Automated public DNS and web checks; results may be incomplete. These are passive observations, not an assessment of the organization.

D61/100

Executive summary

harvard.edu

High exposure. Significant weaknesses put the brand, customers and email at risk.

Full coverage: every applicable check was assessed.

2026-11-15 18:29 UTC

Print report / PDF

Useful for your IT provider or a colleague. Anyone with the link can view the report.

Track your progress

Fix the findings, then come back and rescan. Your scan history is saved in this browser so you can see exactly what improved.

Email security26/30

Good

Spoofing email from this domain is hard.

Encryption & certificate25/25

Good

Traffic to the site is encrypted and the certificate is valid.

Browser protections0/30

Critical

Several browser hardening headers are missing, which removes layers of protection against script injection and framing.

DNS infrastructure10/15

Needs attention

The domain's infrastructure works, but recommended hardening is missing.

Help someone else check their domain

Share this public report with a colleague. They can review the evidence and check their own domain.

Get the report badge

What to do first

1.
Tell browsers to always use the secure version
Helps browsers use HTTPS on future visits after they have received the policy.
Who can fix it: Your web host
How to verify after the fix
```
curl -sIL https://harvard.edu/ | grep -i "Strict-Transport-Security"
```
2.
Limit what scripts your pages are allowed to run
This adds one layer of protection against injected scripts.
Who can fix it: Your website developer or web host
How to verify after the fix
```
curl -sIL https://harvard.edu/ | grep -i "Content-Security-Policy"
```

A starting point, not a security guarantee.

What this grade means

Tested hostname: harvard.edu
Website request: GET https://harvard.edu/ → https://www.harvard.edu/
Scan time: 2026-11-15 18:29:30 UTC
Grading method: Version 2How grading works
Unverified or excluded checks: None. Every applicable check was assessed.

This is a snapshot of the public configuration checks listed in this report. It does not verify the site's owner, business legitimacy, application security, or absence of vulnerabilities. It is not a security certification.

Get the badge

Show the live grade for harvard.edu in a README, docs or site footer. The badge links to the public report and refreshes every 24 hours.

Scan shown on this page: ⁦2026-11-15 18:29:30 UTC⁩. The badge may display a cached result for up to 24 hours. Open the linked report to check its scan time.

Markdown

[![Domain Armor grade](https://getmirror.online/badge/harvard.edu.svg)](https://getmirror.online/report/harvard.edu)

HTML

<a href="https://getmirror.online/report/harvard.edu"><img src="https://getmirror.online/badge/harvard.edu.svg" alt="Domain Armor grade"></a>

Badge URL

https://getmirror.online/badge/harvard.edu.svg

Scan history

AI fix plan

Pick scans from this browser's history. The AI compares them, explains what changed and builds a prioritized, step-by-step plan.

Scans to analyze

0 of 6 selected

D61/10011/15/26, 06:29 PMCurrent

The current scan is always included.

AI-generated from your scan results only. Review each step before applying it; nothing is sent to or changed on the domain.

Technical detail

Click a check to see the public data, a verification command, a safe fix recommendation and documentation sources.

Email security

26/30

Encryption & certificate

25/25

Browser protections

0/30

DNS infrastructure

10/15

Public DNS records

A	harvard.edu	192.0.66.20
AAAA	harvard.edu	—
MX	harvard.edu	100 mx0a-00171101.pphosted.com 100 mx0b-00171101.pphosted.com
NS	harvard.edu	a6-66.akam.net a7-65.akam.net a1-171.akam.net a10-66.akam.net a11-67.akam.net a16-64.akam.net
TXT	harvard.edu	MS=ms35192554 _hyz89h4dzuordjnlhz6kkyujqcd9smf brevo-code:30d9f789747b4c124f72dabf24a0a97f status-page-domain-verification=b4j4g69th3vv status-page-domain-verification=p83gt91wpxms fastly-domain-delgation-vdnblsdg768nm-21052021 airtable-verification=8b8110e9283dd87d57b3c5f2f5af2db1 airtable-verification=a92cef30671587a4f6deb7951c1c3f1a airtable-verification=b25f432db3cbc5bfc481914364b6ce41 openai-domain-verification=dv-5z82SztO32q9YBNgFooNBz5v openai-domain-verification=dv-e8vYSnmmPbWxpNte1iIKgvOO geneious.com:domain-verification=1781B6exIEsRBzJ0KzPtKg cloudflare_dashboard_sso=ef2b950ccd264aba96ddef41e3cf3475 smartsheet-site-validation=jfLh_IkQNJXuKKpTn7RydwiiaAOLy4CR anthropic-domain-verification-dprfjc=K9LyiFV7zLafnNLNO4lFjyaRx anthropic-domain-verification-gy5zhc=zmrGT2kyyc2HlnUn6f0utkQB6 globalsign-domain-verification=1C94E0FFAAE95796F597427644D90C03 globalsign-domain-verification=1DDF777ED1ADF45E5FFAFFAAD6774180 globalsign-domain-verification=5A1F4E0081852ECB9015E837384121AD globalsign-domain-verification=87677a19ae97bfbeec25ff1510a80420 globalsign-domain-verification=9ff12eafbeebb02a0f2b0383aef9d1fa globalsign-domain-verification=B8359DCEFBCF837B95E2F82282E4297A globalsign-domain-verification=C44DEEAC45AB4DC2B5AD0B9B2E5D5803 globalsign-domain-verification=dcc2e5d0d67efc32044ae679c7cf19e6 google-site-verification=DZTZhbBaYJ6AO5j-tHFYBdkwryNywFh2gMUeg3SRDSg google-site-verification=DzhZyP8pu0M1-RFghfTcSN-9poidboYRNdfn2Rf2hCQ google-site-verification=MmfJS0BjLRgcxrlj8kAyNdToKeAmj0fKb-lPOnd5Pmo google-site-verification=NEWpTHNZnWRWN3trkIMeFbuPVG3ExwOXUHlC9aJ2sks google-site-verification=lY-T8NneGQX1RGXeaoBJjSmT_lx3dLRKDq1xY44ZI5w google-site-verification=pWvLuNePLYxAbafZw2a95vnBhvcj12DzM9NulT9ujSY google-site-verification=xXWxVElKH8ek_eW45CbAqVSMTQgAqLYUNQUrWpOmkrY google-site-verification=xqg8LPF_v_QMEIST789q8xhRDqUEX4_8lQjAvV6YykY heroku-domain-verification=1qfmzz9vp3kexf4fr5zuliwvpieih2ffz4gexo7tlh4 mgverify=45e7fcf3ed36156afa50e8dd90aa36e82af6f11b95e35537b03ecebd434b328a pardot378242=7001579db574e062735763ba81b54da111abc31facf16bbfa653ab6b8a770988 pardot679353=3cc5e124c5020a1e160f01981f45be33a467a1c802711e0e5654184ef56d18c9 pardot679353=f93ea3588d69483bf48dbf587511f51d43ddadaae52b8bac6856c8428559a06d pardot962443=9098884472c5cb29a2e20700b41411cb4aa5ebcf340360e71b2cd8464d8864b6 pardot_378242_*=8b485d5cd9114869cff8f307da5fa9287434ebec11621d88c07ce97a7fee06e0 v=spf1 include:%{i}._ip.%{h}._ehlo.%{d}._spf.vali.email include:spf.mailjet.com ~all Peh2GHoW8uiAzwS9tTZKlGBn9cMq6Y+XUFtrqmLtqFh1WvloPkzGczPsZcSdDfin4hZ7QiL9J7SM8yr7Yyzi8w== jAykGnWytyLeBseMa8x2/MBve6/yQqana4yrAc1ROoei7uZHUkM2FU0Xx4qI/rm+kOGdImZdoq0fdodgLEw1dg== xIGeuA0e5B1BOjTE4IBO806ziFX9G1m2dVJ8zO7CMkmKwZ6MEkMXC0P7n5SRCGOdS9jbceH/7gKYgD4h9FBGKA== ciscocidomainverification=41ce9827e3fbbca9ce75d5dbb5a6bc7b089dc4e239c1b56ba828216d1214480 adobe-idp-site-verification=66e813947c764d98330002232f383a68df8ad609065abb9482f3805dd2a1902c atlassian-domain-verification=ASRKBXyOafZgDCRWh1Ylv34hiOSMgAIoNXs8H57rR3aTkuOD5KwJfUN9G3f7Ah/H atlassian-domain-verification=OYfkFwspEELRW6A32BsDVWgvdz8/pLBxVcq7s/mHLBVGqRQRG58XA5LRtDAGpfA7 atlassian-domain-verification=Z8oUd5brL6/RGUMCkxs4U0P/RyhpiNJEIVx9HXJLr3uqEQ1eDmTnj1eq1ObCgY1i
TXT	_dmarc.harvard.edu	v=DMARC1; p=quarantine; sp=none; pct=100; adkim=r; aspf=r; rua=mailto:dmarc_agg@vali.email
CAA	harvard.edu	—
DS	harvard.edu	23262 13 2 715cbed751ded62ec74d446c91bbe30deb6b09b03b2d66a512247e0e43d755cb

Fix priorities

Sorted by risk: severity first, confirmed issues before hardening gaps, then effort and score impact.

1HighHSTS — enforce encryption in the browserHardening gap+8
2MediumClickjacking protectionHardening gap+5
3MediumCSP — protection from script injectionHardening gap+8
4LowCAA — who may issue certificatesHardening gap+5
5LowX-Content-Type-OptionsHardening gap+4
6LowDMARC — anti-spoofing policyHardening gap+3
7LowReferrer-PolicyHardening gap+3
8LowPermissions-PolicyHardening gap+2

Indicative alignment

Best-practice mapping of public findings to common frameworks. Passive scanning tests public configuration only; it doesn't prove compliance or a violation.

Google & Yahoo sender rules1 observed gaps
SPF, DKIM and DMARC are required for bulk senders to Gmail and Yahoo; missing them risks rejected or spam-foldered mail.
DMARC — anti-spoofing policy
PCI DSS v4.03 observed gaps
TLS, certificate and browser-header protections relate to PCI DSS v4.0 requirements 4.2 and 6.4 for payment pages.
HSTS — enforce encryption in the browser CSP — protection from script injection Clickjacking protection
NIS2 / vendor due diligence3 observed gaps
Vendor risk reviews under NIS2/DORA and cyber-insurance questionnaires check these public signals.
DMARC — anti-spoofing policy HSTS — enforce encryption in the browser CAA — who may issue certificates
SOC 2 / ISO 27001 baseline5 observed gaps
Baseline external hygiene commonly expected in SOC 2 and ISO 27001 audits.
DMARC — anti-spoofing policy HSTS — enforce encryption in the browser CSP — protection from script injection Clickjacking protection X-Content-Type-Options

Indicative alignment only, based on public configuration. It doesn't establish whether a framework applies to you, and it isn't legal advice, an audit or a certification.

Head-to-head vs competitor

How do you stack up against competitors?

The check reads public data only and makes no changes to the domain. Recommendations are intended for the domain owner.

Is your domain as secure? Scan it free, no sign-up

All pre-scanned domains

What to do first

Tell browsers to always use the secure version

Helps browsers use HTTPS on future visits after they have received the policy.

Who can fix it: Your web host

How to verify after the fix

curl -sIL https://harvard.edu/ | grep -i "Strict-Transport-Security"

Limit what scripts your pages are allowed to run

This adds one layer of protection against injected scripts.

Who can fix it: Your website developer or web host

How to verify after the fix

curl -sIL https://harvard.edu/ | grep -i "Content-Security-Policy"

What this grade means

Tested hostname

harvard.edu

Website request

GET https://harvard.edu/ → https://www.harvard.edu/

Scan time

2026-11-15 18:29:30 UTC

Grading method

Version 2How grading works

Unverified or excluded checks

None. Every applicable check was assessed.

Technical detail

Click a check to see the public data, a verification command, a safe fix recommendation and documentation sources.

Email security

26/30

Encryption & certificate

25/25

Browser protections

0/30

DNS infrastructure

10/15

Public DNS records

A	harvard.edu	192.0.66.20
AAAA	harvard.edu	—
MX	harvard.edu	100 mx0a-00171101.pphosted.com 100 mx0b-00171101.pphosted.com
NS	harvard.edu	a6-66.akam.net a7-65.akam.net a1-171.akam.net a10-66.akam.net a11-67.akam.net a16-64.akam.net
TXT	harvard.edu	MS=ms35192554 _hyz89h4dzuordjnlhz6kkyujqcd9smf brevo-code:30d9f789747b4c124f72dabf24a0a97f status-page-domain-verification=b4j4g69th3vv status-page-domain-verification=p83gt91wpxms fastly-domain-delgation-vdnblsdg768nm-21052021 airtable-verification=8b8110e9283dd87d57b3c5f2f5af2db1 airtable-verification=a92cef30671587a4f6deb7951c1c3f1a airtable-verification=b25f432db3cbc5bfc481914364b6ce41 openai-domain-verification=dv-5z82SztO32q9YBNgFooNBz5v openai-domain-verification=dv-e8vYSnmmPbWxpNte1iIKgvOO geneious.com:domain-verification=1781B6exIEsRBzJ0KzPtKg cloudflare_dashboard_sso=ef2b950ccd264aba96ddef41e3cf3475 smartsheet-site-validation=jfLh_IkQNJXuKKpTn7RydwiiaAOLy4CR anthropic-domain-verification-dprfjc=K9LyiFV7zLafnNLNO4lFjyaRx anthropic-domain-verification-gy5zhc=zmrGT2kyyc2HlnUn6f0utkQB6 globalsign-domain-verification=1C94E0FFAAE95796F597427644D90C03 globalsign-domain-verification=1DDF777ED1ADF45E5FFAFFAAD6774180 globalsign-domain-verification=5A1F4E0081852ECB9015E837384121AD globalsign-domain-verification=87677a19ae97bfbeec25ff1510a80420 globalsign-domain-verification=9ff12eafbeebb02a0f2b0383aef9d1fa globalsign-domain-verification=B8359DCEFBCF837B95E2F82282E4297A globalsign-domain-verification=C44DEEAC45AB4DC2B5AD0B9B2E5D5803 globalsign-domain-verification=dcc2e5d0d67efc32044ae679c7cf19e6 google-site-verification=DZTZhbBaYJ6AO5j-tHFYBdkwryNywFh2gMUeg3SRDSg google-site-verification=DzhZyP8pu0M1-RFghfTcSN-9poidboYRNdfn2Rf2hCQ google-site-verification=MmfJS0BjLRgcxrlj8kAyNdToKeAmj0fKb-lPOnd5Pmo google-site-verification=NEWpTHNZnWRWN3trkIMeFbuPVG3ExwOXUHlC9aJ2sks google-site-verification=lY-T8NneGQX1RGXeaoBJjSmT_lx3dLRKDq1xY44ZI5w google-site-verification=pWvLuNePLYxAbafZw2a95vnBhvcj12DzM9NulT9ujSY google-site-verification=xXWxVElKH8ek_eW45CbAqVSMTQgAqLYUNQUrWpOmkrY google-site-verification=xqg8LPF_v_QMEIST789q8xhRDqUEX4_8lQjAvV6YykY heroku-domain-verification=1qfmzz9vp3kexf4fr5zuliwvpieih2ffz4gexo7tlh4 mgverify=45e7fcf3ed36156afa50e8dd90aa36e82af6f11b95e35537b03ecebd434b328a pardot378242=7001579db574e062735763ba81b54da111abc31facf16bbfa653ab6b8a770988 pardot679353=3cc5e124c5020a1e160f01981f45be33a467a1c802711e0e5654184ef56d18c9 pardot679353=f93ea3588d69483bf48dbf587511f51d43ddadaae52b8bac6856c8428559a06d pardot962443=9098884472c5cb29a2e20700b41411cb4aa5ebcf340360e71b2cd8464d8864b6 pardot_378242_*=8b485d5cd9114869cff8f307da5fa9287434ebec11621d88c07ce97a7fee06e0 v=spf1 include:%{i}._ip.%{h}._ehlo.%{d}._spf.vali.email include:spf.mailjet.com ~all Peh2GHoW8uiAzwS9tTZKlGBn9cMq6Y+XUFtrqmLtqFh1WvloPkzGczPsZcSdDfin4hZ7QiL9J7SM8yr7Yyzi8w== jAykGnWytyLeBseMa8x2/MBve6/yQqana4yrAc1ROoei7uZHUkM2FU0Xx4qI/rm+kOGdImZdoq0fdodgLEw1dg== xIGeuA0e5B1BOjTE4IBO806ziFX9G1m2dVJ8zO7CMkmKwZ6MEkMXC0P7n5SRCGOdS9jbceH/7gKYgD4h9FBGKA== ciscocidomainverification=41ce9827e3fbbca9ce75d5dbb5a6bc7b089dc4e239c1b56ba828216d1214480 adobe-idp-site-verification=66e813947c764d98330002232f383a68df8ad609065abb9482f3805dd2a1902c atlassian-domain-verification=ASRKBXyOafZgDCRWh1Ylv34hiOSMgAIoNXs8H57rR3aTkuOD5KwJfUN9G3f7Ah/H atlassian-domain-verification=OYfkFwspEELRW6A32BsDVWgvdz8/pLBxVcq7s/mHLBVGqRQRG58XA5LRtDAGpfA7 atlassian-domain-verification=Z8oUd5brL6/RGUMCkxs4U0P/RyhpiNJEIVx9HXJLr3uqEQ1eDmTnj1eq1ObCgY1i
TXT	_dmarc.harvard.edu	v=DMARC1; p=quarantine; sp=none; pct=100; adkim=r; aspf=r; rua=mailto:dmarc_agg@vali.email
CAA	harvard.edu	—
DS	harvard.edu	23262 13 2 715cbed751ded62ec74d446c91bbe30deb6b09b03b2d66a512247e0e43d755cb

Indicative alignment

Best-practice mapping of public findings to common frameworks. Passive scanning tests public configuration only; it doesn't prove compliance or a violation.

Indicative alignment only, based on public configuration. It doesn't establish whether a framework applies to you, and it isn't legal advice, an audit or a certification.

harvard.edu

Track your progress

Help someone else check their domain

What to do first

What this grade means

Get the badge

Scan history

AI fix plan

Scans to analyze

Technical detail

Email security

Encryption & certificate

Browser protections

DNS infrastructure

Public DNS records

Is your domain as secure? Scan it free, no sign-up

harvard.edu

Track your progress

Help someone else check their domain

What to do first

What this grade means

Get the badge

Scan history

AI fix plan

Scans to analyze

Technical detail

Email security

Encryption & certificate

Browser protections

DNS infrastructure

Public DNS records

Is your domain as secure? Scan it free, no sign-up

Agent access & discovery signals