Automated public DNS and web checks; results may be incomplete. These are passive observations, not an assessment of the organization.

D67/100

Executive summary

cmu.edu

High exposure. Significant weaknesses put the brand, customers and email at risk.

Full coverage: every applicable check was assessed.

2026-11-15 18:29 UTC

Print report / PDF

Useful for your IT provider or a colleague. Anyone with the link can view the report.

Track your progress

Fix the findings, then come back and rescan. Your scan history is saved in this browser so you can see exactly what improved.

Email security19/30

Needs attention

Spoofing email in the company's name is possible in some cases.

Encryption & certificate25/25

Good

Traffic to the site is encrypted and the certificate is valid.

Browser protections13/30

Critical

Several browser hardening headers are missing, which removes layers of protection against script injection and framing.

DNS infrastructure10/15

Needs attention

The domain's infrastructure works, but recommended hardening is missing.

Help someone else check their domain

Share this public report with a colleague. They can review the evidence and check their own domain.

Get the report badge

What to do first

1.
Tell receiving mail servers how to treat fake email from your domain
Without this policy, inboxes have less guidance for spotting messages that impersonate you.
Who can fix it: Your email provider, together with whoever manages your DNS
How to verify after the fix
```
dig +short TXT _dmarc.cmu.edu
```
2.
Limit what scripts your pages are allowed to run
This adds one layer of protection against injected scripts.
Who can fix it: Your website developer or web host
How to verify after the fix
```
curl -sIL https://cmu.edu/ | grep -i "Content-Security-Policy"
```

A starting point, not a security guarantee.

What this grade means

Tested hostname: cmu.edu
Website request: GET https://cmu.edu/ → https://www.cmu.edu/
Scan time: 2026-11-15 18:29:53 UTC
Grading method: Version 2How grading works
Unverified or excluded checks: None. Every applicable check was assessed.

This is a snapshot of the public configuration checks listed in this report. It does not verify the site's owner, business legitimacy, application security, or absence of vulnerabilities. It is not a security certification.

Get the badge

Show the live grade for cmu.edu in a README, docs or site footer. The badge links to the public report and refreshes every 24 hours.

Scan shown on this page: ⁦2026-11-15 18:29:53 UTC⁩. The badge may display a cached result for up to 24 hours. Open the linked report to check its scan time.

Markdown

[![Domain Armor grade](https://getmirror.online/badge/cmu.edu.svg)](https://getmirror.online/report/cmu.edu)

HTML

<a href="https://getmirror.online/report/cmu.edu"><img src="https://getmirror.online/badge/cmu.edu.svg" alt="Domain Armor grade"></a>

Badge URL

https://getmirror.online/badge/cmu.edu.svg

Scan history

AI fix plan

Pick scans from this browser's history. The AI compares them, explains what changed and builds a prioritized, step-by-step plan.

Scans to analyze

0 of 6 selected

D67/10011/15/26, 06:29 PMCurrent

The current scan is always included.

AI-generated from your scan results only. Review each step before applying it; nothing is sent to or changed on the domain.

Technical detail

Click a check to see the public data, a verification command, a safe fix recommendation and documentation sources.

Email security

19/30

Encryption & certificate

25/25

Browser protections

13/30

DNS infrastructure

10/15

Public DNS records

A	cmu.edu	128.2.42.10
AAAA	cmu.edu	—
MX	cmu.edu	1 ASPMX.L.GOOGLE.COM 5 ALT1.ASPMX.L.GOOGLE.COM 5 ALT2.ASPMX.L.GOOGLE.COM 10 ALT3.ASPMX.L.GOOGLE.COM 10 ALT4.ASPMX.L.GOOGLE.COM
NS	cmu.edu	NSAUTH1.NET.cmu.edu NSAUTH2.NET.cmu.edu NSAUTH3.NET.cmu.edu
TXT	cmu.edu	MS=ms17583017 00df4000000231leaa e2ma-verification=fu2 A8809FFAB54BD9C6F7DFBE92616764D0 EECD69320F38F645362247248BD675F4 v=spf1 include:_spf.cmu.edu ~all ZOOM_verify_FruZuJfdTeW1OOezpsuIVA apple-domain-verification=yZrPHuazhdH42CPf docusign=048da45a-23c6-4f6b-8f96-6dff4fa6b22b zoho-verification=zb38550127.zmverify.zoho.com airtable-verification=878daeee4665d51015a6dda912bbb9f5 [NRDR 33356_IN_TXT_MS=ms17583017 io8/1MnXyp5PTqiijD8s0Q] facebook-domain-verification=vxpo0xkores42yfj9ggcdd2o2d2v2n reftab-domain-verification=c24d073b23fed3af77c9e3b40010223f [NRDR 31057_IN_TXT_00df4000000231leaa QSq9rQj5GCBh30pVnLGMtQ] [NRDR 36124_IN_TXT_e2ma-verification=fu2 tn9dGsCpd6YZrmWG6O9dqw] [NRDR 36125_IN_TXT_e2ma-verification=fu2 tn9dGsCpd6YZrmWG6O9dqw] google-site-verification=JopPlnNv9VupQydpE3TiwZAEod-zouxEX0inao6rggg google-site-verification=MYZf5OssFVvgYQF1snvJdiFbMjHy53WzLrnsVGkgpFU google-site-verification=O2gyijlOW-8BSOghh0tL_4N1PlWU_qznkYhUA22dLJ0 google-site-verification=m3lUupwhWqjbGCA6JswqWyBi7tkzh-BjbRiYuC6EXTg google-site-verification=pNbrq7j_EeIowr_Kw1Jfy46bmFWR9p1llXH_leCdLrg [NRDR 31504_IN_TXT_v=spf1.include:_spf.cmu.edu.~all jxEj2x9CC1Gu8ePZldY84w] [NRDR 37587_IN_TXT_EECD69320F38F645362247248BD675F4 vdnDjzc5a9LVXuQ6DmgOhA] [NRDR 37683_IN_TXT_A8809FFAB54BD9C6F7DFBE92616764D0 1pWIIBS0QK7rR0bt/OqwZg] [NRDR 33014_IN_TXT_ZOOM_verify_FruZuJfdTeW1OOezpsuIVA +31oybl7gh2i74ky0SLQcg] [NRDR 16337_IN_LOC_40.26.39.0.N.79.56.36.2.W.283.1.10.10 5PS/aNXhz6qcZ6tfoRdgeQ] [NRDR 34415_IN_TXT_apple-domain-verification=yZrPHuazhdH42CPf dbWBQEISZeHDi/9KkKT96g] [NRDR 34190_IN_TXT_docusign=048da45a-23c6-4f6b-8f96-6dff4fa6b22b AWGRCMvgvpXmHSJ7nxKghg] r4bgkix7EqRv+dJHKYelMrye44oR+366MsSA0lCP0TOcMK8wfs0bpTMDP1tLTZ66OFh0Qx+ZMLBCeVx0NJ3syQ== [NRDR 34441_IN_TXT_zoho-verification=zb38550127.zmverify.zoho.com sbctKhpo8bhwlNq+f0khtw] cisco-ci-domain-verification=5f809f49f9d3ca48d84db537e031b2007011ea11f6410de6a8a02919908675d6 atlassian-domain-verification=H4RHVEsTq5YZaRen7VBly2a3AqWhfLMxAL3wBScS8EB0Pg5x1vaPhj3eXsGaUOGi [NRDR 37284_IN_TXT_airtable-verification=878daeee4665d51015a6dda912bbb9f5 GCXTwRluJG0dSxHBUrbFYA] [NRDR 32847_IN_TXT_facebook-domain-verification=vxpo0xkores42yfj9ggcdd2o2d2v2n 9I1LCDr7zb+jK0IoSEFayA] [NRDR 37073_IN_TXT_reftab-domain-verification=c24d073b23fed3af77c9e3b40010223f Kmo0sQxn82COz9etYwP/3w] [NRDR 30017_IN_TXT_google-site-verification=O2gyijlOW-8BSOghh0tL_4N1PlWU_qznkYhUA22dLJ0 PiRIS0yTtnNYmTWYpWCCVw] [NRDR 34436_IN_TXT_google-site-verification=MYZf5OssFVvgYQF1snvJdiFbMjHy53WzLrnsVGkgpFU C0YNNkwQ5Qfm8taSZKc+1A] [NRDR 34437_IN_TXT_google-site-verification=m3lUupwhWqjbGCA6JswqWyBi7tkzh-BjbRiYuC6EXTg Or5AmLIb59AN+oiEMjOqoA] [NRDR 34438_IN_TXT_google-site-verification=pNbrq7j_EeIowr_Kw1Jfy46bmFWR9p1llXH_leCdLrg eMgkItPzPonrYzRZBOx13w] [NRDR 34503_IN_TXT_google-site-verification=JopPlnNv9VupQydpE3TiwZAEod-zouxEX0inao6rggg HxtpS+uc1I0HuPBMBaTlCA] [NRDR 32936_IN_TXT_r4bgkix7EqRv+dJHKYelMrye44oR+366MsSA0lCP0TOcMK8wfs0bpTMDP1tLTZ66OFh0Qx+ZMLBCeVx0NJ3syQ== tGCEAk5qNOFhWjjp1w58vw] [NRDR 36038_IN_TXT_cisco-ci-domain-verification=5f809f49f9d3ca48d84db537e031b2007011ea11f6410de6a8a02919908675d6 VTvqYpCLdM5K6bM5zRNwDQ] [NRDR 34068_IN_TXT_atlassian-domain-verification=H4RHVEsTq5YZaRen7VBly2a3AqWhfLMxAL3wBScS8EB0Pg5x1vaPhj3eXsGaUOGi ePUw4Mw9giYZRVzpV/ysvQ]
TXT	_dmarc.cmu.edu	v=DMARC1;p=none;sp=none;rua=mailto:report-dmarc@andrew.cmu.edu
CAA	cmu.edu	—
DS	cmu.edu	56259 7 1 585e955d36ab11a225e22b42e713c9bc8b0347b7 56259 7 2 83f3ea220349ecd74852847f838121275ff28f3c0806b853133bcef61e1d8205

Fix priorities

Sorted by risk: severity first, confirmed issues before hardening gaps, then effort and score impact.

1MediumHSTS — enforce encryption in the browserHardening gap+4
2MediumDMARC — anti-spoofing policyHardening gap+10
3MediumCSP — protection from script injectionHardening gap+8
4LowCAA — who may issue certificatesHardening gap+5
5LowReferrer-PolicyHardening gap+3
6LowPermissions-PolicyHardening gap+2

Indicative alignment

Best-practice mapping of public findings to common frameworks. Passive scanning tests public configuration only; it doesn't prove compliance or a violation.

Google & Yahoo sender rules1 observed gaps
SPF, DKIM and DMARC are required for bulk senders to Gmail and Yahoo; missing them risks rejected or spam-foldered mail.
DMARC — anti-spoofing policy
PCI DSS v4.02 observed gaps
TLS, certificate and browser-header protections relate to PCI DSS v4.0 requirements 4.2 and 6.4 for payment pages.
HSTS — enforce encryption in the browser CSP — protection from script injection
NIS2 / vendor due diligence3 observed gaps
Vendor risk reviews under NIS2/DORA and cyber-insurance questionnaires check these public signals.
DMARC — anti-spoofing policy HSTS — enforce encryption in the browser CAA — who may issue certificates
SOC 2 / ISO 27001 baseline3 observed gaps
Baseline external hygiene commonly expected in SOC 2 and ISO 27001 audits.
DMARC — anti-spoofing policy HSTS — enforce encryption in the browser CSP — protection from script injection

Indicative alignment only, based on public configuration. It doesn't establish whether a framework applies to you, and it isn't legal advice, an audit or a certification.

Head-to-head vs competitor

How do you stack up against competitors?

The check reads public data only and makes no changes to the domain. Recommendations are intended for the domain owner.

Is your domain as secure? Scan it free, no sign-up

All pre-scanned domains

What to do first

Tell receiving mail servers how to treat fake email from your domain

Without this policy, inboxes have less guidance for spotting messages that impersonate you.

Who can fix it: Your email provider, together with whoever manages your DNS

How to verify after the fix

dig +short TXT _dmarc.cmu.edu

Limit what scripts your pages are allowed to run

This adds one layer of protection against injected scripts.

Who can fix it: Your website developer or web host

How to verify after the fix

curl -sIL https://cmu.edu/ | grep -i "Content-Security-Policy"

What this grade means

Tested hostname

cmu.edu

Website request

GET https://cmu.edu/ → https://www.cmu.edu/

Scan time

2026-11-15 18:29:53 UTC

Grading method

Version 2How grading works

Unverified or excluded checks

None. Every applicable check was assessed.

Technical detail

Click a check to see the public data, a verification command, a safe fix recommendation and documentation sources.

Email security

19/30

Encryption & certificate

25/25

Browser protections

13/30

DNS infrastructure

10/15

Public DNS records

A	cmu.edu	128.2.42.10
AAAA	cmu.edu	—
MX	cmu.edu	1 ASPMX.L.GOOGLE.COM 5 ALT1.ASPMX.L.GOOGLE.COM 5 ALT2.ASPMX.L.GOOGLE.COM 10 ALT3.ASPMX.L.GOOGLE.COM 10 ALT4.ASPMX.L.GOOGLE.COM
NS	cmu.edu	NSAUTH1.NET.cmu.edu NSAUTH2.NET.cmu.edu NSAUTH3.NET.cmu.edu
TXT	cmu.edu	MS=ms17583017 00df4000000231leaa e2ma-verification=fu2 A8809FFAB54BD9C6F7DFBE92616764D0 EECD69320F38F645362247248BD675F4 v=spf1 include:_spf.cmu.edu ~all ZOOM_verify_FruZuJfdTeW1OOezpsuIVA apple-domain-verification=yZrPHuazhdH42CPf docusign=048da45a-23c6-4f6b-8f96-6dff4fa6b22b zoho-verification=zb38550127.zmverify.zoho.com airtable-verification=878daeee4665d51015a6dda912bbb9f5 [NRDR 33356_IN_TXT_MS=ms17583017 io8/1MnXyp5PTqiijD8s0Q] facebook-domain-verification=vxpo0xkores42yfj9ggcdd2o2d2v2n reftab-domain-verification=c24d073b23fed3af77c9e3b40010223f [NRDR 31057_IN_TXT_00df4000000231leaa QSq9rQj5GCBh30pVnLGMtQ] [NRDR 36124_IN_TXT_e2ma-verification=fu2 tn9dGsCpd6YZrmWG6O9dqw] [NRDR 36125_IN_TXT_e2ma-verification=fu2 tn9dGsCpd6YZrmWG6O9dqw] google-site-verification=JopPlnNv9VupQydpE3TiwZAEod-zouxEX0inao6rggg google-site-verification=MYZf5OssFVvgYQF1snvJdiFbMjHy53WzLrnsVGkgpFU google-site-verification=O2gyijlOW-8BSOghh0tL_4N1PlWU_qznkYhUA22dLJ0 google-site-verification=m3lUupwhWqjbGCA6JswqWyBi7tkzh-BjbRiYuC6EXTg google-site-verification=pNbrq7j_EeIowr_Kw1Jfy46bmFWR9p1llXH_leCdLrg [NRDR 31504_IN_TXT_v=spf1.include:_spf.cmu.edu.~all jxEj2x9CC1Gu8ePZldY84w] [NRDR 37587_IN_TXT_EECD69320F38F645362247248BD675F4 vdnDjzc5a9LVXuQ6DmgOhA] [NRDR 37683_IN_TXT_A8809FFAB54BD9C6F7DFBE92616764D0 1pWIIBS0QK7rR0bt/OqwZg] [NRDR 33014_IN_TXT_ZOOM_verify_FruZuJfdTeW1OOezpsuIVA +31oybl7gh2i74ky0SLQcg] [NRDR 16337_IN_LOC_40.26.39.0.N.79.56.36.2.W.283.1.10.10 5PS/aNXhz6qcZ6tfoRdgeQ] [NRDR 34415_IN_TXT_apple-domain-verification=yZrPHuazhdH42CPf dbWBQEISZeHDi/9KkKT96g] [NRDR 34190_IN_TXT_docusign=048da45a-23c6-4f6b-8f96-6dff4fa6b22b AWGRCMvgvpXmHSJ7nxKghg] r4bgkix7EqRv+dJHKYelMrye44oR+366MsSA0lCP0TOcMK8wfs0bpTMDP1tLTZ66OFh0Qx+ZMLBCeVx0NJ3syQ== [NRDR 34441_IN_TXT_zoho-verification=zb38550127.zmverify.zoho.com sbctKhpo8bhwlNq+f0khtw] cisco-ci-domain-verification=5f809f49f9d3ca48d84db537e031b2007011ea11f6410de6a8a02919908675d6 atlassian-domain-verification=H4RHVEsTq5YZaRen7VBly2a3AqWhfLMxAL3wBScS8EB0Pg5x1vaPhj3eXsGaUOGi [NRDR 37284_IN_TXT_airtable-verification=878daeee4665d51015a6dda912bbb9f5 GCXTwRluJG0dSxHBUrbFYA] [NRDR 32847_IN_TXT_facebook-domain-verification=vxpo0xkores42yfj9ggcdd2o2d2v2n 9I1LCDr7zb+jK0IoSEFayA] [NRDR 37073_IN_TXT_reftab-domain-verification=c24d073b23fed3af77c9e3b40010223f Kmo0sQxn82COz9etYwP/3w] [NRDR 30017_IN_TXT_google-site-verification=O2gyijlOW-8BSOghh0tL_4N1PlWU_qznkYhUA22dLJ0 PiRIS0yTtnNYmTWYpWCCVw] [NRDR 34436_IN_TXT_google-site-verification=MYZf5OssFVvgYQF1snvJdiFbMjHy53WzLrnsVGkgpFU C0YNNkwQ5Qfm8taSZKc+1A] [NRDR 34437_IN_TXT_google-site-verification=m3lUupwhWqjbGCA6JswqWyBi7tkzh-BjbRiYuC6EXTg Or5AmLIb59AN+oiEMjOqoA] [NRDR 34438_IN_TXT_google-site-verification=pNbrq7j_EeIowr_Kw1Jfy46bmFWR9p1llXH_leCdLrg eMgkItPzPonrYzRZBOx13w] [NRDR 34503_IN_TXT_google-site-verification=JopPlnNv9VupQydpE3TiwZAEod-zouxEX0inao6rggg HxtpS+uc1I0HuPBMBaTlCA] [NRDR 32936_IN_TXT_r4bgkix7EqRv+dJHKYelMrye44oR+366MsSA0lCP0TOcMK8wfs0bpTMDP1tLTZ66OFh0Qx+ZMLBCeVx0NJ3syQ== tGCEAk5qNOFhWjjp1w58vw] [NRDR 36038_IN_TXT_cisco-ci-domain-verification=5f809f49f9d3ca48d84db537e031b2007011ea11f6410de6a8a02919908675d6 VTvqYpCLdM5K6bM5zRNwDQ] [NRDR 34068_IN_TXT_atlassian-domain-verification=H4RHVEsTq5YZaRen7VBly2a3AqWhfLMxAL3wBScS8EB0Pg5x1vaPhj3eXsGaUOGi ePUw4Mw9giYZRVzpV/ysvQ]
TXT	_dmarc.cmu.edu	v=DMARC1;p=none;sp=none;rua=mailto:report-dmarc@andrew.cmu.edu
CAA	cmu.edu	—
DS	cmu.edu	56259 7 1 585e955d36ab11a225e22b42e713c9bc8b0347b7 56259 7 2 83f3ea220349ecd74852847f838121275ff28f3c0806b853133bcef61e1d8205

Indicative alignment

Best-practice mapping of public findings to common frameworks. Passive scanning tests public configuration only; it doesn't prove compliance or a violation.

Google & Yahoo sender rules1 observed gaps

SPF, DKIM and DMARC are required for bulk senders to Gmail and Yahoo; missing them risks rejected or spam-foldered mail.

DMARC — anti-spoofing policy

PCI DSS v4.02 observed gaps

TLS, certificate and browser-header protections relate to PCI DSS v4.0 requirements 4.2 and 6.4 for payment pages.

HSTS — enforce encryption in the browser CSP — protection from script injection

NIS2 / vendor due diligence3 observed gaps

Vendor risk reviews under NIS2/DORA and cyber-insurance questionnaires check these public signals.

DMARC — anti-spoofing policy HSTS — enforce encryption in the browser CAA — who may issue certificates

SOC 2 / ISO 27001 baseline3 observed gaps

Baseline external hygiene commonly expected in SOC 2 and ISO 27001 audits.

DMARC — anti-spoofing policy HSTS — enforce encryption in the browser CSP — protection from script injection

Indicative alignment only, based on public configuration. It doesn't establish whether a framework applies to you, and it isn't legal advice, an audit or a certification.

cmu.edu

Track your progress

Help someone else check their domain

What to do first

What this grade means

Get the badge

Scan history

AI fix plan

Scans to analyze

Technical detail

Email security

Encryption & certificate

Browser protections

DNS infrastructure

Public DNS records

Is your domain as secure? Scan it free, no sign-up

cmu.edu

Track your progress

Help someone else check their domain

What to do first

What this grade means

Get the badge

Scan history

AI fix plan

Scans to analyze

Technical detail

Email security

Encryption & certificate

Browser protections

DNS infrastructure

Public DNS records

Is your domain as secure? Scan it free, no sign-up

Agent access & discovery signals