Automated public DNS and web checks; results may be incomplete. These are passive observations, not an assessment of the organization.

C76/100

Executive summary

costco.com

Moderate exposure. There are gaps an attacker could exploit — fix them soon.

Full coverage: every applicable check was assessed.

2026-11-15 18:23 UTC

Print report / PDF

Useful for your IT provider or a colleague. Anyone with the link can view the report.

Track your progress

Fix the findings, then come back and rescan. Your scan history is saved in this browser so you can see exactly what improved.

Email security30/30

Good

Spoofing email from this domain is hard.

Encryption & certificate25/25

Good

Traffic to the site is encrypted and the certificate is valid.

Browser protections13/30

Critical

Several browser hardening headers are missing, which removes layers of protection against script injection and framing.

DNS infrastructure8/15

Needs attention

The domain's infrastructure works, but recommended hardening is missing.

Help someone else check their domain

Share this public report with a colleague. They can review the evidence and check their own domain.

Get the report badge

What to do first

1.
Turn on DNS signing for your domain
Signing helps resolvers detect forged answers about your domain.
Who can fix it: Your domain registrar or DNS provider
How to verify after the fix
```
dig +short DS costco.com
```
2.
Stop other sites from embedding your pages
This removes one way to trick visitors into clicking something on your site unknowingly.
Who can fix it: Your website developer or web host
How to verify after the fix
```
curl -sIL https://costco.com/ | grep -i "X-Frame-Options"
```

A starting point, not a security guarantee.

What this grade means

Tested hostname: costco.com
Website request: GET https://costco.com/ → https://www.costco.com/
Scan time: 2026-11-15 18:23:59 UTC
Grading method: Version 2How grading works
Unverified or excluded checks: None. Every applicable check was assessed.

This is a snapshot of the public configuration checks listed in this report. It does not verify the site's owner, business legitimacy, application security, or absence of vulnerabilities. It is not a security certification.

Get the badge

Show the live grade for costco.com in a README, docs or site footer. The badge links to the public report and refreshes every 24 hours.

Scan shown on this page: ⁦2026-11-15 18:23:59 UTC⁩. The badge may display a cached result for up to 24 hours. Open the linked report to check its scan time.

Markdown

[![Domain Armor grade](https://getmirror.online/badge/costco.com.svg)](https://getmirror.online/report/costco.com)

HTML

<a href="https://getmirror.online/report/costco.com"><img src="https://getmirror.online/badge/costco.com.svg" alt="Domain Armor grade"></a>

Badge URL

https://getmirror.online/badge/costco.com.svg

Scan history

AI fix plan

Pick scans from this browser's history. The AI compares them, explains what changed and builds a prioritized, step-by-step plan.

Scans to analyze

0 of 6 selected

C76/10011/15/26, 06:23 PMCurrent

The current scan is always included.

AI-generated from your scan results only. Review each step before applying it; nothing is sent to or changed on the domain.

Technical detail

Click a check to see the public data, a verification command, a safe fix recommendation and documentation sources.

Email security

30/30

Encryption & certificate

25/25

Browser protections

13/30

DNS infrastructure

8/15

Public DNS records

A	costco.com	151.101.3.52 151.101.195.52 151.101.131.52 151.101.67.52
AAAA	costco.com	—
MX	costco.com	5 mxb-001f9d01.gslb.pphosted.com 10 mx0b-001f9d01.pphosted.com 5 mxa-001f9d01.gslb.pphosted.com 10 mx0a-001f9d01.pphosted.com
NS	costco.com	a9-66.akam.net a1-116.akam.net a28-66.akam.net a14-67.akam.net a5-64.akam.net a6-64.akam.net
TXT	costco.com	flexera-domain-verification-bazgmhadwejbbgdq MS=ms45356090 flexera-domain-verification-mddzccpcqcdbeuih dtm-domain-verification=RvQ3bIbvQAeeMHbrXwHbtfcU-Z8WGxW6tBQQFfdpIvA intersight=c7f5c84fa7c1559a23ae37f0a45aa2806cc1b09291dfe94ffa5c775b65feb280 postman-domain-verification=a5e9b1c7145c22a192ff089eb9c140d4a589b99d7763b87483c24c2deba6d7032578d3a1329849d9e52dd2ae59b3721b451d3fdb461b4514f4e8f5f6b8d696cd docusign=4db9a87a-9dea-417f-bfaa-d45bf7c94291 google-site-verification=dffTnhrKhs3V5-UUHvEYJg-RNLJjBz27jCBqmF6sX_E Dynatrace-site-verification=85537782-cedf-4d0d-9b24-3126f2ae1dcb__87kk52lv2c0qrp2k60td8iugme onx=efbf8ab1-7e83-4416-85a4-711586edb47c google-site-verification=_UMsl36liAGjRl5ldvmM5bK7YCzP_z19C522LsS_6Z4 google-site-verification=3Kx9tc2_v5CgX3NuVqNwWFZRYanPPJCP3__8KbRxn5Q d3958bd3-ebec-43fc-8b73-53355efdf2f6.costco.com a3a34ae6-fccb-4452-9105-cb31f5348086 adobe-idp-site-verification=ae9e3f0f-2848-4000-aed4-e1c7e8031815 onetrust-domain-verification=e62749d1cc3549bea14bacad4cd8215f facebook-domain-verification=46if6nzbzbffbhikh3uq8sye7ez5bg ms-domain-verification=2d5e7430-b403-4b17-a1df-4cb3eee9967b v=spf1 include:%{ir}.%{v}.%{d}.spf.has.pphosted.com -all atlassian-domain-verification=mOyfCnOmDOAo2wCWxZ1feSqlR3yeXX6nP2KotAWqkWWtO1NAJydXpiYNCYEhJUn8 google-site-verification=XGHXzaAnl-HmYsIW4QB-l4aaHMgJyBHqcT3Jc8SB2BY ciscocidomainverification=778c9d75e8b6fdb7dc3f095b677d08d21ececebe8462cb691c377eb0c061c825 vmware-cloud-verification-7161df13-1d90-4cbe-a1a9-0f29fc3e9ffc VmwCafXLaizwh4cfQPdy onetrust-domain-verification=0cc4aa566b3f4d3d9f5f03bc7cfd73c4 d4c2e4a3297fe25a71d030b67eb83bfc have-i-been-pwned-verification=7411effeb11c12300a4c027396b4cf0f onx=2d96b540-bcd6-4410-813c-d5e96ab635c5 docusign=3e51deb4-b2f9-46ef-b120-18f6955ebce1 onx=58b94d97-109f-4db2-98cf-5a1c93395b4d
TXT	_dmarc.costco.com	v=DMARC1; p=reject; sp=reject; fo=1; rua=mailto:dmarc_rua@emaildefense.proofpoint.com; ruf=mailto:dmarc_ruf@emaildefense.proofpoint.com;
CAA	costco.com	128 issue "digicert.com" 128 issue "certainly.com"
DS	costco.com	—

Fix priorities

Sorted by risk: severity first, confirmed issues before hardening gaps, then effort and score impact.

1MediumClickjacking protectionHardening gap+5
2MediumDNSSEC — signed DNS recordsHardening gap+7
3LowX-Content-Type-OptionsHardening gap+4
4LowReferrer-PolicyHardening gap+3
5LowPermissions-PolicyHardening gap+2
6LowCSP — protection from script injectionHardening gap+3

Indicative alignment

Best-practice mapping of public findings to common frameworks. Passive scanning tests public configuration only; it doesn't prove compliance or a violation.

Google & Yahoo sender rulesNo gaps observed
SPF, DKIM and DMARC are required for bulk senders to Gmail and Yahoo; missing them risks rejected or spam-foldered mail.
PCI DSS v4.02 observed gaps
TLS, certificate and browser-header protections relate to PCI DSS v4.0 requirements 4.2 and 6.4 for payment pages.
CSP — protection from script injection Clickjacking protection
NIS2 / vendor due diligence1 observed gaps
Vendor risk reviews under NIS2/DORA and cyber-insurance questionnaires check these public signals.
DNSSEC — signed DNS records
SOC 2 / ISO 27001 baseline3 observed gaps
Baseline external hygiene commonly expected in SOC 2 and ISO 27001 audits.
CSP — protection from script injection Clickjacking protection X-Content-Type-Options

Indicative alignment only, based on public configuration. It doesn't establish whether a framework applies to you, and it isn't legal advice, an audit or a certification.

Head-to-head vs competitor

How do you stack up against competitors?

The check reads public data only and makes no changes to the domain. Recommendations are intended for the domain owner.

Is your domain as secure? Scan it free, no sign-up

All pre-scanned domains

What to do first

Turn on DNS signing for your domain

Signing helps resolvers detect forged answers about your domain.

Who can fix it: Your domain registrar or DNS provider

How to verify after the fix

dig +short DS costco.com

Stop other sites from embedding your pages

This removes one way to trick visitors into clicking something on your site unknowingly.

Who can fix it: Your website developer or web host

How to verify after the fix

curl -sIL https://costco.com/ | grep -i "X-Frame-Options"

What this grade means

Tested hostname

costco.com

Website request

GET https://costco.com/ → https://www.costco.com/

Scan time

2026-11-15 18:23:59 UTC

Grading method

Version 2How grading works

Unverified or excluded checks

None. Every applicable check was assessed.

Technical detail

Click a check to see the public data, a verification command, a safe fix recommendation and documentation sources.

Email security

30/30

Encryption & certificate

25/25

Browser protections

13/30

DNS infrastructure

8/15

Public DNS records

A	costco.com	151.101.3.52 151.101.195.52 151.101.131.52 151.101.67.52
AAAA	costco.com	—
MX	costco.com	5 mxb-001f9d01.gslb.pphosted.com 10 mx0b-001f9d01.pphosted.com 5 mxa-001f9d01.gslb.pphosted.com 10 mx0a-001f9d01.pphosted.com
NS	costco.com	a9-66.akam.net a1-116.akam.net a28-66.akam.net a14-67.akam.net a5-64.akam.net a6-64.akam.net
TXT	costco.com	flexera-domain-verification-bazgmhadwejbbgdq MS=ms45356090 flexera-domain-verification-mddzccpcqcdbeuih dtm-domain-verification=RvQ3bIbvQAeeMHbrXwHbtfcU-Z8WGxW6tBQQFfdpIvA intersight=c7f5c84fa7c1559a23ae37f0a45aa2806cc1b09291dfe94ffa5c775b65feb280 postman-domain-verification=a5e9b1c7145c22a192ff089eb9c140d4a589b99d7763b87483c24c2deba6d7032578d3a1329849d9e52dd2ae59b3721b451d3fdb461b4514f4e8f5f6b8d696cd docusign=4db9a87a-9dea-417f-bfaa-d45bf7c94291 google-site-verification=dffTnhrKhs3V5-UUHvEYJg-RNLJjBz27jCBqmF6sX_E Dynatrace-site-verification=85537782-cedf-4d0d-9b24-3126f2ae1dcb__87kk52lv2c0qrp2k60td8iugme onx=efbf8ab1-7e83-4416-85a4-711586edb47c google-site-verification=_UMsl36liAGjRl5ldvmM5bK7YCzP_z19C522LsS_6Z4 google-site-verification=3Kx9tc2_v5CgX3NuVqNwWFZRYanPPJCP3__8KbRxn5Q d3958bd3-ebec-43fc-8b73-53355efdf2f6.costco.com a3a34ae6-fccb-4452-9105-cb31f5348086 adobe-idp-site-verification=ae9e3f0f-2848-4000-aed4-e1c7e8031815 onetrust-domain-verification=e62749d1cc3549bea14bacad4cd8215f facebook-domain-verification=46if6nzbzbffbhikh3uq8sye7ez5bg ms-domain-verification=2d5e7430-b403-4b17-a1df-4cb3eee9967b v=spf1 include:%{ir}.%{v}.%{d}.spf.has.pphosted.com -all atlassian-domain-verification=mOyfCnOmDOAo2wCWxZ1feSqlR3yeXX6nP2KotAWqkWWtO1NAJydXpiYNCYEhJUn8 google-site-verification=XGHXzaAnl-HmYsIW4QB-l4aaHMgJyBHqcT3Jc8SB2BY ciscocidomainverification=778c9d75e8b6fdb7dc3f095b677d08d21ececebe8462cb691c377eb0c061c825 vmware-cloud-verification-7161df13-1d90-4cbe-a1a9-0f29fc3e9ffc VmwCafXLaizwh4cfQPdy onetrust-domain-verification=0cc4aa566b3f4d3d9f5f03bc7cfd73c4 d4c2e4a3297fe25a71d030b67eb83bfc have-i-been-pwned-verification=7411effeb11c12300a4c027396b4cf0f onx=2d96b540-bcd6-4410-813c-d5e96ab635c5 docusign=3e51deb4-b2f9-46ef-b120-18f6955ebce1 onx=58b94d97-109f-4db2-98cf-5a1c93395b4d
TXT	_dmarc.costco.com	v=DMARC1; p=reject; sp=reject; fo=1; rua=mailto:dmarc_rua@emaildefense.proofpoint.com; ruf=mailto:dmarc_ruf@emaildefense.proofpoint.com;
CAA	costco.com	128 issue "digicert.com" 128 issue "certainly.com"
DS	costco.com	—

Indicative alignment

Best-practice mapping of public findings to common frameworks. Passive scanning tests public configuration only; it doesn't prove compliance or a violation.

Google & Yahoo sender rulesNo gaps observed

SPF, DKIM and DMARC are required for bulk senders to Gmail and Yahoo; missing them risks rejected or spam-foldered mail.

PCI DSS v4.02 observed gaps

TLS, certificate and browser-header protections relate to PCI DSS v4.0 requirements 4.2 and 6.4 for payment pages.

CSP — protection from script injection Clickjacking protection

NIS2 / vendor due diligence1 observed gaps

Vendor risk reviews under NIS2/DORA and cyber-insurance questionnaires check these public signals.

DNSSEC — signed DNS records

SOC 2 / ISO 27001 baseline3 observed gaps

Baseline external hygiene commonly expected in SOC 2 and ISO 27001 audits.

CSP — protection from script injection Clickjacking protection X-Content-Type-Options

Indicative alignment only, based on public configuration. It doesn't establish whether a framework applies to you, and it isn't legal advice, an audit or a certification.

costco.com

Track your progress

Help someone else check their domain

What to do first

What this grade means

Get the badge

Scan history

AI fix plan

Scans to analyze

Technical detail

Email security

Encryption & certificate

Browser protections

DNS infrastructure

Public DNS records

Is your domain as secure? Scan it free, no sign-up

costco.com

Track your progress

Help someone else check their domain

What to do first

What this grade means

Get the badge

Scan history

AI fix plan

Scans to analyze

Technical detail

Email security

Encryption & certificate

Browser protections

DNS infrastructure

Public DNS records

Is your domain as secure? Scan it free, no sign-up

Agent access & discovery signals