1.
Choose which companies may issue certificates for your domain
This reduces the chance of a certificate being issued by a provider you did not choose.
Who can fix it: Your domain registrar or DNS provider
How to verify after the fix
```
dig +short CAA cam.ac.uk
```
2.
Tell browsers to always use the secure version
Helps browsers use HTTPS on future visits after they have received the policy.
Who can fix it: Your web host
How to verify after the fix
```
curl -sIL https://cam.ac.uk/ | grep -i "Strict-Transport-Security"
```

A starting point, not a security guarantee.

What this grade means

Tested hostname: cam.ac.uk
Website request: GET https://cam.ac.uk/ → https://www.cam.ac.uk/
Scan time: 2026-11-15 18:29:49 UTC
Grading method: Version 2How grading works
Unverified or excluded checks: None. Every applicable check was assessed.

This is a snapshot of the public configuration checks listed in this report. It does not verify the site's owner, business legitimacy, application security, or absence of vulnerabilities. It is not a security certification.

Get the badge

Show the live grade for cam.ac.uk in a README, docs or site footer. The badge links to the public report and refreshes every 24 hours.

Scan shown on this page: ⁦2026-11-15 18:29:49 UTC⁩. The badge may display a cached result for up to 24 hours. Open the linked report to check its scan time.

Markdown

[![Domain Armor grade](https://getmirror.online/badge/cam.ac.uk.svg)](https://getmirror.online/report/cam.ac.uk)

HTML

<a href="https://getmirror.online/report/cam.ac.uk"><img src="https://getmirror.online/badge/cam.ac.uk.svg" alt="Domain Armor grade"></a>

Badge URL

https://getmirror.online/badge/cam.ac.uk.svg

Scan history

AI fix plan

Pick scans from this browser's history. The AI compares them, explains what changed and builds a prioritized, step-by-step plan.

Scans to analyze

0 of 6 selected

B88/10011/15/26, 06:29 PMCurrent

The current scan is always included.

AI-generated from your scan results only. Review each step before applying it; nothing is sent to or changed on the domain.

Technical detail

Click a check to see the public data, a verification command, a safe fix recommendation and documentation sources.

Email security

30/30

Encryption & certificate

25/25

Browser protections

23/30

DNS infrastructure

10/15

Public DNS records

A	cam.ac.uk	23.185.0.2
AAAA	cam.ac.uk	2620:12a:8000::2 2620:12a:8001::2
MX	cam.ac.uk	0 cam-ac-uk.mail.protection.outlook.com
NS	cam.ac.uk	ns1.mythic-beasts.com ns2.ic.ac.uk ns3.mythic-beasts.com dns0.cl.cam.ac.uk dns0.eng.cam.ac.uk auth0.dns.cam.ac.uk auth1.dns.cam.ac.uk auth2.dns.cam.ac.uk auth3.dns.cam.ac.uk
TXT	cam.ac.uk	_l57xfo8xodfo7j6g0fb9zoljfwh18qt _um3kem45o33chvq68mb4qyt72y57oow 9026cbf1-7b8b-4613-87ce-a46bda32c08f QuoVadis=a2edaff3-bdc6-44c5-8550-2167fe7338c4 jamf-site-verification=9Xc0IY8F9-nFQz_ItUdvSg airtable-verification=a44072da1d55edc25c09b3eb72f8cedd miro-verification=a1052e0584a21e3d2792bce42f69dc21def357fc have-i-been-pwned-verification=505eab056dca3ebf0a94cc28eeef0c31 google-site-verification=DzWWuhcpZ1B2FT5ftPCIV8rK6hbuLEEaojFzIt_YhSM google-site-verification=WBy6QZ92OsuLOOPs8Zrr4GxorRnSu9H_aiLmyCjX-nI google-site-verification=vob_qUOVAbGehTQ74k1vnA1XCWJB2CSWwsP9fNdwALU access-domain-verification=80b9280e5d8d74cd9a01a3af64bba66df221437d7612cc895110546f3b86d2ce atlassian-domain-verification=S5SLTUt0OLAN9mxNzSRE7Cwjz4YOzlAVb87kMqkz6FcVeqp9q2PX8wtErVchDQYH dell-technologies-domain-verification=cam.ac.uk_b220a1b2-fe6b-4199-bae5-c07814bfc1e0_1768470629 hpe-greenlake-domain-verification=78487863375a505250746c662d4236615a71794f322d47423172636354537362 v=spf1 include:_spf.cam.ac.uk include:spf.protection.outlook.com include:_spf.google.com include:spf.uk.odmad.quest-on-demand.com -all
TXT	_dmarc.cam.ac.uk	v=DMARC1; p=reject; pct=100; rua=mailto:dmarc-rua@dmarc.service.gov.uk, mailto:jiq3dpgf@ag.eu.dmarcian.com
CAA	cam.ac.uk	—
DS	cam.ac.uk	17004 13 2 25425306c22124e8319210335a3085247ea8c74df0bd0dd7faae535594d6c3d0

Fix priorities

Sorted by risk: severity first, confirmed issues before hardening gaps, then effort and score impact.

1MediumHSTS — enforce encryption in the browserHardening gap+4
2LowCAA — who may issue certificatesHardening gap+5
3LowCSP — protection from script injectionHardening gap+3

Indicative alignment

Best-practice mapping of public findings to common frameworks. Passive scanning tests public configuration only; it doesn't prove compliance or a violation.

Google & Yahoo sender rulesNo gaps observed
SPF, DKIM and DMARC are required for bulk senders to Gmail and Yahoo; missing them risks rejected or spam-foldered mail.
PCI DSS v4.02 observed gaps
TLS, certificate and browser-header protections relate to PCI DSS v4.0 requirements 4.2 and 6.4 for payment pages.
HSTS — enforce encryption in the browser CSP — protection from script injection
NIS2 / vendor due diligence2 observed gaps
Vendor risk reviews under NIS2/DORA and cyber-insurance questionnaires check these public signals.
HSTS — enforce encryption in the browser CAA — who may issue certificates
SOC 2 / ISO 27001 baseline2 observed gaps
Baseline external hygiene commonly expected in SOC 2 and ISO 27001 audits.
HSTS — enforce encryption in the browser CSP — protection from script injection

Indicative alignment only, based on public configuration. It doesn't establish whether a framework applies to you, and it isn't legal advice, an audit or a certification.

Head-to-head vs competitor

How do you stack up against competitors?

The check reads public data only and makes no changes to the domain. Recommendations are intended for the domain owner.

Is your domain as secure? Scan it free, no sign-up

All pre-scanned domains

What to do first

Choose which companies may issue certificates for your domain

This reduces the chance of a certificate being issued by a provider you did not choose.

Who can fix it: Your domain registrar or DNS provider

How to verify after the fix

dig +short CAA cam.ac.uk

Tell browsers to always use the secure version

Helps browsers use HTTPS on future visits after they have received the policy.

Who can fix it: Your web host

How to verify after the fix

curl -sIL https://cam.ac.uk/ | grep -i "Strict-Transport-Security"

What this grade means

Tested hostname

cam.ac.uk

Website request

GET https://cam.ac.uk/ → https://www.cam.ac.uk/

Scan time

2026-11-15 18:29:49 UTC

Grading method

Version 2How grading works

Unverified or excluded checks

None. Every applicable check was assessed.

Technical detail

Click a check to see the public data, a verification command, a safe fix recommendation and documentation sources.

Email security

30/30

Encryption & certificate

25/25

Browser protections

23/30

DNS infrastructure

10/15

Public DNS records

A	cam.ac.uk	23.185.0.2
AAAA	cam.ac.uk	2620:12a:8000::2 2620:12a:8001::2
MX	cam.ac.uk	0 cam-ac-uk.mail.protection.outlook.com
NS	cam.ac.uk	ns1.mythic-beasts.com ns2.ic.ac.uk ns3.mythic-beasts.com dns0.cl.cam.ac.uk dns0.eng.cam.ac.uk auth0.dns.cam.ac.uk auth1.dns.cam.ac.uk auth2.dns.cam.ac.uk auth3.dns.cam.ac.uk
TXT	cam.ac.uk	_l57xfo8xodfo7j6g0fb9zoljfwh18qt _um3kem45o33chvq68mb4qyt72y57oow 9026cbf1-7b8b-4613-87ce-a46bda32c08f QuoVadis=a2edaff3-bdc6-44c5-8550-2167fe7338c4 jamf-site-verification=9Xc0IY8F9-nFQz_ItUdvSg airtable-verification=a44072da1d55edc25c09b3eb72f8cedd miro-verification=a1052e0584a21e3d2792bce42f69dc21def357fc have-i-been-pwned-verification=505eab056dca3ebf0a94cc28eeef0c31 google-site-verification=DzWWuhcpZ1B2FT5ftPCIV8rK6hbuLEEaojFzIt_YhSM google-site-verification=WBy6QZ92OsuLOOPs8Zrr4GxorRnSu9H_aiLmyCjX-nI google-site-verification=vob_qUOVAbGehTQ74k1vnA1XCWJB2CSWwsP9fNdwALU access-domain-verification=80b9280e5d8d74cd9a01a3af64bba66df221437d7612cc895110546f3b86d2ce atlassian-domain-verification=S5SLTUt0OLAN9mxNzSRE7Cwjz4YOzlAVb87kMqkz6FcVeqp9q2PX8wtErVchDQYH dell-technologies-domain-verification=cam.ac.uk_b220a1b2-fe6b-4199-bae5-c07814bfc1e0_1768470629 hpe-greenlake-domain-verification=78487863375a505250746c662d4236615a71794f322d47423172636354537362 v=spf1 include:_spf.cam.ac.uk include:spf.protection.outlook.com include:_spf.google.com include:spf.uk.odmad.quest-on-demand.com -all
TXT	_dmarc.cam.ac.uk	v=DMARC1; p=reject; pct=100; rua=mailto:dmarc-rua@dmarc.service.gov.uk, mailto:jiq3dpgf@ag.eu.dmarcian.com
CAA	cam.ac.uk	—
DS	cam.ac.uk	17004 13 2 25425306c22124e8319210335a3085247ea8c74df0bd0dd7faae535594d6c3d0

Indicative alignment

Best-practice mapping of public findings to common frameworks. Passive scanning tests public configuration only; it doesn't prove compliance or a violation.

Google & Yahoo sender rulesNo gaps observed

SPF, DKIM and DMARC are required for bulk senders to Gmail and Yahoo; missing them risks rejected or spam-foldered mail.

PCI DSS v4.02 observed gaps

TLS, certificate and browser-header protections relate to PCI DSS v4.0 requirements 4.2 and 6.4 for payment pages.

HSTS — enforce encryption in the browser CSP — protection from script injection

NIS2 / vendor due diligence2 observed gaps

Vendor risk reviews under NIS2/DORA and cyber-insurance questionnaires check these public signals.

HSTS — enforce encryption in the browser CAA — who may issue certificates

SOC 2 / ISO 27001 baseline2 observed gaps

Baseline external hygiene commonly expected in SOC 2 and ISO 27001 audits.

HSTS — enforce encryption in the browser CSP — protection from script injection

Indicative alignment only, based on public configuration. It doesn't establish whether a framework applies to you, and it isn't legal advice, an audit or a certification.

cam.ac.uk

Track your progress

Help someone else check their domain

What to do first

What this grade means

Get the badge

Scan history

AI fix plan

Scans to analyze

Technical detail

Email security

Encryption & certificate

Browser protections

DNS infrastructure

Public DNS records

Is your domain as secure? Scan it free, no sign-up

cam.ac.uk

Track your progress

Help someone else check their domain

What to do first

What this grade means

Get the badge

Scan history

AI fix plan

Scans to analyze

Technical detail

Email security

Encryption & certificate

Browser protections

DNS infrastructure

Public DNS records

Is your domain as secure? Scan it free, no sign-up

Agent access & discovery signals