Automated public DNS and web checks; results may be incomplete. These are passive observations, not an assessment of the organization.

B86/100

Executive summary

dropbox.com

Good shape, with a few gaps worth closing this quarter.

Partial coverage: the score is based on 95% of applicable check weight. 1 unverified check(s) are excluded, not counted as failures.

2026-11-15 18:19 UTC

Print report / PDF

Useful for your IT provider or a colleague. Anyone with the link can view the report.

Track your progress

Fix the findings, then come back and rescan. Your scan history is saved in this browser so you can see exactly what improved.

Email security24/25

Good83% coverage

Spoofing email from this domain is hard.

Encryption & certificate25/25

Good

Traffic to the site is encrypted and the certificate is valid.

Browser protections25/30

Good

The site instructs browsers to block common attacks.

DNS infrastructure8/15

Needs attention

The domain's infrastructure works, but recommended hardening is missing.

Help someone else check their domain

Share this public report with a colleague. They can review the evidence and check their own domain.

Get the report badge

What to do first

1.
Turn on DNS signing for your domain
Signing helps resolvers detect forged answers about your domain.
Who can fix it: Your domain registrar or DNS provider
How to verify after the fix
```
dig +short DS dropbox.com
```
2.
Limit what scripts your pages are allowed to run
This adds one layer of protection against injected scripts.
Who can fix it: Your website developer or web host
How to verify after the fix
```
curl -sIL https://dropbox.com/ | grep -i "Content-Security-Policy"
```

A starting point, not a security guarantee.

What this grade means

Tested hostname: dropbox.com
Website request: GET https://dropbox.com/ → https://www.dropbox.com/
Scan time: 2026-11-15 18:19:15 UTC
Grading method: Version 2How grading works
Unverified or excluded checks: DKIM — digital signature on email · Not detected (common selectors only)

This is a snapshot of the public configuration checks listed in this report. It does not verify the site's owner, business legitimacy, application security, or absence of vulnerabilities. It is not a security certification.

Get the badge

Show the live grade for dropbox.com in a README, docs or site footer. The badge links to the public report and refreshes every 24 hours.

Scan shown on this page: ⁦2026-11-15 18:19:15 UTC⁩. The badge may display a cached result for up to 24 hours. Open the linked report to check its scan time.

Markdown

[![Domain Armor grade](https://getmirror.online/badge/dropbox.com.svg)](https://getmirror.online/report/dropbox.com)

HTML

<a href="https://getmirror.online/report/dropbox.com"><img src="https://getmirror.online/badge/dropbox.com.svg" alt="Domain Armor grade"></a>

Badge URL

https://getmirror.online/badge/dropbox.com.svg

Scan history

AI fix plan

Pick scans from this browser's history. The AI compares them, explains what changed and builds a prioritized, step-by-step plan.

Scans to analyze

0 of 6 selected

B86/10011/15/26, 06:19 PMCurrent

The current scan is always included.

AI-generated from your scan results only. Review each step before applying it; nothing is sent to or changed on the domain.

Technical detail

Click a check to see the public data, a verification command, a safe fix recommendation and documentation sources.

Email security

24/25

Encryption & certificate

25/25

Browser protections

25/30

DNS infrastructure

8/15

Public DNS records

A	dropbox.com	162.125.248.18
AAAA	dropbox.com	2620:100:6040:18::a27d:f812
MX	dropbox.com	10 mxa-001ed902.gslb.pphosted.com 10 mxb-001ed902.gslb.pphosted.com
NS	dropbox.com	ns-1162.awsdns-17.org ns-1949.awsdns-51.co.uk ns-315.awsdns-39.com ns-564.awsdns-06.net
TXT	dropbox.com	1e6de3584eb44e3e9fde429fb262995bb3f6422cab16daeff7cba598948242b8 MS=ms91256510 adobe-idp-site-verification=4977108a-46c6-4763-a3cc-b23b3d87e5cc anthropic-domain-verification-jk1bd4=WXuV479YDJRmIn8CJaIpZaW4S apple-domain-verification=6wGFrdfZ2TC4HlEk atlassian-domain-verification=yjrZDQ/hCS3k4pk87lelfsKb7+aOLpQPPgowWw/RHEwDCvNo8zH2iNCjFjZZtPvT aws-domain-control-verification=295d3c77-d647-4042-a10b-17bc6cf2a81c aws-domain-control-verification=fa66314d-b786-43ac-ba00-a2fc8c8da6c2 citrix-verification-code=b29deae6-12fa-4939-a5b1-9585f5fc82ba cursor-domain-verification-me5gdt=FG4EqpnCbcfCNcVW9qV0OYu9R decagon-domain-verification-v0ye0x=hK1f8wt5pCP112ZomGdWacypL docker-verification=215c893f-0bb3-4887-87a2-152ae8636422 docusign=a3cf77c9-f563-4c9b-8cbb-73c5322feb8e docusign=c18a935e-b7a7-4ca5-a401-9f7cac288c0b google-site-verification=2ZBxb1JI0xc_p5crqO_FHyV6OO3iYuvryuZj4nUNCEc google-site-verification=2_3MpLNP3RT2WDZTWn2VErDq0zTl7-IOZMviotkEhEQ google-site-verification=6Gs0C-CwJui707tVZirEFGKvKfGtwwZf2Snzz0-2nUQ google-site-verification=8NWlYGBCOsGGZoWB62V0z-I1v92RPDYt5e2MIcIlKOk google-site-verification=E9R8qj0pQvUF7rQ3x0s0m5Oh8FGBiO-7CQt-hiPQtFs google-site-verification=cPTvnO7zyyCEASSqXGDlzGgEECA-hWG7k_drsp-f9RA google-site-verification=dvbnC9kulo9yolnth_U5l7fMneacmwsmc7T-amaztiY google-site-verification=eL_MhPPeLDIVMzQmUh8cQlm1zzdyZRZs7a5aVqrTPKc google-site-verification=leXlkd4GKqaMP-t93sX2D_mNej1qyME73hyCvyjkbmA google-site-verification=rGECt1BQW-vtsJ-FgNwFpxTiTMc2DdQ9ZxAwT8nmbTE google-site-verification=u07OaGer3GQQDKmGdXvEnVDA7hVQJZ3nVglkGqTxnqI google-site-verification=vPdXnwB_snnJ8dqzD0OFEhiy3Vjq2l7qhXA-rnWR1lk hcp-domain-verification=70f13e6db06700814cb6a41bc0b14c0b02d972a58a16bc566918d50ecff3e2f7 hubspot-developer-verification=YTQ0MmYzMzItYjhhOC00YzhlLTg3ZDYtMjU3NWQ4OWY4MDNk hubspot-domain-verification=Y2NiYzY0YjktYzI1MC00NDg5LWI5ZTYtZWY4ZWQ1ZDEwNjdh infoblox-domain-mastery=d893f536feb426f7bcef35610e78c319a79a9585e03a3cbf753c589e58db5dbfae jamf-site-verification=EecmGLwXK6l4sJLtg1ckwQ liveramp-site-verification=l9GQet4bxvwWtgD1svh_74N5vOes7buz_drCyiY-dV4 lovable_verification=oimC5YnefHVCMkPlojvq mgverify=32a6a13661e86bff81acaf247c1dd6c5991bccc6a77dbe49f078deef4d61979c miro-verification=06f0d83f07b5b7c1936df29f6dc8a6a11cf82d08 mixpanel-domain-verify=c8f954c8-17fc-42a3-925c-6ea23ee3b534 notion-domain-verification=enHWmn6FFlHvaUid8AdXGKPkDn7j1VVAKudIomtvw0z openai-domain-verification=dv-taySZvuNYfU5nkRTfwxixP7F parallels-domain-verification=c22a91cd65da42ee92515d4d96940a8caed8b947d0ed4a37b1fa8cf8dbdd64b5 slack-domain-verification=1qkjOc6gwuxLaFmX90NDKDiQVw0k4aNHyeT15kdt stripe-verification=58A24CAFE9E3D2B5BC1B57D90B3271230384E4A98B997D269F6E93357C043DF9 stripe-verification=5A1286A45D18E28C4909AD9CAA70017D493E1A09417FB572992366CEC23DE9D3 stripe-verification=7f4c0115f99ee7bc4ed67beff4365dd6b29ec5e4cfca03b874d2de54fb1730a3 stripe-verification=ADB471381BCF8F6CF5635864612A5C41B09F3AD2E69F0BC675D96AB24CCCD5FC stripe-verification=abd8d702e1361e583deb9f1085ca164782f13f205b1b8b04225f9bac41c3f744 stripe-verification=d0a25558a690907c8476879165000a457c5521640f0be53b0d1acf5f4c311978 stripe-verification=fc5d818b64666e2f2da6e857d432a8278df3bcadcb7dce142103841f6045a54f v=spf1 ip4:45.58.64.0/20 ip4:185.45.8.0/22 ip4:162.125.0.0/16 ip4:199.47.216.0/22 ip4:108.160.160.0/20 ip4:205.189.0.0/24 ip4:160.34.15.16/28 ip4:52.5.134.202/32 ip4:205.220.162.87/32 ip4:205.220.174.83/32 ip4:167.89.98.146/32 ip4:167.89.89.46/32 ip4:167.89.96.134/32 ip4:159.183.109.97/32 ip4:149.72.220.85/32 ip4:159.183.15.144/32 ip4:159.183.2.51/32 ip4:159.183.2.58/32 ip6:2620:c6:8000::/48 include:amazonses.com include:_spf.google.com include:mail.zendesk.com include:mktomail.com include:rp.oracleemaildelivery.com exists:%{i}._spf.mta.salesforce.com ~all zapier-domain-verification-challenge=2d9f161a-cc7a-4780-862d-04aa31320698
TXT	_dmarc.dropbox.com	v=DMARC1;p=reject;pct=100;rua=mailto:c7xrs-8253@rua.dmarc.emailanalyst.com,mailto:dmarc@dropbox.com
CAA	dropbox.com	0 issue "amazonaws.com" 0 issue "digicert.com" 0 issue "letsencrypt.org;validationmethods=dns-01;accounturi=https://acme-v02.api.letsencrypt.org/acme/acct/2079416047"
DS	dropbox.com	—

Fix priorities

Sorted by risk: severity first, confirmed issues before hardening gaps, then effort and score impact.

1MediumDNSSEC — signed DNS recordsHardening gap+7
2LowPermissions-PolicyHardening gap+2
3LowCSP — protection from script injectionHardening gap+3

To verify

Couldn't be confirmed from public data, so excluded from the score. Checking them clarifies your posture; it doesn't guarantee a score change.

DKIM — digital signature on email

Indicative alignment

Best-practice mapping of public findings to common frameworks. Passive scanning tests public configuration only; it doesn't prove compliance or a violation.

Google & Yahoo sender rulesIncomplete evidence · 1 unverified
SPF, DKIM and DMARC are required for bulk senders to Gmail and Yahoo; missing them risks rejected or spam-foldered mail.
PCI DSS v4.01 observed gaps
TLS, certificate and browser-header protections relate to PCI DSS v4.0 requirements 4.2 and 6.4 for payment pages.
CSP — protection from script injection
NIS2 / vendor due diligence1 observed gaps
Vendor risk reviews under NIS2/DORA and cyber-insurance questionnaires check these public signals.
DNSSEC — signed DNS records
SOC 2 / ISO 27001 baseline1 observed gaps
Baseline external hygiene commonly expected in SOC 2 and ISO 27001 audits.
CSP — protection from script injection

Indicative alignment only, based on public configuration. It doesn't establish whether a framework applies to you, and it isn't legal advice, an audit or a certification.

Head-to-head vs competitor

How do you stack up against competitors?

The check reads public data only and makes no changes to the domain. Recommendations are intended for the domain owner.

Is your domain as secure? Scan it free, no sign-up

All pre-scanned domains

dropbox.com

Good shape, with a few gaps worth closing this quarter.

Partial coverage: the score is based on 95% of applicable check weight. 1 unverified check(s) are excluded, not counted as failures.

2026-11-15 18:19 UTC

Useful for your IT provider or a colleague. Anyone with the link can view the report.

What to do first

Turn on DNS signing for your domain

Signing helps resolvers detect forged answers about your domain.

Who can fix it: Your domain registrar or DNS provider

How to verify after the fix

dig +short DS dropbox.com

Limit what scripts your pages are allowed to run

This adds one layer of protection against injected scripts.

Who can fix it: Your website developer or web host

How to verify after the fix

curl -sIL https://dropbox.com/ | grep -i "Content-Security-Policy"

What this grade means

Tested hostname

dropbox.com

Website request

GET https://dropbox.com/ → https://www.dropbox.com/

Scan time

2026-11-15 18:19:15 UTC

Grading method

Version 2How grading works

Unverified or excluded checks

DKIM — digital signature on email · Not detected (common selectors only)

Technical detail

Click a check to see the public data, a verification command, a safe fix recommendation and documentation sources.

Email security

24/25

Encryption & certificate

25/25

Browser protections

25/30

DNS infrastructure

8/15

Public DNS records

A	dropbox.com	162.125.248.18
AAAA	dropbox.com	2620:100:6040:18::a27d:f812
MX	dropbox.com	10 mxa-001ed902.gslb.pphosted.com 10 mxb-001ed902.gslb.pphosted.com
NS	dropbox.com	ns-1162.awsdns-17.org ns-1949.awsdns-51.co.uk ns-315.awsdns-39.com ns-564.awsdns-06.net
TXT	dropbox.com	1e6de3584eb44e3e9fde429fb262995bb3f6422cab16daeff7cba598948242b8 MS=ms91256510 adobe-idp-site-verification=4977108a-46c6-4763-a3cc-b23b3d87e5cc anthropic-domain-verification-jk1bd4=WXuV479YDJRmIn8CJaIpZaW4S apple-domain-verification=6wGFrdfZ2TC4HlEk atlassian-domain-verification=yjrZDQ/hCS3k4pk87lelfsKb7+aOLpQPPgowWw/RHEwDCvNo8zH2iNCjFjZZtPvT aws-domain-control-verification=295d3c77-d647-4042-a10b-17bc6cf2a81c aws-domain-control-verification=fa66314d-b786-43ac-ba00-a2fc8c8da6c2 citrix-verification-code=b29deae6-12fa-4939-a5b1-9585f5fc82ba cursor-domain-verification-me5gdt=FG4EqpnCbcfCNcVW9qV0OYu9R decagon-domain-verification-v0ye0x=hK1f8wt5pCP112ZomGdWacypL docker-verification=215c893f-0bb3-4887-87a2-152ae8636422 docusign=a3cf77c9-f563-4c9b-8cbb-73c5322feb8e docusign=c18a935e-b7a7-4ca5-a401-9f7cac288c0b google-site-verification=2ZBxb1JI0xc_p5crqO_FHyV6OO3iYuvryuZj4nUNCEc google-site-verification=2_3MpLNP3RT2WDZTWn2VErDq0zTl7-IOZMviotkEhEQ google-site-verification=6Gs0C-CwJui707tVZirEFGKvKfGtwwZf2Snzz0-2nUQ google-site-verification=8NWlYGBCOsGGZoWB62V0z-I1v92RPDYt5e2MIcIlKOk google-site-verification=E9R8qj0pQvUF7rQ3x0s0m5Oh8FGBiO-7CQt-hiPQtFs google-site-verification=cPTvnO7zyyCEASSqXGDlzGgEECA-hWG7k_drsp-f9RA google-site-verification=dvbnC9kulo9yolnth_U5l7fMneacmwsmc7T-amaztiY google-site-verification=eL_MhPPeLDIVMzQmUh8cQlm1zzdyZRZs7a5aVqrTPKc google-site-verification=leXlkd4GKqaMP-t93sX2D_mNej1qyME73hyCvyjkbmA google-site-verification=rGECt1BQW-vtsJ-FgNwFpxTiTMc2DdQ9ZxAwT8nmbTE google-site-verification=u07OaGer3GQQDKmGdXvEnVDA7hVQJZ3nVglkGqTxnqI google-site-verification=vPdXnwB_snnJ8dqzD0OFEhiy3Vjq2l7qhXA-rnWR1lk hcp-domain-verification=70f13e6db06700814cb6a41bc0b14c0b02d972a58a16bc566918d50ecff3e2f7 hubspot-developer-verification=YTQ0MmYzMzItYjhhOC00YzhlLTg3ZDYtMjU3NWQ4OWY4MDNk hubspot-domain-verification=Y2NiYzY0YjktYzI1MC00NDg5LWI5ZTYtZWY4ZWQ1ZDEwNjdh infoblox-domain-mastery=d893f536feb426f7bcef35610e78c319a79a9585e03a3cbf753c589e58db5dbfae jamf-site-verification=EecmGLwXK6l4sJLtg1ckwQ liveramp-site-verification=l9GQet4bxvwWtgD1svh_74N5vOes7buz_drCyiY-dV4 lovable_verification=oimC5YnefHVCMkPlojvq mgverify=32a6a13661e86bff81acaf247c1dd6c5991bccc6a77dbe49f078deef4d61979c miro-verification=06f0d83f07b5b7c1936df29f6dc8a6a11cf82d08 mixpanel-domain-verify=c8f954c8-17fc-42a3-925c-6ea23ee3b534 notion-domain-verification=enHWmn6FFlHvaUid8AdXGKPkDn7j1VVAKudIomtvw0z openai-domain-verification=dv-taySZvuNYfU5nkRTfwxixP7F parallels-domain-verification=c22a91cd65da42ee92515d4d96940a8caed8b947d0ed4a37b1fa8cf8dbdd64b5 slack-domain-verification=1qkjOc6gwuxLaFmX90NDKDiQVw0k4aNHyeT15kdt stripe-verification=58A24CAFE9E3D2B5BC1B57D90B3271230384E4A98B997D269F6E93357C043DF9 stripe-verification=5A1286A45D18E28C4909AD9CAA70017D493E1A09417FB572992366CEC23DE9D3 stripe-verification=7f4c0115f99ee7bc4ed67beff4365dd6b29ec5e4cfca03b874d2de54fb1730a3 stripe-verification=ADB471381BCF8F6CF5635864612A5C41B09F3AD2E69F0BC675D96AB24CCCD5FC stripe-verification=abd8d702e1361e583deb9f1085ca164782f13f205b1b8b04225f9bac41c3f744 stripe-verification=d0a25558a690907c8476879165000a457c5521640f0be53b0d1acf5f4c311978 stripe-verification=fc5d818b64666e2f2da6e857d432a8278df3bcadcb7dce142103841f6045a54f v=spf1 ip4:45.58.64.0/20 ip4:185.45.8.0/22 ip4:162.125.0.0/16 ip4:199.47.216.0/22 ip4:108.160.160.0/20 ip4:205.189.0.0/24 ip4:160.34.15.16/28 ip4:52.5.134.202/32 ip4:205.220.162.87/32 ip4:205.220.174.83/32 ip4:167.89.98.146/32 ip4:167.89.89.46/32 ip4:167.89.96.134/32 ip4:159.183.109.97/32 ip4:149.72.220.85/32 ip4:159.183.15.144/32 ip4:159.183.2.51/32 ip4:159.183.2.58/32 ip6:2620:c6:8000::/48 include:amazonses.com include:_spf.google.com include:mail.zendesk.com include:mktomail.com include:rp.oracleemaildelivery.com exists:%{i}._spf.mta.salesforce.com ~all zapier-domain-verification-challenge=2d9f161a-cc7a-4780-862d-04aa31320698
TXT	_dmarc.dropbox.com	v=DMARC1;p=reject;pct=100;rua=mailto:c7xrs-8253@rua.dmarc.emailanalyst.com,mailto:dmarc@dropbox.com
CAA	dropbox.com	0 issue "amazonaws.com" 0 issue "digicert.com" 0 issue "letsencrypt.org;validationmethods=dns-01;accounturi=https://acme-v02.api.letsencrypt.org/acme/acct/2079416047"
DS	dropbox.com	—

Indicative alignment

Best-practice mapping of public findings to common frameworks. Passive scanning tests public configuration only; it doesn't prove compliance or a violation.

Google & Yahoo sender rulesIncomplete evidence · 1 unverified

SPF, DKIM and DMARC are required for bulk senders to Gmail and Yahoo; missing them risks rejected or spam-foldered mail.

PCI DSS v4.01 observed gaps

TLS, certificate and browser-header protections relate to PCI DSS v4.0 requirements 4.2 and 6.4 for payment pages.

CSP — protection from script injection

NIS2 / vendor due diligence1 observed gaps

Vendor risk reviews under NIS2/DORA and cyber-insurance questionnaires check these public signals.

DNSSEC — signed DNS records

SOC 2 / ISO 27001 baseline1 observed gaps

Baseline external hygiene commonly expected in SOC 2 and ISO 27001 audits.

CSP — protection from script injection

Indicative alignment only, based on public configuration. It doesn't establish whether a framework applies to you, and it isn't legal advice, an audit or a certification.

dropbox.com

Track your progress

Help someone else check their domain

What to do first

What this grade means

Get the badge

Scan history

AI fix plan

Scans to analyze

Technical detail

Email security

Encryption & certificate

Browser protections

DNS infrastructure

Public DNS records

Is your domain as secure? Scan it free, no sign-up

dropbox.com

Track your progress

Help someone else check their domain

What to do first

What this grade means

Get the badge

Scan history

AI fix plan

Scans to analyze

Technical detail

Email security

Encryption & certificate

Browser protections

DNS infrastructure

Public DNS records

Is your domain as secure? Scan it free, no sign-up

Agent access & discovery signals