Automated public DNS and web checks; results may be incomplete. These are passive observations, not an assessment of the organization.

F53/100

Executive summary

google.com

Critical findings in the observed public configuration. Some basic protections were not detected.

Partial coverage: the score is based on 95% of applicable check weight. 1 unverified check(s) are excluded, not counted as failures.

2026-11-15 18:14 UTC

Print report / PDF

Useful for your IT provider or a colleague. Anyone with the link can view the report.

Track your progress

Fix the findings, then come back and rescan. Your scan history is saved in this browser so you can see exactly what improved.

Email security24/25

Good83% coverage

Spoofing email from this domain is hard.

Encryption & certificate18/25

Needs attention

Encryption is in place, but a gap could expose users.

Browser protections0/30

Critical

Several browser hardening headers are missing, which removes layers of protection against script injection and framing.

DNS infrastructure8/15

Needs attention

The domain's infrastructure works, but recommended hardening is missing.

Help someone else check their domain

Share this public report with a colleague. They can review the evidence and check their own domain.

Get the report badge

What to do first

1.
Tell browsers to always use the secure version
Helps browsers use HTTPS on future visits after they have received the policy.
Who can fix it: Your web host
How to verify after the fix
```
curl -sIL https://google.com/ | grep -i "Strict-Transport-Security"
```
2.
Limit what scripts your pages are allowed to run
This adds one layer of protection against injected scripts.
Who can fix it: Your website developer or web host
How to verify after the fix
```
curl -sIL https://google.com/ | grep -i "Content-Security-Policy"
```

A starting point, not a security guarantee.

What this grade means

Tested hostname: google.com
Website request: GET https://google.com/ → https://www.google.com/sorry/index?continue=https://google.com/&q=EgSinlZ8GKPt59cGIilRQlVxo0FUEvBx2sjAoMnpFQcFtNcovmb6K_qRG5nbxCJVsXrfREkR0zICclJaAUNgmtHSuOODiqk4
Scan time: 2026-11-15 18:14:58 UTC
Grading method: Version 2How grading works
Unverified or excluded checks: DKIM — digital signature on email · Not detected (common selectors only)

This is a snapshot of the public configuration checks listed in this report. It does not verify the site's owner, business legitimacy, application security, or absence of vulnerabilities. It is not a security certification.

Get the badge

Show the live grade for google.com in a README, docs or site footer. The badge links to the public report and refreshes every 24 hours.

Scan shown on this page: ⁦2026-11-15 18:14:58 UTC⁩. The badge may display a cached result for up to 24 hours. Open the linked report to check its scan time.

Markdown

[![Domain Armor grade](https://getmirror.online/badge/google.com.svg)](https://getmirror.online/report/google.com)

HTML

<a href="https://getmirror.online/report/google.com"><img src="https://getmirror.online/badge/google.com.svg" alt="Domain Armor grade"></a>

Badge URL

https://getmirror.online/badge/google.com.svg

Scan history

AI fix plan

Pick scans from this browser's history. The AI compares them, explains what changed and builds a prioritized, step-by-step plan.

Scans to analyze

0 of 6 selected

F53/10011/15/26, 06:14 PMCurrent

The current scan is always included.

AI-generated from your scan results only. Review each step before applying it; nothing is sent to or changed on the domain.

Technical detail

Click a check to see the public data, a verification command, a safe fix recommendation and documentation sources.

Email security

24/25

Encryption & certificate

18/25

Browser protections

0/30

DNS infrastructure

8/15

Public DNS records

A	google.com	142.251.127.139 142.251.127.101 142.251.127.138 142.251.127.102 142.251.127.100 142.251.127.113
AAAA	google.com	2a00:1450:4001:c0f::66 2a00:1450:4001:c0f::8a 2a00:1450:4001:c0f::64 2a00:1450:4001:c0f::8b
MX	google.com	10 smtp.google.com
NS	google.com	ns4.google.com ns1.google.com ns2.google.com ns3.google.com
TXT	google.com	MS=E4A68B9AB2BB9670BCE15412F62916164C0B20BB onetrust-domain-verification=0d477fe608074e6f9c12bca7826035cc v=spf1 include:_spf.google.com ~all work-accounts-domain-verification=Tcj6JjIMZOw2KsSEw2Nt2rLae89tN6 arcules-domain-verification=2R4t5G7nI6tRCo61lpxxbLksPYstxhGmtV75cpr8x9K google-site-verification=4ibFUgB-wXLQ_S7vsXVomSTVamuOXBiVAzpR5IZ87D0 docusign=1b0a6754-49b1-4db5-8540-d2c12664b289 docusign=05958488-4752-4ef2-95eb-aa7ba8a3bd0e globalsign-smime-dv=CDYX+XFHUw2wml6/Gb8+59BsH31KzUr6c1l2BPvqKX8= cisco-ci-domain-verification=47c38bc8c4b74b7233e9053220c1bbe76bcc1cd33c7acf7acd36cd6a5332004b apple-domain-verification=30afIBcvSuDV2PLX facebook-domain-verification=22rm551cu4k0ab0bxsw536tlds4h95 google-site-verification=TV9-DBe4R80X4v0M4U_bd_J9cpOJM0nikft0jAgjmsQ onetrust-domain-verification=6d685f1d41a94696ad7ef771f68993e0 Z29vZ2xl google-site-verification=wD8N7i1JTNTkezJ49swvWW48f8_9xveREV4oB-0Hf5o _r4rd1pvwyrpi7sw4a3hzmw8e51yh9td
TXT	_dmarc.google.com	v=DMARC1; p=reject; rua=mailto:mailauth-reports@google.com
CAA	google.com	0 issue "pki.goog"
DS	google.com	—

Fix priorities

Sorted by risk: severity first, confirmed issues before hardening gaps, then effort and score impact.

1HighHSTS — enforce encryption in the browserHardening gap+8
2HighHTTP → HTTPS redirectHardening gap+7
3MediumClickjacking protectionHardening gap+5
4MediumDNSSEC — signed DNS recordsHardening gap+7
5MediumCSP — protection from script injectionHardening gap+8
6LowX-Content-Type-OptionsHardening gap+4
7LowReferrer-PolicyHardening gap+3
8LowPermissions-PolicyHardening gap+2

To verify

Couldn't be confirmed from public data, so excluded from the score. Checking them clarifies your posture; it doesn't guarantee a score change.

DKIM — digital signature on email

Indicative alignment

Best-practice mapping of public findings to common frameworks. Passive scanning tests public configuration only; it doesn't prove compliance or a violation.

Google & Yahoo sender rulesIncomplete evidence · 1 unverified
SPF, DKIM and DMARC are required for bulk senders to Gmail and Yahoo; missing them risks rejected or spam-foldered mail.
PCI DSS v4.04 observed gaps
TLS, certificate and browser-header protections relate to PCI DSS v4.0 requirements 4.2 and 6.4 for payment pages.
HTTP → HTTPS redirect HSTS — enforce encryption in the browser CSP — protection from script injection Clickjacking protection
NIS2 / vendor due diligence2 observed gaps
Vendor risk reviews under NIS2/DORA and cyber-insurance questionnaires check these public signals.
HSTS — enforce encryption in the browser DNSSEC — signed DNS records
SOC 2 / ISO 27001 baseline4 observed gaps
Baseline external hygiene commonly expected in SOC 2 and ISO 27001 audits.
HSTS — enforce encryption in the browser CSP — protection from script injection Clickjacking protection X-Content-Type-Options

Indicative alignment only, based on public configuration. It doesn't establish whether a framework applies to you, and it isn't legal advice, an audit or a certification.

Head-to-head vs competitor

How do you stack up against competitors?

The check reads public data only and makes no changes to the domain. Recommendations are intended for the domain owner.

Is your domain as secure? Scan it free, no sign-up

All pre-scanned domains

google.com

Critical findings in the observed public configuration. Some basic protections were not detected.

Partial coverage: the score is based on 95% of applicable check weight. 1 unverified check(s) are excluded, not counted as failures.

2026-11-15 18:14 UTC

Useful for your IT provider or a colleague. Anyone with the link can view the report.

What to do first

Tell browsers to always use the secure version

Helps browsers use HTTPS on future visits after they have received the policy.

Who can fix it: Your web host

How to verify after the fix

curl -sIL https://google.com/ | grep -i "Strict-Transport-Security"

Limit what scripts your pages are allowed to run

This adds one layer of protection against injected scripts.

Who can fix it: Your website developer or web host

How to verify after the fix

curl -sIL https://google.com/ | grep -i "Content-Security-Policy"

What this grade means

Tested hostname

google.com

Website request

GET https://google.com/ → https://www.google.com/sorry/index?continue=https://google.com/&q=EgSinlZ8GKPt59cGIilRQlVxo0FUEvBx2sjAoMnpFQcFtNcovmb6K_qRG5nbxCJVsXrfREkR0zICclJaAUNgmtHSuOODiqk4

Scan time

2026-11-15 18:14:58 UTC

Grading method

Version 2How grading works

Unverified or excluded checks

DKIM — digital signature on email · Not detected (common selectors only)

Technical detail

Click a check to see the public data, a verification command, a safe fix recommendation and documentation sources.

Email security

24/25

Encryption & certificate

18/25

Browser protections

0/30

DNS infrastructure

8/15

Public DNS records

A	google.com	142.251.127.139 142.251.127.101 142.251.127.138 142.251.127.102 142.251.127.100 142.251.127.113
AAAA	google.com	2a00:1450:4001:c0f::66 2a00:1450:4001:c0f::8a 2a00:1450:4001:c0f::64 2a00:1450:4001:c0f::8b
MX	google.com	10 smtp.google.com
NS	google.com	ns4.google.com ns1.google.com ns2.google.com ns3.google.com
TXT	google.com	MS=E4A68B9AB2BB9670BCE15412F62916164C0B20BB onetrust-domain-verification=0d477fe608074e6f9c12bca7826035cc v=spf1 include:_spf.google.com ~all work-accounts-domain-verification=Tcj6JjIMZOw2KsSEw2Nt2rLae89tN6 arcules-domain-verification=2R4t5G7nI6tRCo61lpxxbLksPYstxhGmtV75cpr8x9K google-site-verification=4ibFUgB-wXLQ_S7vsXVomSTVamuOXBiVAzpR5IZ87D0 docusign=1b0a6754-49b1-4db5-8540-d2c12664b289 docusign=05958488-4752-4ef2-95eb-aa7ba8a3bd0e globalsign-smime-dv=CDYX+XFHUw2wml6/Gb8+59BsH31KzUr6c1l2BPvqKX8= cisco-ci-domain-verification=47c38bc8c4b74b7233e9053220c1bbe76bcc1cd33c7acf7acd36cd6a5332004b apple-domain-verification=30afIBcvSuDV2PLX facebook-domain-verification=22rm551cu4k0ab0bxsw536tlds4h95 google-site-verification=TV9-DBe4R80X4v0M4U_bd_J9cpOJM0nikft0jAgjmsQ onetrust-domain-verification=6d685f1d41a94696ad7ef771f68993e0 Z29vZ2xl google-site-verification=wD8N7i1JTNTkezJ49swvWW48f8_9xveREV4oB-0Hf5o _r4rd1pvwyrpi7sw4a3hzmw8e51yh9td
TXT	_dmarc.google.com	v=DMARC1; p=reject; rua=mailto:mailauth-reports@google.com
CAA	google.com	0 issue "pki.goog"
DS	google.com	—

Indicative alignment

Best-practice mapping of public findings to common frameworks. Passive scanning tests public configuration only; it doesn't prove compliance or a violation.

Google & Yahoo sender rulesIncomplete evidence · 1 unverified

SPF, DKIM and DMARC are required for bulk senders to Gmail and Yahoo; missing them risks rejected or spam-foldered mail.

PCI DSS v4.04 observed gaps

TLS, certificate and browser-header protections relate to PCI DSS v4.0 requirements 4.2 and 6.4 for payment pages.

HTTP → HTTPS redirect HSTS — enforce encryption in the browser CSP — protection from script injection Clickjacking protection

NIS2 / vendor due diligence2 observed gaps

Vendor risk reviews under NIS2/DORA and cyber-insurance questionnaires check these public signals.

HSTS — enforce encryption in the browser DNSSEC — signed DNS records

SOC 2 / ISO 27001 baseline4 observed gaps

Baseline external hygiene commonly expected in SOC 2 and ISO 27001 audits.

HSTS — enforce encryption in the browser CSP — protection from script injection Clickjacking protection X-Content-Type-Options

Indicative alignment only, based on public configuration. It doesn't establish whether a framework applies to you, and it isn't legal advice, an audit or a certification.

google.com

Track your progress

Help someone else check their domain

What to do first

What this grade means

Get the badge

Scan history

AI fix plan

Scans to analyze

Technical detail

Email security

Encryption & certificate

Browser protections

DNS infrastructure

Public DNS records

Is your domain as secure? Scan it free, no sign-up

google.com

Track your progress

Help someone else check their domain

What to do first

What this grade means

Get the badge

Scan history

AI fix plan

Scans to analyze

Technical detail

Email security

Encryption & certificate

Browser protections

DNS infrastructure

Public DNS records

Is your domain as secure? Scan it free, no sign-up

Agent access & discovery signals