

Help someone else check their domain

What to do first

What this grade means

Get the badge

Scan history

AI fix plan

Scans to analyze

Technical detail

Email security

Encryption & certificate

Browser protections

DNS infrastructure

Public DNS records

Is your domain as secure? Scan it free, no sign-up

bankofamerica.com

Track your progress

Help someone else check their domain

What to do first

What this grade means

Get the badge

Scan history

AI fix plan

Scans to analyze

Technical detail

Email security

Encryption & certificate

Browser protections

DNS infrastructure

Public DNS records

Is your domain as secure? Scan it free, no sign-up

Agent access & discovery signals