Automated public DNS and web checks; results may be incomplete. These are passive observations, not an assessment of the organization.

C75/100

Executive summary

bestbuy.com

Moderate exposure. There are gaps an attacker could exploit — fix them soon.

Partial coverage: the score is based on 52% of applicable check weight. 8 unverified check(s) are excluded, not counted as failures.

2026-11-15 18:23 UTC

Print report / PDF

Useful for your IT provider or a colleague. Anyone with the link can view the report.

Track your progress

Fix the findings, then come back and rescan. Your scan history is saved in this browser so you can see exactly what improved.

Email security29/30

Good

Spoofing email from this domain is hard.

Encryption & certificate7/7

Good28% coverage

Traffic to the site is encrypted and the certificate is valid.

Browser protections—

Not verified

Nothing in this category could be verified from public data.

DNS infrastructure3/15

Critical

The domain's infrastructure lacks basic protections.

Help someone else check their domain

Share this public report with a colleague. They can review the evidence and check their own domain.

Get the report badge

What to do first

1.
Turn on DNS signing for your domain
Signing helps resolvers detect forged answers about your domain.
Who can fix it: Your domain registrar or DNS provider
How to verify after the fix
```
dig +short DS bestbuy.com
```
2.
Choose which companies may issue certificates for your domain
This reduces the chance of a certificate being issued by a provider you did not choose.
Who can fix it: Your domain registrar or DNS provider
How to verify after the fix
```
dig +short CAA bestbuy.com
```

A starting point, not a security guarantee.

What this grade means

Tested hostname: bestbuy.com
Website request: GET https://bestbuy.com/ → https://www.bestbuy.com/
Scan time: 2026-11-15 18:23:50 UTC
Grading method: Version 2How grading works
Unverified or excluded checks: HTTPS available · Unverified
SSL/TLS certificate validity · Unverified
HSTS — enforce encryption in the browser · Unverified
CSP — protection from script injection · Unverified
Clickjacking protection · Unverified
X-Content-Type-Options · Unverified
Referrer-Policy · Unverified
Permissions-Policy · Unverified

This is a snapshot of the public configuration checks listed in this report. It does not verify the site's owner, business legitimacy, application security, or absence of vulnerabilities. It is not a security certification.

Get the badge

Show the live grade for bestbuy.com in a README, docs or site footer. The badge links to the public report and refreshes every 24 hours.

Scan shown on this page: ⁦2026-11-15 18:23:50 UTC⁩. The badge may display a cached result for up to 24 hours. Open the linked report to check its scan time.

Markdown

[![Domain Armor grade](https://getmirror.online/badge/bestbuy.com.svg)](https://getmirror.online/report/bestbuy.com)

HTML

<a href="https://getmirror.online/report/bestbuy.com"><img src="https://getmirror.online/badge/bestbuy.com.svg" alt="Domain Armor grade"></a>

Badge URL

https://getmirror.online/badge/bestbuy.com.svg

Scan history

AI fix plan

Pick scans from this browser's history. The AI compares them, explains what changed and builds a prioritized, step-by-step plan.

Scans to analyze

0 of 6 selected

C75/10011/15/26, 06:23 PMCurrent

The current scan is always included.

AI-generated from your scan results only. Review each step before applying it; nothing is sent to or changed on the domain.

Technical detail

Click a check to see the public data, a verification command, a safe fix recommendation and documentation sources.

Email security

29/30

Encryption & certificate

7/7

Browser protections

—

DNS infrastructure

3/15

Public DNS records

A	bestbuy.com	184.28.2.249
AAAA	bestbuy.com	—
MX	bestbuy.com	10 mxa-002a6b01.gslb.pphosted.com 30 mx0a-002a6b01.pphosted.com 10 mxb-002a6b01.gslb.pphosted.com 30 mx0b-002a6b01.pphosted.com
NS	bestbuy.com	ns1-119.akam.net eur1.akam.net ns1-118.akam.net use1.akam.net usw2.akam.net asia3.akam.net usc2.akam.net eur2.akam.net
TXT	bestbuy.com	onetrust-domain-verification=b709621cb21a441a9906ac5fe67acf4f d365mktkey=4aspdiy55hf9qe6u9i7kg67n1 d365mktkey=2xfbovrpbth5b74ebygf1lnoq _c1hfgiy1y1ykdjiw6m9rornb4xmyvva _globalsign-domain-verification=OuhJ-18jU_ZoR0fywqNBLK0TA5KlUlb7k3G_I6zGn8 _globalsign-domain-verification=c17wKbxTHRlX9guWhH5pvY8jYFvxnFjwQSZ1H2U6qo anthropic-domain-verification-gn84cy=IX6D2hSzfDx5E5ytxYLnsJJyw _globalsign-domain-verification=Rz2ibbBlL0vg31R_v5MoH1lsSmldHcG7HE7FQFrWxn _globalsign-domain-verification=kOdr8YXX373IW1gr_Of8-4bZONLkNzH_mTPCWGQ-sW docusign=c614af81-8967-4e75-837d-cecfdcd2c879 _wrigrwh3deyxponfw7cjri8usbysbwu d365mktkey=6orxxh8leit5lzxd0abqnuuqe shopify-verification-code=D2rnbVaTP8FoOEL9qmvldwvq6sLwMX infoblox-domain-mastery=e7509e2d71273e9f7614a639f09a001905a408b536134c6edc7acfb6923b3384e8 d365mktkey=2qemjncqsww30ft64gp4gyg7g Dynatrace-site-verification=7ddbc628-a14e-4777-9382-1c465da01cbe__cerg0381k2nnur85q9kj11l2un docusign=c36307b9-2820-4415-92d1-ca4faea5aac3 _globalsign-domain-verification=p9Qai1DIi4fFkvfsen_nMkaGokY-5QSLW1qyHhWxVF atlassian-domain-verification=TtUwVlR0K3KZx5O4wjw626rEZ0jNSaWcym1iHnu3MI3N72lPEma/xgp8ia6cifzM d365mktkey=2ud6jfzvcdaomybdz7yvh8pwx adobe-idp-site-verification=525758772c073f6d5fdcd1854e6caf8bd27517827a81eafb9c048531abb4f428 Dynatrace-site-verification=882011e0-9bd0-40d2-822f-f85f661d2095__bbfqnfh72ema7g5dccpprntb12 liveramp-site-verification=BCRY5T_vpgZw0uDfS90iCAyU1c5pqGNVx5l2PaDnXH8 v=spf1 ip4:198.22.123.0/24 ip4:168.94.230.0/24 ip4:198.22.122.4 ip4:198.22.122.6 include:spf.protection.outlook.com include:spf-002a6b01.pphosted.com include:spf-007f1401.pphosted.com ~all docker-verification=6e02b058-6a9b-4bd6-b2ff-19d7b53ec244 globalsign-domain-verification=eypMAkwo9EOFdpks_S48knXiSq036prCa_TIc0JYYR _globalsign-domain-verification=WlIRFk9I6Bf84ZXoznfQPiEFxSqvhCwi_u5ZK-dZkM bestbuy.com CKO=cli_phqj6vpebyqe3ds4jj4qyqm6ze _globalsign-domain-verification=E4YIjaa32WEGqA47Dm0jdFThhcAH_eakVg4sP0hwYj _globalsign-domain-verification=FPaCAb-qc1XQOp3g21zvMhYe5Kqf5_oFrOTNv2bvdP Dynatrace-site-verification=d39123ba-6007-4678-9099-bab300e4cc4d__b1g36mt3t36i7o1gb5q67ak9is _globalsign-domain-verification=GEpPhKvRpaNmLHFvhc88dKiT10KXAaZ5eR7TObGHOP globalsign-domain-verification=DvclDCGtuqSdLq6_HvbJttP6xPFiMqtYrJIaYYgWvO _globalsign-domain-verification=-Dnz9-l2YuDUGF6pkxiEAV2dZD8vCAw1vjyXgf4X5f CKO=cli_t6crzmn6zwgudjx7rtdpd54eqq confluent-verification=c6f05e07-472d-4c33-85a6-8fbaf2c089a7 _globalsign-domain-verification=zohml7OMpOYBgZSep8H4TwrXwEEyxdtmxOmjWh0Dvb DlUfs9zx61nM1yUbnSP+ZzoX8CvEbKiZw6FRCqveTF8fDYmLIOR2LfzMYaXuit+sLpBYYV4QrRRFoUSVfOZ5HQ== d98949bf-1774-453a-a6d4-a76227024157 google-site-verification=s1KAsSED_OW5FMoqEkTv7d5Vl6IjwQbhNFAkBqtykiQ mk-org-sso-465501ed-efb7-4bdd-a703-dc485ceab414 v=verifydomain MS=ms22146670 openai-domain-verification=dv-vi3MOTmQL7yhfQCB4T8HwJtS
TXT	_dmarc.bestbuy.com	v=DMARC1; p=reject; fo=1; rua=mailto:dmarc_rua@emaildefense.proofpoint.com; ruf=mailto:dmarc_ruf@emaildefense.proofpoint.com
CAA	bestbuy.com	—
DS	bestbuy.com	—

Fix priorities

Sorted by risk: severity first, confirmed issues before hardening gaps, then effort and score impact.

1MediumDNSSEC — signed DNS recordsHardening gap+13
2LowCAA — who may issue certificatesHardening gap+10

To verify

Couldn't be confirmed from public data, so excluded from the score. Checking them clarifies your posture; it doesn't guarantee a score change.

HTTPS available
SSL/TLS certificate validity
CSP — protection from script injection
HSTS — enforce encryption in the browser
Clickjacking protection
X-Content-Type-Options
Referrer-Policy
Permissions-Policy

Indicative alignment

Best-practice mapping of public findings to common frameworks. Passive scanning tests public configuration only; it doesn't prove compliance or a violation.

Google & Yahoo sender rulesNo gaps observed
SPF, DKIM and DMARC are required for bulk senders to Gmail and Yahoo; missing them risks rejected or spam-foldered mail.
PCI DSS v4.0Incomplete evidence · 5 unverified
TLS, certificate and browser-header protections relate to PCI DSS v4.0 requirements 4.2 and 6.4 for payment pages.
NIS2 / vendor due diligence2 observed gaps · 3 unverified
Vendor risk reviews under NIS2/DORA and cyber-insurance questionnaires check these public signals.
DNSSEC — signed DNS records CAA — who may issue certificates
SOC 2 / ISO 27001 baselineIncomplete evidence · 6 unverified
Baseline external hygiene commonly expected in SOC 2 and ISO 27001 audits.

Indicative alignment only, based on public configuration. It doesn't establish whether a framework applies to you, and it isn't legal advice, an audit or a certification.

Head-to-head vs competitor

How do you stack up against competitors?

The check reads public data only and makes no changes to the domain. Recommendations are intended for the domain owner.

Is your domain as secure? Scan it free, no sign-up

All pre-scanned domains

bestbuy.com

Moderate exposure. There are gaps an attacker could exploit — fix them soon.

Partial coverage: the score is based on 52% of applicable check weight. 8 unverified check(s) are excluded, not counted as failures.

2026-11-15 18:23 UTC

Useful for your IT provider or a colleague. Anyone with the link can view the report.

What to do first

Turn on DNS signing for your domain

Signing helps resolvers detect forged answers about your domain.

Who can fix it: Your domain registrar or DNS provider

How to verify after the fix

dig +short DS bestbuy.com

Choose which companies may issue certificates for your domain

This reduces the chance of a certificate being issued by a provider you did not choose.

Who can fix it: Your domain registrar or DNS provider

How to verify after the fix

dig +short CAA bestbuy.com

What this grade means

Tested hostname

bestbuy.com

Website request

GET https://bestbuy.com/ → https://www.bestbuy.com/

Scan time

2026-11-15 18:23:50 UTC

Grading method

Version 2How grading works

Unverified or excluded checks

HTTPS available · Unverified
SSL/TLS certificate validity · Unverified
HSTS — enforce encryption in the browser · Unverified
CSP — protection from script injection · Unverified
Clickjacking protection · Unverified
X-Content-Type-Options · Unverified
Referrer-Policy · Unverified
Permissions-Policy · Unverified

Technical detail

Click a check to see the public data, a verification command, a safe fix recommendation and documentation sources.

Email security

29/30

Encryption & certificate

7/7

Browser protections

—

DNS infrastructure

3/15

Public DNS records

A	bestbuy.com	184.28.2.249
AAAA	bestbuy.com	—
MX	bestbuy.com	10 mxa-002a6b01.gslb.pphosted.com 30 mx0a-002a6b01.pphosted.com 10 mxb-002a6b01.gslb.pphosted.com 30 mx0b-002a6b01.pphosted.com
NS	bestbuy.com	ns1-119.akam.net eur1.akam.net ns1-118.akam.net use1.akam.net usw2.akam.net asia3.akam.net usc2.akam.net eur2.akam.net
TXT	bestbuy.com	onetrust-domain-verification=b709621cb21a441a9906ac5fe67acf4f d365mktkey=4aspdiy55hf9qe6u9i7kg67n1 d365mktkey=2xfbovrpbth5b74ebygf1lnoq _c1hfgiy1y1ykdjiw6m9rornb4xmyvva _globalsign-domain-verification=OuhJ-18jU_ZoR0fywqNBLK0TA5KlUlb7k3G_I6zGn8 _globalsign-domain-verification=c17wKbxTHRlX9guWhH5pvY8jYFvxnFjwQSZ1H2U6qo anthropic-domain-verification-gn84cy=IX6D2hSzfDx5E5ytxYLnsJJyw _globalsign-domain-verification=Rz2ibbBlL0vg31R_v5MoH1lsSmldHcG7HE7FQFrWxn _globalsign-domain-verification=kOdr8YXX373IW1gr_Of8-4bZONLkNzH_mTPCWGQ-sW docusign=c614af81-8967-4e75-837d-cecfdcd2c879 _wrigrwh3deyxponfw7cjri8usbysbwu d365mktkey=6orxxh8leit5lzxd0abqnuuqe shopify-verification-code=D2rnbVaTP8FoOEL9qmvldwvq6sLwMX infoblox-domain-mastery=e7509e2d71273e9f7614a639f09a001905a408b536134c6edc7acfb6923b3384e8 d365mktkey=2qemjncqsww30ft64gp4gyg7g Dynatrace-site-verification=7ddbc628-a14e-4777-9382-1c465da01cbe__cerg0381k2nnur85q9kj11l2un docusign=c36307b9-2820-4415-92d1-ca4faea5aac3 _globalsign-domain-verification=p9Qai1DIi4fFkvfsen_nMkaGokY-5QSLW1qyHhWxVF atlassian-domain-verification=TtUwVlR0K3KZx5O4wjw626rEZ0jNSaWcym1iHnu3MI3N72lPEma/xgp8ia6cifzM d365mktkey=2ud6jfzvcdaomybdz7yvh8pwx adobe-idp-site-verification=525758772c073f6d5fdcd1854e6caf8bd27517827a81eafb9c048531abb4f428 Dynatrace-site-verification=882011e0-9bd0-40d2-822f-f85f661d2095__bbfqnfh72ema7g5dccpprntb12 liveramp-site-verification=BCRY5T_vpgZw0uDfS90iCAyU1c5pqGNVx5l2PaDnXH8 v=spf1 ip4:198.22.123.0/24 ip4:168.94.230.0/24 ip4:198.22.122.4 ip4:198.22.122.6 include:spf.protection.outlook.com include:spf-002a6b01.pphosted.com include:spf-007f1401.pphosted.com ~all docker-verification=6e02b058-6a9b-4bd6-b2ff-19d7b53ec244 globalsign-domain-verification=eypMAkwo9EOFdpks_S48knXiSq036prCa_TIc0JYYR _globalsign-domain-verification=WlIRFk9I6Bf84ZXoznfQPiEFxSqvhCwi_u5ZK-dZkM bestbuy.com CKO=cli_phqj6vpebyqe3ds4jj4qyqm6ze _globalsign-domain-verification=E4YIjaa32WEGqA47Dm0jdFThhcAH_eakVg4sP0hwYj _globalsign-domain-verification=FPaCAb-qc1XQOp3g21zvMhYe5Kqf5_oFrOTNv2bvdP Dynatrace-site-verification=d39123ba-6007-4678-9099-bab300e4cc4d__b1g36mt3t36i7o1gb5q67ak9is _globalsign-domain-verification=GEpPhKvRpaNmLHFvhc88dKiT10KXAaZ5eR7TObGHOP globalsign-domain-verification=DvclDCGtuqSdLq6_HvbJttP6xPFiMqtYrJIaYYgWvO _globalsign-domain-verification=-Dnz9-l2YuDUGF6pkxiEAV2dZD8vCAw1vjyXgf4X5f CKO=cli_t6crzmn6zwgudjx7rtdpd54eqq confluent-verification=c6f05e07-472d-4c33-85a6-8fbaf2c089a7 _globalsign-domain-verification=zohml7OMpOYBgZSep8H4TwrXwEEyxdtmxOmjWh0Dvb DlUfs9zx61nM1yUbnSP+ZzoX8CvEbKiZw6FRCqveTF8fDYmLIOR2LfzMYaXuit+sLpBYYV4QrRRFoUSVfOZ5HQ== d98949bf-1774-453a-a6d4-a76227024157 google-site-verification=s1KAsSED_OW5FMoqEkTv7d5Vl6IjwQbhNFAkBqtykiQ mk-org-sso-465501ed-efb7-4bdd-a703-dc485ceab414 v=verifydomain MS=ms22146670 openai-domain-verification=dv-vi3MOTmQL7yhfQCB4T8HwJtS
TXT	_dmarc.bestbuy.com	v=DMARC1; p=reject; fo=1; rua=mailto:dmarc_rua@emaildefense.proofpoint.com; ruf=mailto:dmarc_ruf@emaildefense.proofpoint.com
CAA	bestbuy.com	—
DS	bestbuy.com	—

Indicative alignment

Best-practice mapping of public findings to common frameworks. Passive scanning tests public configuration only; it doesn't prove compliance or a violation.

Google & Yahoo sender rulesNo gaps observed

SPF, DKIM and DMARC are required for bulk senders to Gmail and Yahoo; missing them risks rejected or spam-foldered mail.

PCI DSS v4.0Incomplete evidence · 5 unverified

TLS, certificate and browser-header protections relate to PCI DSS v4.0 requirements 4.2 and 6.4 for payment pages.

NIS2 / vendor due diligence2 observed gaps · 3 unverified

Vendor risk reviews under NIS2/DORA and cyber-insurance questionnaires check these public signals.

DNSSEC — signed DNS records CAA — who may issue certificates

SOC 2 / ISO 27001 baselineIncomplete evidence · 6 unverified

Baseline external hygiene commonly expected in SOC 2 and ISO 27001 audits.

Indicative alignment only, based on public configuration. It doesn't establish whether a framework applies to you, and it isn't legal advice, an audit or a certification.

bestbuy.com

Track your progress

Help someone else check their domain

What to do first

What this grade means

Get the badge

Scan history

AI fix plan

Scans to analyze

Technical detail

Email security

Encryption & certificate

Browser protections

DNS infrastructure

Public DNS records

Is your domain as secure? Scan it free, no sign-up

bestbuy.com

Track your progress

Help someone else check their domain

What to do first

What this grade means

Get the badge

Scan history

AI fix plan

Scans to analyze

Technical detail

Email security

Encryption & certificate

Browser protections

DNS infrastructure

Public DNS records

Is your domain as secure? Scan it free, no sign-up

Agent access & discovery signals