Automated public DNS and web checks; results may be incomplete. These are passive observations, not an assessment of the organization.

C71/100

Executive summary

cnn.com

Moderate exposure. There are gaps an attacker could exploit — fix them soon.

Full coverage: every applicable check was assessed.

2026-11-15 18:23 UTC

Print report / PDF

Useful for your IT provider or a colleague. Anyone with the link can view the report.

Track your progress

Fix the findings, then come back and rescan. Your scan history is saved in this browser so you can see exactly what improved.

Email security29/30

Good

Spoofing email from this domain is hard.

Encryption & certificate25/25

Good

Traffic to the site is encrypted and the certificate is valid.

Browser protections14/30

Critical

Several browser hardening headers are missing, which removes layers of protection against script injection and framing.

DNS infrastructure3/15

Critical

The domain's infrastructure lacks basic protections.

Help someone else check their domain

Share this public report with a colleague. They can review the evidence and check their own domain.

Get the report badge

What to do first

1.
Tell browsers to always use the secure version
Helps browsers use HTTPS on future visits after they have received the policy.
Who can fix it: Your web host
How to verify after the fix
```
curl -sIL https://cnn.com/ | grep -i "Strict-Transport-Security"
```
2.
Turn on DNS signing for your domain
Signing helps resolvers detect forged answers about your domain.
Who can fix it: Your domain registrar or DNS provider
How to verify after the fix
```
dig +short DS cnn.com
```

A starting point, not a security guarantee.

What this grade means

Tested hostname: cnn.com
Website request: GET https://cnn.com/ → https://www.cnn.com/
Scan time: 2026-11-15 18:23:13 UTC
Grading method: Version 2How grading works
Unverified or excluded checks: None. Every applicable check was assessed.

This is a snapshot of the public configuration checks listed in this report. It does not verify the site's owner, business legitimacy, application security, or absence of vulnerabilities. It is not a security certification.

Get the badge

Show the live grade for cnn.com in a README, docs or site footer. The badge links to the public report and refreshes every 24 hours.

Scan shown on this page: ⁦2026-11-15 18:23:13 UTC⁩. The badge may display a cached result for up to 24 hours. Open the linked report to check its scan time.

Markdown

[![Domain Armor grade](https://getmirror.online/badge/cnn.com.svg)](https://getmirror.online/report/cnn.com)

HTML

<a href="https://getmirror.online/report/cnn.com"><img src="https://getmirror.online/badge/cnn.com.svg" alt="Domain Armor grade"></a>

Badge URL

https://getmirror.online/badge/cnn.com.svg

Scan history

AI fix plan

Pick scans from this browser's history. The AI compares them, explains what changed and builds a prioritized, step-by-step plan.

Scans to analyze

0 of 6 selected

C71/10011/15/26, 06:23 PMCurrent

The current scan is always included.

AI-generated from your scan results only. Review each step before applying it; nothing is sent to or changed on the domain.

Technical detail

Click a check to see the public data, a verification command, a safe fix recommendation and documentation sources.

Email security

29/30

Encryption & certificate

25/25

Browser protections

14/30

DNS infrastructure

3/15

Public DNS records

A	cnn.com	151.101.67.5 151.101.195.5 151.101.3.5 151.101.131.5
AAAA	cnn.com	2a04:4e42:200::773 2a04:4e42::773 2a04:4e42:400::773 2a04:4e42:600::773
MX	cnn.com	10 cnn-com.mail.protection.outlook.com
NS	cnn.com	ns-1242.awsdns-27.org ns-1652.awsdns-14.co.uk ns-378.awsdns-47.com ns-587.awsdns-09.net
TXT	cnn.com	2baPGrmeo+RwsWdIdq/gIVSEWNb4tC9mLGQu0j4l/mduqhm06T+V9vNLXsauLyH9FwMZJSRHvj/YHGKOVWRylw== 98f06e94-b4da-4343-86be-c6c1667205e6 _globalsign-domain-verification=nPcGMc5MexVHi5gaiJ3TNZjT3fI_seEOQWXPUSMmWm adobe-idp-site-verification=279ead95-3581-42b7-82f4-73c97f8cebfa atlassian-domain-verification=joqe6L8dNi+aisGbB1XHQa0pDc53V2l0GQQRUtLEcr2997x0+rtrAA5Zw+UgQw3u canva-site-verification=C8ADd96ykBUHF3wyVjPyXQ cisco-ci-domain-verification=4a1c92ef69fe42f8125c3ca9ce0696dcf6cc16fa80243257de578af593d19548 d1xTs9+kADZZSz3bPphLpkMXXxBGjqn5vsQHhi2M6lo0r8AdIbm6j8LfQXPujsywVgeGSP+AXWX0vO9Iep5cUg== facebook-domain-verification=xszi21kow2trmw3xt3ph6s631zyu3i google-site-verification=ASY4609WhzE-rpuCRXIIkcG6sCdrUw7SdTjD93UutiE google-site-verification=R-Btow3Z8oU_9H1IWU4Gm4lvUQ_OVmsfxonIKhIaiPE google-site-verification=_QivaXNjhXy-V1y_YqrycXdAWZi2mVrcwbXerX6THeY google-site-verification=cNhH3bbaizgJp34tQo2r1NgKE0YYLIPNOOvcBVTT5Pk google-site-verification=j2gGPSOzQ_1vx08SNjoGR7G8PfAIAThdvkPr_KdQGkc google-site-verification=zLPPRYQh2mgpr-Yhg_8j8Z04d1okax7bGsPDmHlrfN0 jamf-site-verification=n384y4ilec6xqi08ShxAOg miro-verification=1e01f8da769be1241fceefd9abf2c317dcd68323 mongodb-site-verification=mtrxHeW3jOzWtwEwnOLpeQo9NXh6Lqas stripe-verification=08de20cb0357e775ecd57d7bcb9bc860f4e2a4e962245b893b24db9ba57839b9 stripe-verification=094254c9a60a6dc0c1c2a62294b81c0c3b9363d044151a3e562ffeac0a7c4157 stripe-verification=1488a36c1dc125ea564dc5822d1414eeed68875825aaf90df27ac3131d053935 stripe-verification=42CDB310484C1CAA878F12A73EB7505EA6E7F154731CD7E4F5ABB574DE5E7725 stripe-verification=e5dad290205182f6bdbd4e72697ce3cf9a965f35cb0349d538e09706345fb673 v=spf1 include:cnn.com._nspf.vali.email include:%{i}._ip.%{h}._ehlo.%{d}._spf.vali.email include:mail.zendesk.com ~all
TXT	_dmarc.cnn.com	v=DMARC1; p=reject; rua=mailto:dmarc_agg@vali.email; ruf=mailto:Njk3@ruf.vali.email
CAA	cnn.com	—
DS	cnn.com	—

Fix priorities

Sorted by risk: severity first, confirmed issues before hardening gaps, then effort and score impact.

1HighHSTS — enforce encryption in the browserHardening gap+8
2MediumDNSSEC — signed DNS recordsHardening gap+7
3LowCAA — who may issue certificatesHardening gap+5
4LowReferrer-PolicyHardening gap+3
5LowPermissions-PolicyHardening gap+2
6LowCSP — protection from script injectionHardening gap+3

Indicative alignment

Best-practice mapping of public findings to common frameworks. Passive scanning tests public configuration only; it doesn't prove compliance or a violation.

Google & Yahoo sender rulesNo gaps observed
SPF, DKIM and DMARC are required for bulk senders to Gmail and Yahoo; missing them risks rejected or spam-foldered mail.
PCI DSS v4.02 observed gaps
TLS, certificate and browser-header protections relate to PCI DSS v4.0 requirements 4.2 and 6.4 for payment pages.
HSTS — enforce encryption in the browser CSP — protection from script injection
NIS2 / vendor due diligence3 observed gaps
Vendor risk reviews under NIS2/DORA and cyber-insurance questionnaires check these public signals.
HSTS — enforce encryption in the browser DNSSEC — signed DNS records CAA — who may issue certificates
SOC 2 / ISO 27001 baseline2 observed gaps
Baseline external hygiene commonly expected in SOC 2 and ISO 27001 audits.
HSTS — enforce encryption in the browser CSP — protection from script injection

Indicative alignment only, based on public configuration. It doesn't establish whether a framework applies to you, and it isn't legal advice, an audit or a certification.

Head-to-head vs competitor

How do you stack up against competitors?

The check reads public data only and makes no changes to the domain. Recommendations are intended for the domain owner.

Is your domain as secure? Scan it free, no sign-up

All pre-scanned domains

What to do first

Tell browsers to always use the secure version

Helps browsers use HTTPS on future visits after they have received the policy.

Who can fix it: Your web host

How to verify after the fix

curl -sIL https://cnn.com/ | grep -i "Strict-Transport-Security"

Turn on DNS signing for your domain

Signing helps resolvers detect forged answers about your domain.

Who can fix it: Your domain registrar or DNS provider

How to verify after the fix

dig +short DS cnn.com

What this grade means

Tested hostname

cnn.com

Website request

GET https://cnn.com/ → https://www.cnn.com/

Scan time

2026-11-15 18:23:13 UTC

Grading method

Version 2How grading works

Unverified or excluded checks

None. Every applicable check was assessed.

Technical detail

Click a check to see the public data, a verification command, a safe fix recommendation and documentation sources.

Email security

29/30

Encryption & certificate

25/25

Browser protections

14/30

DNS infrastructure

3/15

Public DNS records

A	cnn.com	151.101.67.5 151.101.195.5 151.101.3.5 151.101.131.5
AAAA	cnn.com	2a04:4e42:200::773 2a04:4e42::773 2a04:4e42:400::773 2a04:4e42:600::773
MX	cnn.com	10 cnn-com.mail.protection.outlook.com
NS	cnn.com	ns-1242.awsdns-27.org ns-1652.awsdns-14.co.uk ns-378.awsdns-47.com ns-587.awsdns-09.net
TXT	cnn.com	2baPGrmeo+RwsWdIdq/gIVSEWNb4tC9mLGQu0j4l/mduqhm06T+V9vNLXsauLyH9FwMZJSRHvj/YHGKOVWRylw== 98f06e94-b4da-4343-86be-c6c1667205e6 _globalsign-domain-verification=nPcGMc5MexVHi5gaiJ3TNZjT3fI_seEOQWXPUSMmWm adobe-idp-site-verification=279ead95-3581-42b7-82f4-73c97f8cebfa atlassian-domain-verification=joqe6L8dNi+aisGbB1XHQa0pDc53V2l0GQQRUtLEcr2997x0+rtrAA5Zw+UgQw3u canva-site-verification=C8ADd96ykBUHF3wyVjPyXQ cisco-ci-domain-verification=4a1c92ef69fe42f8125c3ca9ce0696dcf6cc16fa80243257de578af593d19548 d1xTs9+kADZZSz3bPphLpkMXXxBGjqn5vsQHhi2M6lo0r8AdIbm6j8LfQXPujsywVgeGSP+AXWX0vO9Iep5cUg== facebook-domain-verification=xszi21kow2trmw3xt3ph6s631zyu3i google-site-verification=ASY4609WhzE-rpuCRXIIkcG6sCdrUw7SdTjD93UutiE google-site-verification=R-Btow3Z8oU_9H1IWU4Gm4lvUQ_OVmsfxonIKhIaiPE google-site-verification=_QivaXNjhXy-V1y_YqrycXdAWZi2mVrcwbXerX6THeY google-site-verification=cNhH3bbaizgJp34tQo2r1NgKE0YYLIPNOOvcBVTT5Pk google-site-verification=j2gGPSOzQ_1vx08SNjoGR7G8PfAIAThdvkPr_KdQGkc google-site-verification=zLPPRYQh2mgpr-Yhg_8j8Z04d1okax7bGsPDmHlrfN0 jamf-site-verification=n384y4ilec6xqi08ShxAOg miro-verification=1e01f8da769be1241fceefd9abf2c317dcd68323 mongodb-site-verification=mtrxHeW3jOzWtwEwnOLpeQo9NXh6Lqas stripe-verification=08de20cb0357e775ecd57d7bcb9bc860f4e2a4e962245b893b24db9ba57839b9 stripe-verification=094254c9a60a6dc0c1c2a62294b81c0c3b9363d044151a3e562ffeac0a7c4157 stripe-verification=1488a36c1dc125ea564dc5822d1414eeed68875825aaf90df27ac3131d053935 stripe-verification=42CDB310484C1CAA878F12A73EB7505EA6E7F154731CD7E4F5ABB574DE5E7725 stripe-verification=e5dad290205182f6bdbd4e72697ce3cf9a965f35cb0349d538e09706345fb673 v=spf1 include:cnn.com._nspf.vali.email include:%{i}._ip.%{h}._ehlo.%{d}._spf.vali.email include:mail.zendesk.com ~all
TXT	_dmarc.cnn.com	v=DMARC1; p=reject; rua=mailto:dmarc_agg@vali.email; ruf=mailto:Njk3@ruf.vali.email
CAA	cnn.com	—
DS	cnn.com	—

Indicative alignment

Best-practice mapping of public findings to common frameworks. Passive scanning tests public configuration only; it doesn't prove compliance or a violation.

Google & Yahoo sender rulesNo gaps observed

SPF, DKIM and DMARC are required for bulk senders to Gmail and Yahoo; missing them risks rejected or spam-foldered mail.

PCI DSS v4.02 observed gaps

TLS, certificate and browser-header protections relate to PCI DSS v4.0 requirements 4.2 and 6.4 for payment pages.

HSTS — enforce encryption in the browser CSP — protection from script injection

NIS2 / vendor due diligence3 observed gaps

Vendor risk reviews under NIS2/DORA and cyber-insurance questionnaires check these public signals.

HSTS — enforce encryption in the browser DNSSEC — signed DNS records CAA — who may issue certificates

SOC 2 / ISO 27001 baseline2 observed gaps

Baseline external hygiene commonly expected in SOC 2 and ISO 27001 audits.

HSTS — enforce encryption in the browser CSP — protection from script injection

Indicative alignment only, based on public configuration. It doesn't establish whether a framework applies to you, and it isn't legal advice, an audit or a certification.

cnn.com

Track your progress

Help someone else check their domain

What to do first

What this grade means

Get the badge

Scan history

AI fix plan

Scans to analyze

Technical detail

Email security

Encryption & certificate

Browser protections

DNS infrastructure

Public DNS records

Is your domain as secure? Scan it free, no sign-up

cnn.com

Track your progress

Help someone else check their domain

What to do first

What this grade means

Get the badge

Scan history

AI fix plan

Scans to analyze

Technical detail

Email security

Encryption & certificate

Browser protections

DNS infrastructure

Public DNS records

Is your domain as secure? Scan it free, no sign-up

Agent access & discovery signals