Automated public DNS and web checks; results may be incomplete. These are passive observations, not an assessment of the organization.

D65/100

Executive summary

berkeley.edu

High exposure. Significant weaknesses put the brand, customers and email at risk.

Full coverage: every applicable check was assessed.

2026-11-15 18:29 UTC

Print report / PDF

Useful for your IT provider or a colleague. Anyone with the link can view the report.

Track your progress

Fix the findings, then come back and rescan. Your scan history is saved in this browser so you can see exactly what improved.

Email security29/30

Good

Spoofing email from this domain is hard.

Encryption & certificate18/25

Needs attention

Encryption is in place, but a gap could expose users.

Browser protections8/30

Critical

Several browser hardening headers are missing, which removes layers of protection against script injection and framing.

DNS infrastructure10/15

Needs attention

The domain's infrastructure works, but recommended hardening is missing.

Help someone else check their domain

Share this public report with a colleague. They can review the evidence and check their own domain.

Get the report badge

What to do first

1.
Tell browsers to always use the secure version
Helps browsers use HTTPS on future visits after they have received the policy.
Who can fix it: Your web host
How to verify after the fix
```
curl -sIL https://berkeley.edu/ | grep -i "Strict-Transport-Security"
```
2.
Limit what scripts your pages are allowed to run
This adds one layer of protection against injected scripts.
Who can fix it: Your website developer or web host
How to verify after the fix
```
curl -sIL https://berkeley.edu/ | grep -i "Content-Security-Policy"
```

A starting point, not a security guarantee.

What this grade means

Tested hostname: berkeley.edu
Website request: GET https://berkeley.edu/ → https://www.berkeley.edu/
Scan time: 2026-11-15 18:29:43 UTC
Grading method: Version 2How grading works
Unverified or excluded checks: None. Every applicable check was assessed.

This is a snapshot of the public configuration checks listed in this report. It does not verify the site's owner, business legitimacy, application security, or absence of vulnerabilities. It is not a security certification.

Get the badge

Show the live grade for berkeley.edu in a README, docs or site footer. The badge links to the public report and refreshes every 24 hours.

Scan shown on this page: ⁦2026-11-15 18:29:43 UTC⁩. The badge may display a cached result for up to 24 hours. Open the linked report to check its scan time.

Markdown

[![Domain Armor grade](https://getmirror.online/badge/berkeley.edu.svg)](https://getmirror.online/report/berkeley.edu)

HTML

<a href="https://getmirror.online/report/berkeley.edu"><img src="https://getmirror.online/badge/berkeley.edu.svg" alt="Domain Armor grade"></a>

Badge URL

https://getmirror.online/badge/berkeley.edu.svg

Scan history

AI fix plan

Pick scans from this browser's history. The AI compares them, explains what changed and builds a prioritized, step-by-step plan.

Scans to analyze

0 of 6 selected

D65/10011/15/26, 06:29 PMCurrent

The current scan is always included.

AI-generated from your scan results only. Review each step before applying it; nothing is sent to or changed on the domain.

Technical detail

Click a check to see the public data, a verification command, a safe fix recommendation and documentation sources.

Email security

29/30

Encryption & certificate

18/25

Browser protections

8/30

DNS infrastructure

10/15

Public DNS records

A	berkeley.edu	141.193.213.20 141.193.213.21
AAAA	berkeley.edu	—
MX	berkeley.edu	1 aspmx.l.google.com 5 alt1.aspmx.l.google.com 5 alt2.aspmx.l.google.com 10 alt3.aspmx.l.google.com 10 alt4.aspmx.l.google.com
NS	berkeley.edu	adns1.berkeley.edu adns2.berkeley.edu adns3.berkeley.edu
TXT	berkeley.edu	MS=ms19521665 MS=ms37758698 iContact1393487 iContact1462072 iContact1583632 896263912-18360412 klaviyo-site-verification=SWYLuM ZOOM_verify_RirbP7N1QWC3Zzm02oL4Cw apple-domain-verification=ZDtApcKYPmKfYxn4 MS=10BE0CF63C8BD5AFF9A6EF7B71763B098A905719 brevo-code:a2b2aef0282cf9caec92be7bed7630ad brevo-code:c6f4c03d44819f8975dc05ff6b3df3a9 brevo-code:e1e8345a4a2352cdbd9d6979093f2aec brevo-code:ee0b01818d57850991280d3999efc841 docusign=25bb9bc1-b377-48ce-a907-61472fca6261 docusign=31f4475e-737f-4a3a-b6ea-60b1ac273c95 jamf-site-verification=2jicltwxCxH93ep4OhO0dA canva-site-verification=HJ933woS6KmNfYtvOaJHZA amazonses:IuakF7FVH1Y7h0Kap7krqHwRvoXFOzSET+Ri1VBHziA= adobe-idp-site-verification=a113c870-3c49-4b4a-b3a4-31e1cf1860cb google-site-verification=C4YkQW0t-gtD5FpVWdjxAipEUofVb2p0KmW3xFaUJeA google-site-verification=CDuttEoV44OF0dD7qwidnTj3wvYxIPz05W6MKEZfKYc google-site-verification=R5hbazPMfJqtXtm6OHprlDpBnSThQvYDrt-i-IqZvjE google-site-verification=fL93jj-VPnl_5wdFDh26YshzKVPraWAurHaBCu-k-Xw google-site-verification=loQrJWyMsMB249uINb-AsRGTWVoLdTc44Td3aMGn-NE sending_domain102272=da1fdb1bce80fcb235c498ec3ad47745fed6ea7c6dc03752d88318531e6b07b7 atlassian-domain-verification=RIwGoMGAwFoHKm3AJg0bhFvuzEkRseqI6LStzthTqt4dWfA6Mqm5OCHFbZd1BJ9e v=spf1 include:_spf.berkeley.edu include:_spf2.berkeley.edu include:_spf.google.com include:_spf.qualtrics.com include:servers.mcsv.net include:spf.mailjet.com a:c.spf.service-now.com ~all
TXT	_dmarc.berkeley.edu	v=DMARC1; p=reject; np=reject; psd=n; rua=mailto:dmarcrpt@berkeley.edu; ruf=mailto:dmarcrpt@berkeley.edu
CAA	berkeley.edu	—
DS	berkeley.edu	10359 10 2 90c805bdf785312d7ce4af92d697cdb1e6f5228d7364dce259d0652b8579c65b 17532 10 2 a6c9ec2b5ac641f87b436d2ff9adb8d5655bc8434de90cc47ed47f8bad65ae1f

Fix priorities

Sorted by risk: severity first, confirmed issues before hardening gaps, then effort and score impact.

1HighHSTS — enforce encryption in the browserHardening gap+8
2HighHTTP → HTTPS redirectHardening gap+7
3MediumCSP — protection from script injectionHardening gap+8
4LowCAA — who may issue certificatesHardening gap+5
5LowX-Content-Type-OptionsHardening gap+4
6LowPermissions-PolicyHardening gap+2

Indicative alignment

Best-practice mapping of public findings to common frameworks. Passive scanning tests public configuration only; it doesn't prove compliance or a violation.

Google & Yahoo sender rulesNo gaps observed
SPF, DKIM and DMARC are required for bulk senders to Gmail and Yahoo; missing them risks rejected or spam-foldered mail.
PCI DSS v4.03 observed gaps
TLS, certificate and browser-header protections relate to PCI DSS v4.0 requirements 4.2 and 6.4 for payment pages.
HTTP → HTTPS redirect HSTS — enforce encryption in the browser CSP — protection from script injection
NIS2 / vendor due diligence2 observed gaps
Vendor risk reviews under NIS2/DORA and cyber-insurance questionnaires check these public signals.
HSTS — enforce encryption in the browser CAA — who may issue certificates
SOC 2 / ISO 27001 baseline3 observed gaps
Baseline external hygiene commonly expected in SOC 2 and ISO 27001 audits.
HSTS — enforce encryption in the browser CSP — protection from script injection X-Content-Type-Options

Indicative alignment only, based on public configuration. It doesn't establish whether a framework applies to you, and it isn't legal advice, an audit or a certification.

Head-to-head vs competitor

How do you stack up against competitors?

The check reads public data only and makes no changes to the domain. Recommendations are intended for the domain owner.

Is your domain as secure? Scan it free, no sign-up

All pre-scanned domains

What to do first

Tell browsers to always use the secure version

Helps browsers use HTTPS on future visits after they have received the policy.

Who can fix it: Your web host

How to verify after the fix

curl -sIL https://berkeley.edu/ | grep -i "Strict-Transport-Security"

Limit what scripts your pages are allowed to run

This adds one layer of protection against injected scripts.

Who can fix it: Your website developer or web host

How to verify after the fix

curl -sIL https://berkeley.edu/ | grep -i "Content-Security-Policy"

What this grade means

Tested hostname

berkeley.edu

Website request

GET https://berkeley.edu/ → https://www.berkeley.edu/

Scan time

2026-11-15 18:29:43 UTC

Grading method

Version 2How grading works

Unverified or excluded checks

None. Every applicable check was assessed.

Technical detail

Click a check to see the public data, a verification command, a safe fix recommendation and documentation sources.

Email security

29/30

Encryption & certificate

18/25

Browser protections

8/30

DNS infrastructure

10/15

Public DNS records

A	berkeley.edu	141.193.213.20 141.193.213.21
AAAA	berkeley.edu	—
MX	berkeley.edu	1 aspmx.l.google.com 5 alt1.aspmx.l.google.com 5 alt2.aspmx.l.google.com 10 alt3.aspmx.l.google.com 10 alt4.aspmx.l.google.com
NS	berkeley.edu	adns1.berkeley.edu adns2.berkeley.edu adns3.berkeley.edu
TXT	berkeley.edu	MS=ms19521665 MS=ms37758698 iContact1393487 iContact1462072 iContact1583632 896263912-18360412 klaviyo-site-verification=SWYLuM ZOOM_verify_RirbP7N1QWC3Zzm02oL4Cw apple-domain-verification=ZDtApcKYPmKfYxn4 MS=10BE0CF63C8BD5AFF9A6EF7B71763B098A905719 brevo-code:a2b2aef0282cf9caec92be7bed7630ad brevo-code:c6f4c03d44819f8975dc05ff6b3df3a9 brevo-code:e1e8345a4a2352cdbd9d6979093f2aec brevo-code:ee0b01818d57850991280d3999efc841 docusign=25bb9bc1-b377-48ce-a907-61472fca6261 docusign=31f4475e-737f-4a3a-b6ea-60b1ac273c95 jamf-site-verification=2jicltwxCxH93ep4OhO0dA canva-site-verification=HJ933woS6KmNfYtvOaJHZA amazonses:IuakF7FVH1Y7h0Kap7krqHwRvoXFOzSET+Ri1VBHziA= adobe-idp-site-verification=a113c870-3c49-4b4a-b3a4-31e1cf1860cb google-site-verification=C4YkQW0t-gtD5FpVWdjxAipEUofVb2p0KmW3xFaUJeA google-site-verification=CDuttEoV44OF0dD7qwidnTj3wvYxIPz05W6MKEZfKYc google-site-verification=R5hbazPMfJqtXtm6OHprlDpBnSThQvYDrt-i-IqZvjE google-site-verification=fL93jj-VPnl_5wdFDh26YshzKVPraWAurHaBCu-k-Xw google-site-verification=loQrJWyMsMB249uINb-AsRGTWVoLdTc44Td3aMGn-NE sending_domain102272=da1fdb1bce80fcb235c498ec3ad47745fed6ea7c6dc03752d88318531e6b07b7 atlassian-domain-verification=RIwGoMGAwFoHKm3AJg0bhFvuzEkRseqI6LStzthTqt4dWfA6Mqm5OCHFbZd1BJ9e v=spf1 include:_spf.berkeley.edu include:_spf2.berkeley.edu include:_spf.google.com include:_spf.qualtrics.com include:servers.mcsv.net include:spf.mailjet.com a:c.spf.service-now.com ~all
TXT	_dmarc.berkeley.edu	v=DMARC1; p=reject; np=reject; psd=n; rua=mailto:dmarcrpt@berkeley.edu; ruf=mailto:dmarcrpt@berkeley.edu
CAA	berkeley.edu	—
DS	berkeley.edu	10359 10 2 90c805bdf785312d7ce4af92d697cdb1e6f5228d7364dce259d0652b8579c65b 17532 10 2 a6c9ec2b5ac641f87b436d2ff9adb8d5655bc8434de90cc47ed47f8bad65ae1f

Indicative alignment

Best-practice mapping of public findings to common frameworks. Passive scanning tests public configuration only; it doesn't prove compliance or a violation.

Google & Yahoo sender rulesNo gaps observed

SPF, DKIM and DMARC are required for bulk senders to Gmail and Yahoo; missing them risks rejected or spam-foldered mail.

PCI DSS v4.03 observed gaps

TLS, certificate and browser-header protections relate to PCI DSS v4.0 requirements 4.2 and 6.4 for payment pages.

HTTP → HTTPS redirect HSTS — enforce encryption in the browser CSP — protection from script injection

NIS2 / vendor due diligence2 observed gaps

Vendor risk reviews under NIS2/DORA and cyber-insurance questionnaires check these public signals.

HSTS — enforce encryption in the browser CAA — who may issue certificates

SOC 2 / ISO 27001 baseline3 observed gaps

Baseline external hygiene commonly expected in SOC 2 and ISO 27001 audits.

HSTS — enforce encryption in the browser CSP — protection from script injection X-Content-Type-Options

Indicative alignment only, based on public configuration. It doesn't establish whether a framework applies to you, and it isn't legal advice, an audit or a certification.

berkeley.edu

Track your progress

Help someone else check their domain

What to do first

What this grade means

Get the badge

Scan history

AI fix plan

Scans to analyze

Technical detail

Email security

Encryption & certificate

Browser protections

DNS infrastructure

Public DNS records

Is your domain as secure? Scan it free, no sign-up

berkeley.edu

Track your progress

Help someone else check their domain

What to do first

What this grade means

Get the badge

Scan history

AI fix plan

Scans to analyze

Technical detail

Email security

Encryption & certificate

Browser protections

DNS infrastructure

Public DNS records

Is your domain as secure? Scan it free, no sign-up

Agent access & discovery signals