Automated public DNS and web checks; results may be incomplete. These are passive observations, not an assessment of the organization.

D66/100

Executive summary

booking.com

High exposure. Significant weaknesses put the brand, customers and email at risk.

Full coverage: every applicable check was assessed.

2026-11-15 18:24 UTC

Print report / PDF

Useful for your IT provider or a colleague. Anyone with the link can view the report.

Track your progress

Fix the findings, then come back and rescan. Your scan history is saved in this browser so you can see exactly what improved.

Email security30/30

Good

Spoofing email from this domain is hard.

Encryption & certificate25/25

Good

Traffic to the site is encrypted and the certificate is valid.

Browser protections8/30

Critical

Several browser hardening headers are missing, which removes layers of protection against script injection and framing.

DNS infrastructure3/15

Critical

The domain's infrastructure lacks basic protections.

Help someone else check their domain

Share this public report with a colleague. They can review the evidence and check their own domain.

Get the report badge

What to do first

1.
Limit what scripts your pages are allowed to run
This adds one layer of protection against injected scripts.
Who can fix it: Your website developer or web host
How to verify after the fix
```
curl -sIL https://booking.com/ | grep -i "Content-Security-Policy"
```
2.
Turn on DNS signing for your domain
Signing helps resolvers detect forged answers about your domain.
Who can fix it: Your domain registrar or DNS provider
How to verify after the fix
```
dig +short DS booking.com
```

A starting point, not a security guarantee.

What this grade means

Tested hostname: booking.com
Website request: GET https://booking.com/ → https://www.booking.com/
Scan time: 2026-11-15 18:24:19 UTC
Grading method: Version 2How grading works
Unverified or excluded checks: None. Every applicable check was assessed.

This is a snapshot of the public configuration checks listed in this report. It does not verify the site's owner, business legitimacy, application security, or absence of vulnerabilities. It is not a security certification.

Get the badge

Show the live grade for booking.com in a README, docs or site footer. The badge links to the public report and refreshes every 24 hours.

Scan shown on this page: ⁦2026-11-15 18:24:19 UTC⁩. The badge may display a cached result for up to 24 hours. Open the linked report to check its scan time.

Markdown

[![Domain Armor grade](https://getmirror.online/badge/booking.com.svg)](https://getmirror.online/report/booking.com)

HTML

<a href="https://getmirror.online/report/booking.com"><img src="https://getmirror.online/badge/booking.com.svg" alt="Domain Armor grade"></a>

Badge URL

https://getmirror.online/badge/booking.com.svg

Scan history

AI fix plan

Pick scans from this browser's history. The AI compares them, explains what changed and builds a prioritized, step-by-step plan.

Scans to analyze

0 of 6 selected

D66/10011/15/26, 06:24 PMCurrent

The current scan is always included.

AI-generated from your scan results only. Review each step before applying it; nothing is sent to or changed on the domain.

Technical detail

Click a check to see the public data, a verification command, a safe fix recommendation and documentation sources.

Email security

30/30

Encryption & certificate

25/25

Browser protections

8/30

DNS infrastructure

3/15

Public DNS records

A	booking.com	18.172.170.36 18.172.170.103 18.172.170.127 18.172.170.114
AAAA	booking.com	—
MX	booking.com	10 mxa-0032a201.gslb.pphosted.com 10 mxb-0032a201.gslb.pphosted.com
NS	booking.com	ns-1288.awsdns-33.org ns-1959.awsdns-52.co.uk ns-508.awsdns-63.com ns-716.awsdns-25.net
TXT	booking.com	Dynatrace-site-verification=3a88fc1a-195c-455d-ab87-88d09191496b__drhtlct978bncn9utek6qdqapk MS=ms35392088 MS=ms94636132 VkJHqtn1JPDHrgqwzb8C30fmoABFhxVfjIOtLvlUK06CUwKgd2mevDGtnDhWZcNbxEgK39DOezbHay8XSv1zVQ== ZOOM_verify_rRPrFA9oTH2bxfFkJeQTzA _globalsign-domain-verification=9Xqu2bonefjuoUF-XmyjAptAfuE-yStJz6wy9UnH-C _globalsign-domain-verification=FSlSaYMuHsffF-JRsSpJSonQOV0_jwrwl5kQGpFdtb _globalsign-domain-verification=l_BNpBAnk-rKZRyXJ9UkBfv9o6EEuuenkBrGpYNYo0 _ngvwjw7ivb5mv4iz4ynfsao26826rul _t33b2jwn9aya9tjjl23glp3pdv3puct _z95nlosvuygcxtrb7snfkon25shq4zm adobe-idp-site-verification=040db58f-cfb9-4203-a555-bfcd15b24b86 anthropic-domain-verification-3tn1j6=kp9CbC14s2pKcVhSOOlbHwQHz apple-domain-verification=immERz8LzjEgeSoW asv=93db973d8bc6fd37d0c9e0c3feebff95 atlassian-domain-verification=F3hugs/a4ZZHwjGTLmlb12IMA3TIRiz3ifqw4TKRz9tWk0LoyBBXfwc775aT/juy atlassian-domain-verification=PEQekniknkTLbMzMw6Ifb9G9YWzhgcGHzIne34xYo7zW9/rzVsM/6qZSUWdIVAmR atlassian-sending-domain-verification=e6842471-4159-4738-b15a-cefe813dc42a canva-site-verification=KAuoIY0y5F95ChkJB52A2w cisco-ci-domain-verification=45d8573a6620606f09d1556681408112c9f9754309b02423c380eee5d287bd8f cursor-domain-verification-wv67f5=cvoPd4JZECcPi6V9VqDM7DpGz docker-verification=0ebe0b8e-6bd1-4f94-b0b3-344bd07052ed docusign=1ddc2bf3-a249-4127-a351-f22dc75077d3 ecostruxure-it-verification=881dfd3b-5776-4fc0-a5f6-190a0ac842f8 f3n3z6cw35fkl9lnb6q72dczy2z7d2gy fastly-domain-delegation-0344411-343733-2021_0223 globalsign-domain-verification=jpcnVg6kuHYyEz5op6ZzxI2E53gePoVqca7RgL0aNq google-site-verification=1eOMDGAH7nc_P5U-8MWPqSTU40og02u0CODDvbcmoMw google-site-verification=IqETr3m1Iq2apdhg2tJndtOH5xn_C0PrLSBL4UpB9WU google-site-verification=WMDRc5NQqj7RWff1N8L0_Ikc08kSr-iUa3C0Zczl9QA google-site-verification=Yse39yHdmcUPiSTGNVY-eI27sV3TBfQVLBPHGWHiins google-site-verification=_dm8lZJlohRuCXhYRFe8COWc0JNx7c6AVF1vWpP52nE google-site-verification=qKQzyXjxHLM4q1X-7PdrurR3p1QjjINz2QD_MBvAmyU google-site-verification=z4muhl35r1aT-msc5R269PO3RKaZHc7zzn6omxkiedI gwt5v1xngwj1f6zq7khv3bp4xnxbgmkg hpe-greenlake-domain-verification=34593547575036384f70456d357572467164437161596e387935596c35665041 intersight=f7b95d6ad5339839c1253d5e47c1c32ff8276909334ff7173890c54f4730e68a jamf-site-verification=ginKrX1WfPAXLoSWwmiYoA logmein-domain-confirmation 90DIFG9EEUT8U8R4895Y87H mandrill_verify.e-l764xQVEGJ2x07f-WGHg miro-verification=a08b425a7aa0b2b93256f4b504ee72afe8f9e0b9 mongodb-site-verification=Edb8EnML5i9pqy6z4N7La044KKs2z3iC onetrust-domain-verification=3fce180bf9e54d5b97a7c9e1ce3cb10c openai-domain-verification=dv-L58PjwMLqJ4qWsOGfKRPglPO paloaltonetworks-site-verification=05d52539c7f02572db198a10ba1b238b6f4c6550c083c4bf41f4eb5e5101e47c pexip-portal-domain-verification=d7d25e06-b2de-4a76-80c2-25f5f228b1d7 sending_domain1012722=80cff31442c5f4e1b9c51346939d5bf298d9eff5f69d465476631c95f588ac90 slack-domain-verification=VZdvc1wWSAicshovagXu0IsScNTUVr0gj1ZcE2IM smartsheet-site-validation=zF2Qh0qhBS3O7AjSZMdaAVW2E7GB1VLL v=spf1 include:%{ir}.%{v}.%{d}.spf.has.pphosted.com -all workplace-domain-verification=LsPqX88w148qQltQvOoT4ZTx6EO5Be wrike-verification=NDM5MTUzODoyMTFkNjJmZWM5MDk5MTVjOWY2YTQ2MWI4MmVhNjRkZjBmNjg3NzhmZTJhZTQ2NjYxMmVlNjNmMDJkZWRkN2Vi x9zcxt1dfyz6jj60w7smwl42tjzfv5yn
TXT	_dmarc.booking.com	v=DMARC1; p=reject; rua=mailto:dmarc_rua@emaildefense.proofpoint.com,mailto:booking@dmarc.postmastery.eu; ruf=mailto:dmarc_ruf@emaildefense.proofpoint.com
CAA	booking.com	—
DS	booking.com	—

Fix priorities

Sorted by risk: severity first, confirmed issues before hardening gaps, then effort and score impact.

1MediumClickjacking protectionHardening gap+5
2MediumDNSSEC — signed DNS recordsHardening gap+7
3MediumCSP — protection from script injectionHardening gap+8
4LowCAA — who may issue certificatesHardening gap+5
5LowX-Content-Type-OptionsHardening gap+4
6LowReferrer-PolicyHardening gap+3
7LowPermissions-PolicyHardening gap+2

Indicative alignment

Best-practice mapping of public findings to common frameworks. Passive scanning tests public configuration only; it doesn't prove compliance or a violation.

Google & Yahoo sender rulesNo gaps observed
SPF, DKIM and DMARC are required for bulk senders to Gmail and Yahoo; missing them risks rejected or spam-foldered mail.
PCI DSS v4.02 observed gaps
TLS, certificate and browser-header protections relate to PCI DSS v4.0 requirements 4.2 and 6.4 for payment pages.
CSP — protection from script injection Clickjacking protection
NIS2 / vendor due diligence2 observed gaps
Vendor risk reviews under NIS2/DORA and cyber-insurance questionnaires check these public signals.
DNSSEC — signed DNS records CAA — who may issue certificates
SOC 2 / ISO 27001 baseline3 observed gaps
Baseline external hygiene commonly expected in SOC 2 and ISO 27001 audits.
CSP — protection from script injection Clickjacking protection X-Content-Type-Options

Indicative alignment only, based on public configuration. It doesn't establish whether a framework applies to you, and it isn't legal advice, an audit or a certification.

Head-to-head vs competitor

How do you stack up against competitors?

The check reads public data only and makes no changes to the domain. Recommendations are intended for the domain owner.

Is your domain as secure? Scan it free, no sign-up

All pre-scanned domains

What to do first

Limit what scripts your pages are allowed to run

This adds one layer of protection against injected scripts.

Who can fix it: Your website developer or web host

How to verify after the fix

curl -sIL https://booking.com/ | grep -i "Content-Security-Policy"

Turn on DNS signing for your domain

Signing helps resolvers detect forged answers about your domain.

Who can fix it: Your domain registrar or DNS provider

How to verify after the fix

dig +short DS booking.com

What this grade means

Tested hostname

booking.com

Website request

GET https://booking.com/ → https://www.booking.com/

Scan time

2026-11-15 18:24:19 UTC

Grading method

Version 2How grading works

Unverified or excluded checks

None. Every applicable check was assessed.

Technical detail

Click a check to see the public data, a verification command, a safe fix recommendation and documentation sources.

Email security

30/30

Encryption & certificate

25/25

Browser protections

8/30

DNS infrastructure

3/15

Public DNS records

A	booking.com	18.172.170.36 18.172.170.103 18.172.170.127 18.172.170.114
AAAA	booking.com	—
MX	booking.com	10 mxa-0032a201.gslb.pphosted.com 10 mxb-0032a201.gslb.pphosted.com
NS	booking.com	ns-1288.awsdns-33.org ns-1959.awsdns-52.co.uk ns-508.awsdns-63.com ns-716.awsdns-25.net
TXT	booking.com	Dynatrace-site-verification=3a88fc1a-195c-455d-ab87-88d09191496b__drhtlct978bncn9utek6qdqapk MS=ms35392088 MS=ms94636132 VkJHqtn1JPDHrgqwzb8C30fmoABFhxVfjIOtLvlUK06CUwKgd2mevDGtnDhWZcNbxEgK39DOezbHay8XSv1zVQ== ZOOM_verify_rRPrFA9oTH2bxfFkJeQTzA _globalsign-domain-verification=9Xqu2bonefjuoUF-XmyjAptAfuE-yStJz6wy9UnH-C _globalsign-domain-verification=FSlSaYMuHsffF-JRsSpJSonQOV0_jwrwl5kQGpFdtb _globalsign-domain-verification=l_BNpBAnk-rKZRyXJ9UkBfv9o6EEuuenkBrGpYNYo0 _ngvwjw7ivb5mv4iz4ynfsao26826rul _t33b2jwn9aya9tjjl23glp3pdv3puct _z95nlosvuygcxtrb7snfkon25shq4zm adobe-idp-site-verification=040db58f-cfb9-4203-a555-bfcd15b24b86 anthropic-domain-verification-3tn1j6=kp9CbC14s2pKcVhSOOlbHwQHz apple-domain-verification=immERz8LzjEgeSoW asv=93db973d8bc6fd37d0c9e0c3feebff95 atlassian-domain-verification=F3hugs/a4ZZHwjGTLmlb12IMA3TIRiz3ifqw4TKRz9tWk0LoyBBXfwc775aT/juy atlassian-domain-verification=PEQekniknkTLbMzMw6Ifb9G9YWzhgcGHzIne34xYo7zW9/rzVsM/6qZSUWdIVAmR atlassian-sending-domain-verification=e6842471-4159-4738-b15a-cefe813dc42a canva-site-verification=KAuoIY0y5F95ChkJB52A2w cisco-ci-domain-verification=45d8573a6620606f09d1556681408112c9f9754309b02423c380eee5d287bd8f cursor-domain-verification-wv67f5=cvoPd4JZECcPi6V9VqDM7DpGz docker-verification=0ebe0b8e-6bd1-4f94-b0b3-344bd07052ed docusign=1ddc2bf3-a249-4127-a351-f22dc75077d3 ecostruxure-it-verification=881dfd3b-5776-4fc0-a5f6-190a0ac842f8 f3n3z6cw35fkl9lnb6q72dczy2z7d2gy fastly-domain-delegation-0344411-343733-2021_0223 globalsign-domain-verification=jpcnVg6kuHYyEz5op6ZzxI2E53gePoVqca7RgL0aNq google-site-verification=1eOMDGAH7nc_P5U-8MWPqSTU40og02u0CODDvbcmoMw google-site-verification=IqETr3m1Iq2apdhg2tJndtOH5xn_C0PrLSBL4UpB9WU google-site-verification=WMDRc5NQqj7RWff1N8L0_Ikc08kSr-iUa3C0Zczl9QA google-site-verification=Yse39yHdmcUPiSTGNVY-eI27sV3TBfQVLBPHGWHiins google-site-verification=_dm8lZJlohRuCXhYRFe8COWc0JNx7c6AVF1vWpP52nE google-site-verification=qKQzyXjxHLM4q1X-7PdrurR3p1QjjINz2QD_MBvAmyU google-site-verification=z4muhl35r1aT-msc5R269PO3RKaZHc7zzn6omxkiedI gwt5v1xngwj1f6zq7khv3bp4xnxbgmkg hpe-greenlake-domain-verification=34593547575036384f70456d357572467164437161596e387935596c35665041 intersight=f7b95d6ad5339839c1253d5e47c1c32ff8276909334ff7173890c54f4730e68a jamf-site-verification=ginKrX1WfPAXLoSWwmiYoA logmein-domain-confirmation 90DIFG9EEUT8U8R4895Y87H mandrill_verify.e-l764xQVEGJ2x07f-WGHg miro-verification=a08b425a7aa0b2b93256f4b504ee72afe8f9e0b9 mongodb-site-verification=Edb8EnML5i9pqy6z4N7La044KKs2z3iC onetrust-domain-verification=3fce180bf9e54d5b97a7c9e1ce3cb10c openai-domain-verification=dv-L58PjwMLqJ4qWsOGfKRPglPO paloaltonetworks-site-verification=05d52539c7f02572db198a10ba1b238b6f4c6550c083c4bf41f4eb5e5101e47c pexip-portal-domain-verification=d7d25e06-b2de-4a76-80c2-25f5f228b1d7 sending_domain1012722=80cff31442c5f4e1b9c51346939d5bf298d9eff5f69d465476631c95f588ac90 slack-domain-verification=VZdvc1wWSAicshovagXu0IsScNTUVr0gj1ZcE2IM smartsheet-site-validation=zF2Qh0qhBS3O7AjSZMdaAVW2E7GB1VLL v=spf1 include:%{ir}.%{v}.%{d}.spf.has.pphosted.com -all workplace-domain-verification=LsPqX88w148qQltQvOoT4ZTx6EO5Be wrike-verification=NDM5MTUzODoyMTFkNjJmZWM5MDk5MTVjOWY2YTQ2MWI4MmVhNjRkZjBmNjg3NzhmZTJhZTQ2NjYxMmVlNjNmMDJkZWRkN2Vi x9zcxt1dfyz6jj60w7smwl42tjzfv5yn
TXT	_dmarc.booking.com	v=DMARC1; p=reject; rua=mailto:dmarc_rua@emaildefense.proofpoint.com,mailto:booking@dmarc.postmastery.eu; ruf=mailto:dmarc_ruf@emaildefense.proofpoint.com
CAA	booking.com	—
DS	booking.com	—

Indicative alignment

Best-practice mapping of public findings to common frameworks. Passive scanning tests public configuration only; it doesn't prove compliance or a violation.

Google & Yahoo sender rulesNo gaps observed

SPF, DKIM and DMARC are required for bulk senders to Gmail and Yahoo; missing them risks rejected or spam-foldered mail.

PCI DSS v4.02 observed gaps

TLS, certificate and browser-header protections relate to PCI DSS v4.0 requirements 4.2 and 6.4 for payment pages.

CSP — protection from script injection Clickjacking protection

NIS2 / vendor due diligence2 observed gaps

Vendor risk reviews under NIS2/DORA and cyber-insurance questionnaires check these public signals.

DNSSEC — signed DNS records CAA — who may issue certificates

SOC 2 / ISO 27001 baseline3 observed gaps

Baseline external hygiene commonly expected in SOC 2 and ISO 27001 audits.

CSP — protection from script injection Clickjacking protection X-Content-Type-Options

Indicative alignment only, based on public configuration. It doesn't establish whether a framework applies to you, and it isn't legal advice, an audit or a certification.

booking.com

Track your progress

Help someone else check their domain

What to do first

What this grade means

Get the badge

Scan history

AI fix plan

Scans to analyze

Technical detail

Email security

Encryption & certificate

Browser protections

DNS infrastructure

Public DNS records

Is your domain as secure? Scan it free, no sign-up

booking.com

Track your progress

Help someone else check their domain

What to do first

What this grade means

Get the badge

Scan history

AI fix plan

Scans to analyze

Technical detail

Email security

Encryption & certificate

Browser protections

DNS infrastructure

Public DNS records

Is your domain as secure? Scan it free, no sign-up

Agent access & discovery signals