Automated public DNS and web checks; results may be incomplete. These are passive observations, not an assessment of the organization.

D63/100

Executive summary

microsoft.com

High exposure. Significant weaknesses put the brand, customers and email at risk.

Full coverage: every applicable check was assessed.

2026-11-15 18:15 UTC

Print report / PDF

Useful for your IT provider or a colleague. Anyone with the link can view the report.

Track your progress

Fix the findings, then come back and rescan. Your scan history is saved in this browser so you can see exactly what improved.

Email security30/30

Good

Spoofing email from this domain is hard.

Encryption & certificate25/25

Good

Traffic to the site is encrypted and the certificate is valid.

Browser protections0/30

Critical

Several browser hardening headers are missing, which removes layers of protection against script injection and framing.

DNS infrastructure8/15

Needs attention

The domain's infrastructure works, but recommended hardening is missing.

Help someone else check their domain

Share this public report with a colleague. They can review the evidence and check their own domain.

Get the report badge

What to do first

1.
Tell browsers to always use the secure version
Helps browsers use HTTPS on future visits after they have received the policy.
Who can fix it: Your web host
How to verify after the fix
```
curl -sIL https://microsoft.com/ | grep -i "Strict-Transport-Security"
```
2.
Limit what scripts your pages are allowed to run
This adds one layer of protection against injected scripts.
Who can fix it: Your website developer or web host
How to verify after the fix
```
curl -sIL https://microsoft.com/ | grep -i "Content-Security-Policy"
```

A starting point, not a security guarantee.

What this grade means

Tested hostname: microsoft.com
Website request: GET https://microsoft.com/ → https://www.microsoft.com/
Scan time: 2026-11-15 18:15:45 UTC
Grading method: Version 2How grading works
Unverified or excluded checks: None. Every applicable check was assessed.

This is a snapshot of the public configuration checks listed in this report. It does not verify the site's owner, business legitimacy, application security, or absence of vulnerabilities. It is not a security certification.

Get the badge

Show the live grade for microsoft.com in a README, docs or site footer. The badge links to the public report and refreshes every 24 hours.

Scan shown on this page: ⁦2026-11-15 18:15:45 UTC⁩. The badge may display a cached result for up to 24 hours. Open the linked report to check its scan time.

Markdown

[![Domain Armor grade](https://getmirror.online/badge/microsoft.com.svg)](https://getmirror.online/report/microsoft.com)

HTML

<a href="https://getmirror.online/report/microsoft.com"><img src="https://getmirror.online/badge/microsoft.com.svg" alt="Domain Armor grade"></a>

Badge URL

https://getmirror.online/badge/microsoft.com.svg

Scan history

AI fix plan

Pick scans from this browser's history. The AI compares them, explains what changed and builds a prioritized, step-by-step plan.

Scans to analyze

0 of 6 selected

D63/10011/15/26, 06:15 PMCurrent

The current scan is always included.

AI-generated from your scan results only. Review each step before applying it; nothing is sent to or changed on the domain.

Technical detail

Click a check to see the public data, a verification command, a safe fix recommendation and documentation sources.

Email security

30/30

Encryption & certificate

25/25

Browser protections

0/30

DNS infrastructure

8/15

Public DNS records

A	microsoft.com	150.171.110.145
AAAA	microsoft.com	2603:1061:14:96::1
MX	microsoft.com	10 microsoft-com.mail.protection.outlook.com
NS	microsoft.com	ns1-39.azure-dns.com ns2-39.azure-dns.net ns3-39.azure-dns.org ns4-39.azure-dns.info
TXT	microsoft.com	d365mktkey=3uc1cf82cpv750lzk70v9bvf2 facebook-domain-verification=fwzwhbbzwmg5fzgotc2go51olc3566 google-site-verification=pjPOauSPcrfXOZS9jnPPa5axowcHGCDAl1_86dCqFpk fg2t0gov9424p2tdcuo94goe9j t7sebee51jrj7vm932k531hipa google-site-verification=M--CVfn_YwsV-2FGbCp_HFaEj23BmT0cTF4l8hXgpvM google-site-verification=GfDnTUdATPsK1230J0mXbfsYw-3A9BVMVaKSd4DcKgI d365mktkey=SxDf1EZxLvMwx6eEZUxzjFFgHoapF8DvtWEUjwq7ZTwx hubspot-developer-verification=OTQ5NGIwYWEtODNmZi00YWE1LTkyNmQtNDhjMDMxY2JjNDAx d365mktkey=QDa792dLCZhvaAOOCe2Hz6WTzmTssOp1snABhxWibhMx d365mktkey=6358r1b7e13hox60tl1uagv14 google-site-verification=uFg3wr5PWsK8lV029RoXXBBUW0_E6qf1WEWVHhetkOY docusign=d5a3737c-c23c-4bd0-9095-d2ff621f2840 d365mktkey=j2qHWq9BHdaa3ZXZH8x64daJZxEWsFa0dxDeilxDoYYx atlassian-domain-verification=xvoaqRfxSg3PnlVnR4xCSOlKyw1Aln0MMxRiKXnwWroFG7vI76TUC8xYb03MwMXv workplace-domain-verification=lK0QDLk73xymCYMKUXNpfKAT8TY5Mx google-site-verification=uhh5_jbxpcQgnb-A7gDIjlrr5Ef34lA2t2_BAveYpnk MS=ms79629062 d365mktkey=3l6dste9txazu0Qd2zu4135PUB4E35txLxyzJxjkPbsx d365mktkey=wbU64GRacxVEQxwcLSQnx0zisXLYzgUbfvsufIqO9ZUx linear-domain-verification=iuq6saifcnbe d365mktkey=ZGFU0tlXPekPusNHPo5QQQWpVf0gic0xpuKroNy3NQEx d365mktkey=JlXV17lfZjyvWxNje1qiP390ACSKzTxo5mGqZ3V2BmYx d365mktkey=PNcDqkW71x8VOUhcE96aGM4l5PYX1gnlRl6ieXUl5eMx d365mktkey=Fu49WtSTeClkHtK7S14227RIVpGwwGrzEsO6RVs1I2Ax ms-domain-verification=25524f4b-1476-489c-a086-30f4c5016ecc ms-domain-verification=1c4e4677-e58f-4117-8d61-e5b2810388c2 mixpanel-domain-verify=5803bc4c-5bb6-4ce1-8076-753800097373 sitecore-domain-verification=1d46cb5467624e33a408d14324874088 ms-domain-verification=478640ad-6524-43d5-86c4-a914804b9e93 ms-domain-verification=561512fc-b4ba-4ac7-a946-e464c8f49f1b _zx2p8gpzv720db2aqmozy4jhwk2nl43 airtable-verification=79a09e4a8013ff5737798ffb4ea88eee 1password-site-verification=35ZTURTFFFDC5BW7GFQKRJ77QM d365mktkey=8fEQahTresJms7tZGxGFr94T1zDz36oCbUt1LJc99mox d365mktkey=heYmJ57sWrwMjCgIG1xRwTREJrQokUIDtBcNfGuxoWQx ms-domain-verification=d6545068-89f7-4432-b947-0b137e8a9fe3 hcp-domain-verification=3ce174a8b9fba88909633ab13eb1d81ce0123454745d66e500052ed84b7248a1 v=MCPv1; k=ecdsap384; p=As/XxnDWZFxFwHvRZj+HbG5/ImtAeabLkiOWu1h7wCJQFAR216E9HoYQ5Hy6o7StoQ== v=MCPv1; k=ecdsap384; p=AoHTKEi2W8L2P8cf9CoDicIxYiuttTkwtIeFOqYCewBGoRZiiF+9/92saUkIDERGAA== ms-domain-verification=65f91178-9dfb-41cd-929d-08d1a38ed607 v=MCPv1; k=ecdsap384; p=Asc8WWov6gsmCCzn4CSrwRuJIh5SqvaitKz/LlTW+SD54lLC52wzcnWhlTI416p2vw== liveramp-site-verification=kxcV8fDH_FUNUZQEcAO6lwgim47f_hNLgMP4VG0PF_Q v=MCPv1; k=ecdsap384; p=AqXeTHJ/1FCYeuvJ8dc1B+X3uHaa7m2W0s31vzL4opnrJlSaBdtbWTY8Ti5WiZnu9Q== v=MCPv1; k=ecdsap384; p=An4mJIFLRys9h1EvjX18SJs5p1uEF5MHcs2JJLYPrI48C5Qt9FpaZEM0sQTV4JvNYw== v=MCPv1; k=ecdsap384; p=A/Mf6IKdZzcHfBvpiVz9rkdPTIcCP5IbRDdEkeP3PgXEXF3mNjorahOwaYlMINBF5A== v=MCPv1; k=ecdsap384; p=A8qndBCDJGtFF2+3v/IPIMmM0SaVcrJBoSue7rKob6sUeK7QGeFuWkrtvze3AiqUDA== zoom-domain-verification=ZOOM_verify_e97a3d385acb4c47b9b924609a280524 anthropic-domain-verification-phksss=GZrrKDUR4klRLFCvxyOvqcNGE v=MCPv1; k=ecdsap384; p=Azw9+u4M8RoH+bxJidKAZzGDmsPkzY1N4cO7rB/uC5x1RBoNfMyBlH/ott0lpo4pOQ== dobtdihqagnr18hea8uv1h1mvq atlassian-domain-verification=Sn5AwyIdVgkaRaJA/IKj7ZFMnWeCBnppa9bXGLuJvsakRHH4lYoBxS8g7GVlud9M openai-domain-verification=dv-sFtCvKOlWoe31gpoSvs7cqsP hpe-greenlake-domain-verification=495143304a3330533363357a57684f6335556f316f55654675523541464d3954 v=MCPv1; k=ecdsap384; p=A5JeyhIFWFj4/epHJwt29GRUSrFwGSwXhrhDMAUSklMhfXjI7gi/ekY/fQSWToZdCw== v=MCPv1; k=ecdsap384; p=A/78JIxAOlNwq8f0T/l50w7zhwQFpEuB8/Jz9CafdXNX7ewOluYpS/EEcSmLgxsHXg== docker-verification=b912d2f3-8614-4591-962b-9e07dbf7c047 _ij59qjkrntjw3gpjplj3or17mo3xxvt google-site-verification=jwrHU99GU8HSXlRFeywLDZmVawD2DWVCebQ41shKK0M v=spf1 include:_spf-a.microsoft.com include:_spf-b.microsoft.com include:_spf-ssg-a.msft.net include:_spf1-meo.microsoft.com -all google-gws-recovery-domain-verification=77163048 google-gws-recovery-domain-verification=77417634
TXT	_dmarc.microsoft.com	v=DMARC1; p=reject; pct=100; rua=mailto:itex-rua@microsoft.com; ruf=mailto:itex-ruf@microsoft.com; fo=1
CAA	microsoft.com	0 contactemail "caarecordaware@microsoft.com"
DS	microsoft.com	—

Fix priorities

Sorted by risk: severity first, confirmed issues before hardening gaps, then effort and score impact.

1HighHSTS — enforce encryption in the browserHardening gap+8
2MediumClickjacking protectionHardening gap+5
3MediumDNSSEC — signed DNS recordsHardening gap+7
4MediumCSP — protection from script injectionHardening gap+8
5LowX-Content-Type-OptionsHardening gap+4
6LowReferrer-PolicyHardening gap+3
7LowPermissions-PolicyHardening gap+2

Indicative alignment

Best-practice mapping of public findings to common frameworks. Passive scanning tests public configuration only; it doesn't prove compliance or a violation.

Google & Yahoo sender rulesNo gaps observed
SPF, DKIM and DMARC are required for bulk senders to Gmail and Yahoo; missing them risks rejected or spam-foldered mail.
PCI DSS v4.03 observed gaps
TLS, certificate and browser-header protections relate to PCI DSS v4.0 requirements 4.2 and 6.4 for payment pages.
HSTS — enforce encryption in the browser CSP — protection from script injection Clickjacking protection
NIS2 / vendor due diligence2 observed gaps
Vendor risk reviews under NIS2/DORA and cyber-insurance questionnaires check these public signals.
HSTS — enforce encryption in the browser DNSSEC — signed DNS records
SOC 2 / ISO 27001 baseline4 observed gaps
Baseline external hygiene commonly expected in SOC 2 and ISO 27001 audits.
HSTS — enforce encryption in the browser CSP — protection from script injection Clickjacking protection X-Content-Type-Options

Indicative alignment only, based on public configuration. It doesn't establish whether a framework applies to you, and it isn't legal advice, an audit or a certification.

Head-to-head vs competitor

How do you stack up against competitors?

The check reads public data only and makes no changes to the domain. Recommendations are intended for the domain owner.

Is your domain as secure? Scan it free, no sign-up

All pre-scanned domains

What to do first

Tell browsers to always use the secure version

Helps browsers use HTTPS on future visits after they have received the policy.

Who can fix it: Your web host

How to verify after the fix

curl -sIL https://microsoft.com/ | grep -i "Strict-Transport-Security"

Limit what scripts your pages are allowed to run

This adds one layer of protection against injected scripts.

Who can fix it: Your website developer or web host

How to verify after the fix

curl -sIL https://microsoft.com/ | grep -i "Content-Security-Policy"

What this grade means

Tested hostname

microsoft.com

Website request

GET https://microsoft.com/ → https://www.microsoft.com/

Scan time

2026-11-15 18:15:45 UTC

Grading method

Version 2How grading works

Unverified or excluded checks

None. Every applicable check was assessed.

Technical detail

Click a check to see the public data, a verification command, a safe fix recommendation and documentation sources.

Email security

30/30

Encryption & certificate

25/25

Browser protections

0/30

DNS infrastructure

8/15

Public DNS records

A	microsoft.com	150.171.110.145
AAAA	microsoft.com	2603:1061:14:96::1
MX	microsoft.com	10 microsoft-com.mail.protection.outlook.com
NS	microsoft.com	ns1-39.azure-dns.com ns2-39.azure-dns.net ns3-39.azure-dns.org ns4-39.azure-dns.info
TXT	microsoft.com	d365mktkey=3uc1cf82cpv750lzk70v9bvf2 facebook-domain-verification=fwzwhbbzwmg5fzgotc2go51olc3566 google-site-verification=pjPOauSPcrfXOZS9jnPPa5axowcHGCDAl1_86dCqFpk fg2t0gov9424p2tdcuo94goe9j t7sebee51jrj7vm932k531hipa google-site-verification=M--CVfn_YwsV-2FGbCp_HFaEj23BmT0cTF4l8hXgpvM google-site-verification=GfDnTUdATPsK1230J0mXbfsYw-3A9BVMVaKSd4DcKgI d365mktkey=SxDf1EZxLvMwx6eEZUxzjFFgHoapF8DvtWEUjwq7ZTwx hubspot-developer-verification=OTQ5NGIwYWEtODNmZi00YWE1LTkyNmQtNDhjMDMxY2JjNDAx d365mktkey=QDa792dLCZhvaAOOCe2Hz6WTzmTssOp1snABhxWibhMx d365mktkey=6358r1b7e13hox60tl1uagv14 google-site-verification=uFg3wr5PWsK8lV029RoXXBBUW0_E6qf1WEWVHhetkOY docusign=d5a3737c-c23c-4bd0-9095-d2ff621f2840 d365mktkey=j2qHWq9BHdaa3ZXZH8x64daJZxEWsFa0dxDeilxDoYYx atlassian-domain-verification=xvoaqRfxSg3PnlVnR4xCSOlKyw1Aln0MMxRiKXnwWroFG7vI76TUC8xYb03MwMXv workplace-domain-verification=lK0QDLk73xymCYMKUXNpfKAT8TY5Mx google-site-verification=uhh5_jbxpcQgnb-A7gDIjlrr5Ef34lA2t2_BAveYpnk MS=ms79629062 d365mktkey=3l6dste9txazu0Qd2zu4135PUB4E35txLxyzJxjkPbsx d365mktkey=wbU64GRacxVEQxwcLSQnx0zisXLYzgUbfvsufIqO9ZUx linear-domain-verification=iuq6saifcnbe d365mktkey=ZGFU0tlXPekPusNHPo5QQQWpVf0gic0xpuKroNy3NQEx d365mktkey=JlXV17lfZjyvWxNje1qiP390ACSKzTxo5mGqZ3V2BmYx d365mktkey=PNcDqkW71x8VOUhcE96aGM4l5PYX1gnlRl6ieXUl5eMx d365mktkey=Fu49WtSTeClkHtK7S14227RIVpGwwGrzEsO6RVs1I2Ax ms-domain-verification=25524f4b-1476-489c-a086-30f4c5016ecc ms-domain-verification=1c4e4677-e58f-4117-8d61-e5b2810388c2 mixpanel-domain-verify=5803bc4c-5bb6-4ce1-8076-753800097373 sitecore-domain-verification=1d46cb5467624e33a408d14324874088 ms-domain-verification=478640ad-6524-43d5-86c4-a914804b9e93 ms-domain-verification=561512fc-b4ba-4ac7-a946-e464c8f49f1b _zx2p8gpzv720db2aqmozy4jhwk2nl43 airtable-verification=79a09e4a8013ff5737798ffb4ea88eee 1password-site-verification=35ZTURTFFFDC5BW7GFQKRJ77QM d365mktkey=8fEQahTresJms7tZGxGFr94T1zDz36oCbUt1LJc99mox d365mktkey=heYmJ57sWrwMjCgIG1xRwTREJrQokUIDtBcNfGuxoWQx ms-domain-verification=d6545068-89f7-4432-b947-0b137e8a9fe3 hcp-domain-verification=3ce174a8b9fba88909633ab13eb1d81ce0123454745d66e500052ed84b7248a1 v=MCPv1; k=ecdsap384; p=As/XxnDWZFxFwHvRZj+HbG5/ImtAeabLkiOWu1h7wCJQFAR216E9HoYQ5Hy6o7StoQ== v=MCPv1; k=ecdsap384; p=AoHTKEi2W8L2P8cf9CoDicIxYiuttTkwtIeFOqYCewBGoRZiiF+9/92saUkIDERGAA== ms-domain-verification=65f91178-9dfb-41cd-929d-08d1a38ed607 v=MCPv1; k=ecdsap384; p=Asc8WWov6gsmCCzn4CSrwRuJIh5SqvaitKz/LlTW+SD54lLC52wzcnWhlTI416p2vw== liveramp-site-verification=kxcV8fDH_FUNUZQEcAO6lwgim47f_hNLgMP4VG0PF_Q v=MCPv1; k=ecdsap384; p=AqXeTHJ/1FCYeuvJ8dc1B+X3uHaa7m2W0s31vzL4opnrJlSaBdtbWTY8Ti5WiZnu9Q== v=MCPv1; k=ecdsap384; p=An4mJIFLRys9h1EvjX18SJs5p1uEF5MHcs2JJLYPrI48C5Qt9FpaZEM0sQTV4JvNYw== v=MCPv1; k=ecdsap384; p=A/Mf6IKdZzcHfBvpiVz9rkdPTIcCP5IbRDdEkeP3PgXEXF3mNjorahOwaYlMINBF5A== v=MCPv1; k=ecdsap384; p=A8qndBCDJGtFF2+3v/IPIMmM0SaVcrJBoSue7rKob6sUeK7QGeFuWkrtvze3AiqUDA== zoom-domain-verification=ZOOM_verify_e97a3d385acb4c47b9b924609a280524 anthropic-domain-verification-phksss=GZrrKDUR4klRLFCvxyOvqcNGE v=MCPv1; k=ecdsap384; p=Azw9+u4M8RoH+bxJidKAZzGDmsPkzY1N4cO7rB/uC5x1RBoNfMyBlH/ott0lpo4pOQ== dobtdihqagnr18hea8uv1h1mvq atlassian-domain-verification=Sn5AwyIdVgkaRaJA/IKj7ZFMnWeCBnppa9bXGLuJvsakRHH4lYoBxS8g7GVlud9M openai-domain-verification=dv-sFtCvKOlWoe31gpoSvs7cqsP hpe-greenlake-domain-verification=495143304a3330533363357a57684f6335556f316f55654675523541464d3954 v=MCPv1; k=ecdsap384; p=A5JeyhIFWFj4/epHJwt29GRUSrFwGSwXhrhDMAUSklMhfXjI7gi/ekY/fQSWToZdCw== v=MCPv1; k=ecdsap384; p=A/78JIxAOlNwq8f0T/l50w7zhwQFpEuB8/Jz9CafdXNX7ewOluYpS/EEcSmLgxsHXg== docker-verification=b912d2f3-8614-4591-962b-9e07dbf7c047 _ij59qjkrntjw3gpjplj3or17mo3xxvt google-site-verification=jwrHU99GU8HSXlRFeywLDZmVawD2DWVCebQ41shKK0M v=spf1 include:_spf-a.microsoft.com include:_spf-b.microsoft.com include:_spf-ssg-a.msft.net include:_spf1-meo.microsoft.com -all google-gws-recovery-domain-verification=77163048 google-gws-recovery-domain-verification=77417634
TXT	_dmarc.microsoft.com	v=DMARC1; p=reject; pct=100; rua=mailto:itex-rua@microsoft.com; ruf=mailto:itex-ruf@microsoft.com; fo=1
CAA	microsoft.com	0 contactemail "caarecordaware@microsoft.com"
DS	microsoft.com	—

Indicative alignment

Best-practice mapping of public findings to common frameworks. Passive scanning tests public configuration only; it doesn't prove compliance or a violation.

Google & Yahoo sender rulesNo gaps observed

SPF, DKIM and DMARC are required for bulk senders to Gmail and Yahoo; missing them risks rejected or spam-foldered mail.

PCI DSS v4.03 observed gaps

TLS, certificate and browser-header protections relate to PCI DSS v4.0 requirements 4.2 and 6.4 for payment pages.

HSTS — enforce encryption in the browser CSP — protection from script injection Clickjacking protection

NIS2 / vendor due diligence2 observed gaps

Vendor risk reviews under NIS2/DORA and cyber-insurance questionnaires check these public signals.

HSTS — enforce encryption in the browser DNSSEC — signed DNS records

SOC 2 / ISO 27001 baseline4 observed gaps

Baseline external hygiene commonly expected in SOC 2 and ISO 27001 audits.

HSTS — enforce encryption in the browser CSP — protection from script injection Clickjacking protection X-Content-Type-Options

Indicative alignment only, based on public configuration. It doesn't establish whether a framework applies to you, and it isn't legal advice, an audit or a certification.

microsoft.com

Track your progress

Help someone else check their domain

What to do first

What this grade means

Get the badge

Scan history

AI fix plan

Scans to analyze

Technical detail

Email security

Encryption & certificate

Browser protections

DNS infrastructure

Public DNS records

Is your domain as secure? Scan it free, no sign-up

microsoft.com

Track your progress

Help someone else check their domain

What to do first

What this grade means

Get the badge

Scan history

AI fix plan

Scans to analyze

Technical detail

Email security

Encryption & certificate

Browser protections

DNS infrastructure

Public DNS records

Is your domain as secure? Scan it free, no sign-up

Agent access & discovery signals