Automated public DNS and web checks; results may be incomplete. These are passive observations, not an assessment of the organization.

D69/100

Executive summary

morganstanley.com

High exposure. Significant weaknesses put the brand, customers and email at risk.

Partial coverage: the score is based on 95% of applicable check weight. 1 unverified check(s) are excluded, not counted as failures.

2026-11-15 18:20 UTC

Print report / PDF

Useful for your IT provider or a colleague. Anyone with the link can view the report.

Track your progress

Fix the findings, then come back and rescan. Your scan history is saved in this browser so you can see exactly what improved.

Email security24/25

Good83% coverage

Spoofing email from this domain is hard.

Encryption & certificate18/25

Needs attention

Encryption is in place, but a gap could expose users.

Browser protections21/30

Needs attention

Some browser protections are missing.

DNS infrastructure3/15

Critical

The domain's infrastructure lacks basic protections.

Help someone else check their domain

Share this public report with a colleague. They can review the evidence and check their own domain.

Get the report badge

What to do first

1.
Send visitors to the secure version of your site
Visitors who type your address without https may stay on an unprotected connection.
Who can fix it: Your web host
How to verify after the fix
```
curl -sI http://morganstanley.com/ | grep -iE "^(HTTP|location)"
```
2.
Turn on DNS signing for your domain
Signing helps resolvers detect forged answers about your domain.
Who can fix it: Your domain registrar or DNS provider
How to verify after the fix
```
dig +short DS morganstanley.com
```

A starting point, not a security guarantee.

What this grade means

Tested hostname: morganstanley.com
Website request: GET https://morganstanley.com/ → https://www.morganstanley.com/
Scan time: 2026-11-15 18:20:16 UTC
Grading method: Version 2How grading works
Unverified or excluded checks: DKIM — digital signature on email · Not detected (common selectors only)

This is a snapshot of the public configuration checks listed in this report. It does not verify the site's owner, business legitimacy, application security, or absence of vulnerabilities. It is not a security certification.

Get the badge

Show the live grade for morganstanley.com in a README, docs or site footer. The badge links to the public report and refreshes every 24 hours.

Scan shown on this page: ⁦2026-11-15 18:20:16 UTC⁩. The badge may display a cached result for up to 24 hours. Open the linked report to check its scan time.

Markdown

[![Domain Armor grade](https://getmirror.online/badge/morganstanley.com.svg)](https://getmirror.online/report/morganstanley.com)

HTML

<a href="https://getmirror.online/report/morganstanley.com"><img src="https://getmirror.online/badge/morganstanley.com.svg" alt="Domain Armor grade"></a>

Badge URL

https://getmirror.online/badge/morganstanley.com.svg

Scan history

AI fix plan

Pick scans from this browser's history. The AI compares them, explains what changed and builds a prioritized, step-by-step plan.

Scans to analyze

0 of 6 selected

D69/10011/15/26, 06:20 PMCurrent

The current scan is always included.

AI-generated from your scan results only. Review each step before applying it; nothing is sent to or changed on the domain.

Technical detail

Click a check to see the public data, a verification command, a safe fix recommendation and documentation sources.

Email security

24/25

Encryption & certificate

18/25

Browser protections

21/30

DNS infrastructure

3/15

Public DNS records

A	morganstanley.com	23.55.59.208
AAAA	morganstanley.com	—
MX	morganstanley.com	0 mx1.morganstanley.com 0 mx2.morganstanley.com 0 mx3.morganstanley.com 0 mx4.morganstanley.com
NS	morganstanley.com	ext-ns1.morganstanley.net ext-ns3.morganstanley.net ext-ns5.morganstanley.net ext-ns8.morganstanley.net ext-ns10.morganstanley.net ext-ns12.morganstanley.net
TXT	morganstanley.com	00D040000004cgp=1TBDc0000004C9W 00D1900000016Zs=1TBDV000000000k 00D2g0000008dHr=1TBD10000008OIZ 00D3000000001T1=1TBHt0000004C9I 00D300000000aex=1TBKe000000Gma9 00D3000000018Eb=1TBKZ0000008OTr 00D300000001Spr=1TBKX000000fxVP 00D30000001Ggsx=1TBHq000000GmaO 00D3i000000tRel=1TBKk000000TN1F 00D41000000e8Jh=1TBKk000000KyjV 00D50000000a4nt=1TBHt000000blL0 00D590000004ehm=1TBDk0000000001 00D60000000ITxw=1TBKf000000blJJ 00D6g00000364Az=1TBKf000000KykO 00D7f000000AOg4=1TBDz000000000Q 00D8A000000MitH=1TBKR000000KyjL 00D8J0000004eWj=1TBKQ000000CaRg 00D8N0000004z76=1TBDV000000001J 00DD10000004aBT=1TBD1000000CaSe 00DD30000002NM3=1TBD30000004CCq 00DD30000002Onx=1TBD30000004CEr 00DD30000002PfR=1TBD30000004CE4 00DD3000000Cn7k=1TBD30000008OI5 00DD6000000VTqm=1TBD6000000001T 00DDC000001S6Kd=1TBDC0000008OJm 00DDF00000XH4dw=1TBDF0000004C9T 00DDG00000NAnia=1TBDG0000000022 00DDS000001zghE=1TBDS0000008OJr 00DDT000000Xzwk=1TBDT0000004C9c 00DDU0000015PAJ=1TBiX0000000001 00DDb000000KIFz=1TBDb0000004CAa 00DDf000000QS8O=1TBDf0000004CAG 00DDh0000009aLY=1TBDh0000000037 00DDh0000009aNs=1TBDh000000CaSP 00DDi0000001bvB=1TBDi0000000014 00DKd000001BEbu=1TBKd000000fxT4 00DWA0000065185=1TBWA0000004oav;00DVZ000005G5X7=1TBVZ0000000iAj;00D4x000006sKZr=1TBVp00000001CD 00Df40000003tA1=1TBKZ0000004CFL 00Dj0000000JgIh=1TBKi000000KynY Dynatrace-site-verification=f820f38b-6bab-42a4-ba93-c510fc8d95f3__6ia8tdel7lkv90dp9f16kj43nt MS=B11B1927AD6F301CCA14AE1952F7EE3F77FA0DA3 MS=D2F22D15AD6940E6D1595EEA2A82F8EBBE5A7860 MS=ms22717582 MS=ms34046956 SFMC-4NiJy_Iak_jn9G4UG21BCIX17tC5te1FrgeULmPs SFMC-ZKL-mpN1wFcNGjkC0ncn5Q_10UG6bQIc3M75E28E SFMC-ZhfGC4YE5f0EWQ_QB7l5jUeSmcma_nppruiyc2GX SFMC-_U97wzs9WeIMRu1Ogz26fNvO8pRPAWR2iy1Mtw_E SFMC-hykCYq_Hy8fBF57ZZcOZ4wP9mzIlfOneUYxWGyKh anthropic-domain-verification-cfyw5b=NqiPvaPrHby3VqrH6D85nS6DO apple-domain-verification=4DolHYs99fzmivr2 apple-domain-verification=CCHirdPSdqNcSTdw apple-domain-verification=VGV4vVv8k7z8Xjd2 asv=d4ce34268c259ec0685417e93e22ebaa atlassian-domain-verification=F4W/kDM8Hiptb7FLWF88569dinG0xp8RpJihH9P3eAb6axyjKqavdpiJaFQf9UzT autodesk-domain-verification=mCe8qXoGUyvSDwovDrQS canva-site-verification=wRuArEOQ89sOc-3mPb9Yqw cisco-ci-domain-verification=37939da7e981bd61c0d4b47f2fb7f347a6b75ceffd7b48d0f8fd6b3b3067a05e cursor-domain-verification-k9jr9r=gPmg55E4CkrrLq0oI3JMGOAxl dell-technologies-domain-verification=morganstanley.com_b73208cd-f0f0-4209-ae0d-4ba852485ab5_1721317818 docker-verification=6151843d-1f00-407e-a500-d4850180995c docusign=01cdb7c9-0689-4d6c-aec9-7755315fcd04 docusign=d0cb5a28-a75d-4b5a-b7ed-96a5bf28ee10 domain-verification=16be90753d8401fbf6139f44696734fb44fa6db312f59df23562406bfc550782 figma-domain-verification=3fe766178faeda5b2b958ababb0ed36ddd84097689805b66ac345b3bc02d2cbc-1745513310 google-site-verification=RYsm-Dmew_1HnXd0D_d0THltS5_5OV9a93UEDCZMdFE intersight=0aeef0ed5bd1b17a293d9494f1cb28ad28e20c6932cb7d32860976057da38e65 jamf-site-verification=Fz84V5ZHFT1wPgjJL2ux3g jnbJ5VZLAykqqaTWX+bDebORqxQEF2Tl7P+GzZ2Dl9Umwn1FluefTvkKuMwDFxAASJ4HaDdjp5fiaaRJlXb4BA== liveramp-site-verification=vghYxD0cvpAU3QesU37b8LkwMct24AB-T3kD9acej_Y lutron-domain-verification-fpn944=fHEWfpLryKRNAQS2rJ3Y92vSF lutron-domain-verification-wmvzvs=Ec6epeqkSMA3DDKlNTpbUSMAO mongodb-site-verification=PdOHldV5pWVTFD38TZFd0uP5pN2KAdKf notion-domain-verification=a2JLYzSOnyHp7QG6byrW7teNCQn2l0sEOnddMlCRKIq openai-domain-verification=dv-nlk39T5F1QLeg5XfeVInXiAR paloaltonetworks-site-verification=6060c8d373330618e5e966df52c09fa09f16346261e239d025eb1d406504bb37 pardot3032=e9d40f20fce719db3b64485e71711719a05cdf94d2e433e1d773b395d4dab68d slack-domain-verification=DCAvlBYXdYpk7fiATAOiz0bNLSEeV7iY4WQI8Zxv uber-domain-verification=7c136cde-2819-42bd-80ee-10d198d9fedd v=spf1 ip4:199.89.64.0/18 ip4:205.228.0.0/17 include:_spf.morganstanley.neolane.net include:aspmx.pardot.com include:cust-spf.exacttarget.com ~all wiz-domain-verification=f6c7c5c2412d5ec400952b27344f657966d572471626253f0591391775555cfe
TXT	_dmarc.morganstanley.com	v=DMARC1; p=reject; fo=1; rua=mailto:dmarc_rua@emaildefense.proofpoint.com,mailto:morganstanley@rua.netcraft.com; ruf=mailto:dmarc_ruf@emaildefense.proofpoint.com,mailto:morganstanley@ruf.netcraft.com; adkim=s;
CAA	morganstanley.com	—
DS	morganstanley.com	—

Fix priorities

Sorted by risk: severity first, confirmed issues before hardening gaps, then effort and score impact.

1HighHTTP → HTTPS redirectHardening gap+7
2MediumDNSSEC — signed DNS recordsHardening gap+7
3LowCAA — who may issue certificatesHardening gap+5
4LowReferrer-PolicyHardening gap+3
5LowPermissions-PolicyHardening gap+2
6LowCSP — protection from script injectionHardening gap+3

To verify

Couldn't be confirmed from public data, so excluded from the score. Checking them clarifies your posture; it doesn't guarantee a score change.

DKIM — digital signature on email

Indicative alignment

Best-practice mapping of public findings to common frameworks. Passive scanning tests public configuration only; it doesn't prove compliance or a violation.

Google & Yahoo sender rulesIncomplete evidence · 1 unverified
SPF, DKIM and DMARC are required for bulk senders to Gmail and Yahoo; missing them risks rejected or spam-foldered mail.
PCI DSS v4.02 observed gaps
TLS, certificate and browser-header protections relate to PCI DSS v4.0 requirements 4.2 and 6.4 for payment pages.
HTTP → HTTPS redirect CSP — protection from script injection
NIS2 / vendor due diligence2 observed gaps
Vendor risk reviews under NIS2/DORA and cyber-insurance questionnaires check these public signals.
DNSSEC — signed DNS records CAA — who may issue certificates
SOC 2 / ISO 27001 baseline1 observed gaps
Baseline external hygiene commonly expected in SOC 2 and ISO 27001 audits.
CSP — protection from script injection

Indicative alignment only, based on public configuration. It doesn't establish whether a framework applies to you, and it isn't legal advice, an audit or a certification.

Head-to-head vs competitor

How do you stack up against competitors?

The check reads public data only and makes no changes to the domain. Recommendations are intended for the domain owner.

Is your domain as secure? Scan it free, no sign-up

All pre-scanned domains

morganstanley.com

High exposure. Significant weaknesses put the brand, customers and email at risk.

Partial coverage: the score is based on 95% of applicable check weight. 1 unverified check(s) are excluded, not counted as failures.

2026-11-15 18:20 UTC

Useful for your IT provider or a colleague. Anyone with the link can view the report.

What to do first

Send visitors to the secure version of your site

Visitors who type your address without https may stay on an unprotected connection.

Who can fix it: Your web host

How to verify after the fix

curl -sI http://morganstanley.com/ | grep -iE "^(HTTP|location)"

Turn on DNS signing for your domain

Signing helps resolvers detect forged answers about your domain.

Who can fix it: Your domain registrar or DNS provider

How to verify after the fix

dig +short DS morganstanley.com

What this grade means

Tested hostname

morganstanley.com

Website request

GET https://morganstanley.com/ → https://www.morganstanley.com/

Scan time

2026-11-15 18:20:16 UTC

Grading method

Version 2How grading works

Unverified or excluded checks

DKIM — digital signature on email · Not detected (common selectors only)

Technical detail

Click a check to see the public data, a verification command, a safe fix recommendation and documentation sources.

Email security

24/25

Encryption & certificate

18/25

Browser protections

21/30

DNS infrastructure

3/15

Public DNS records

A	morganstanley.com	23.55.59.208
AAAA	morganstanley.com	—
MX	morganstanley.com	0 mx1.morganstanley.com 0 mx2.morganstanley.com 0 mx3.morganstanley.com 0 mx4.morganstanley.com
NS	morganstanley.com	ext-ns1.morganstanley.net ext-ns3.morganstanley.net ext-ns5.morganstanley.net ext-ns8.morganstanley.net ext-ns10.morganstanley.net ext-ns12.morganstanley.net
TXT	morganstanley.com	00D040000004cgp=1TBDc0000004C9W 00D1900000016Zs=1TBDV000000000k 00D2g0000008dHr=1TBD10000008OIZ 00D3000000001T1=1TBHt0000004C9I 00D300000000aex=1TBKe000000Gma9 00D3000000018Eb=1TBKZ0000008OTr 00D300000001Spr=1TBKX000000fxVP 00D30000001Ggsx=1TBHq000000GmaO 00D3i000000tRel=1TBKk000000TN1F 00D41000000e8Jh=1TBKk000000KyjV 00D50000000a4nt=1TBHt000000blL0 00D590000004ehm=1TBDk0000000001 00D60000000ITxw=1TBKf000000blJJ 00D6g00000364Az=1TBKf000000KykO 00D7f000000AOg4=1TBDz000000000Q 00D8A000000MitH=1TBKR000000KyjL 00D8J0000004eWj=1TBKQ000000CaRg 00D8N0000004z76=1TBDV000000001J 00DD10000004aBT=1TBD1000000CaSe 00DD30000002NM3=1TBD30000004CCq 00DD30000002Onx=1TBD30000004CEr 00DD30000002PfR=1TBD30000004CE4 00DD3000000Cn7k=1TBD30000008OI5 00DD6000000VTqm=1TBD6000000001T 00DDC000001S6Kd=1TBDC0000008OJm 00DDF00000XH4dw=1TBDF0000004C9T 00DDG00000NAnia=1TBDG0000000022 00DDS000001zghE=1TBDS0000008OJr 00DDT000000Xzwk=1TBDT0000004C9c 00DDU0000015PAJ=1TBiX0000000001 00DDb000000KIFz=1TBDb0000004CAa 00DDf000000QS8O=1TBDf0000004CAG 00DDh0000009aLY=1TBDh0000000037 00DDh0000009aNs=1TBDh000000CaSP 00DDi0000001bvB=1TBDi0000000014 00DKd000001BEbu=1TBKd000000fxT4 00DWA0000065185=1TBWA0000004oav;00DVZ000005G5X7=1TBVZ0000000iAj;00D4x000006sKZr=1TBVp00000001CD 00Df40000003tA1=1TBKZ0000004CFL 00Dj0000000JgIh=1TBKi000000KynY Dynatrace-site-verification=f820f38b-6bab-42a4-ba93-c510fc8d95f3__6ia8tdel7lkv90dp9f16kj43nt MS=B11B1927AD6F301CCA14AE1952F7EE3F77FA0DA3 MS=D2F22D15AD6940E6D1595EEA2A82F8EBBE5A7860 MS=ms22717582 MS=ms34046956 SFMC-4NiJy_Iak_jn9G4UG21BCIX17tC5te1FrgeULmPs SFMC-ZKL-mpN1wFcNGjkC0ncn5Q_10UG6bQIc3M75E28E SFMC-ZhfGC4YE5f0EWQ_QB7l5jUeSmcma_nppruiyc2GX SFMC-_U97wzs9WeIMRu1Ogz26fNvO8pRPAWR2iy1Mtw_E SFMC-hykCYq_Hy8fBF57ZZcOZ4wP9mzIlfOneUYxWGyKh anthropic-domain-verification-cfyw5b=NqiPvaPrHby3VqrH6D85nS6DO apple-domain-verification=4DolHYs99fzmivr2 apple-domain-verification=CCHirdPSdqNcSTdw apple-domain-verification=VGV4vVv8k7z8Xjd2 asv=d4ce34268c259ec0685417e93e22ebaa atlassian-domain-verification=F4W/kDM8Hiptb7FLWF88569dinG0xp8RpJihH9P3eAb6axyjKqavdpiJaFQf9UzT autodesk-domain-verification=mCe8qXoGUyvSDwovDrQS canva-site-verification=wRuArEOQ89sOc-3mPb9Yqw cisco-ci-domain-verification=37939da7e981bd61c0d4b47f2fb7f347a6b75ceffd7b48d0f8fd6b3b3067a05e cursor-domain-verification-k9jr9r=gPmg55E4CkrrLq0oI3JMGOAxl dell-technologies-domain-verification=morganstanley.com_b73208cd-f0f0-4209-ae0d-4ba852485ab5_1721317818 docker-verification=6151843d-1f00-407e-a500-d4850180995c docusign=01cdb7c9-0689-4d6c-aec9-7755315fcd04 docusign=d0cb5a28-a75d-4b5a-b7ed-96a5bf28ee10 domain-verification=16be90753d8401fbf6139f44696734fb44fa6db312f59df23562406bfc550782 figma-domain-verification=3fe766178faeda5b2b958ababb0ed36ddd84097689805b66ac345b3bc02d2cbc-1745513310 google-site-verification=RYsm-Dmew_1HnXd0D_d0THltS5_5OV9a93UEDCZMdFE intersight=0aeef0ed5bd1b17a293d9494f1cb28ad28e20c6932cb7d32860976057da38e65 jamf-site-verification=Fz84V5ZHFT1wPgjJL2ux3g jnbJ5VZLAykqqaTWX+bDebORqxQEF2Tl7P+GzZ2Dl9Umwn1FluefTvkKuMwDFxAASJ4HaDdjp5fiaaRJlXb4BA== liveramp-site-verification=vghYxD0cvpAU3QesU37b8LkwMct24AB-T3kD9acej_Y lutron-domain-verification-fpn944=fHEWfpLryKRNAQS2rJ3Y92vSF lutron-domain-verification-wmvzvs=Ec6epeqkSMA3DDKlNTpbUSMAO mongodb-site-verification=PdOHldV5pWVTFD38TZFd0uP5pN2KAdKf notion-domain-verification=a2JLYzSOnyHp7QG6byrW7teNCQn2l0sEOnddMlCRKIq openai-domain-verification=dv-nlk39T5F1QLeg5XfeVInXiAR paloaltonetworks-site-verification=6060c8d373330618e5e966df52c09fa09f16346261e239d025eb1d406504bb37 pardot3032=e9d40f20fce719db3b64485e71711719a05cdf94d2e433e1d773b395d4dab68d slack-domain-verification=DCAvlBYXdYpk7fiATAOiz0bNLSEeV7iY4WQI8Zxv uber-domain-verification=7c136cde-2819-42bd-80ee-10d198d9fedd v=spf1 ip4:199.89.64.0/18 ip4:205.228.0.0/17 include:_spf.morganstanley.neolane.net include:aspmx.pardot.com include:cust-spf.exacttarget.com ~all wiz-domain-verification=f6c7c5c2412d5ec400952b27344f657966d572471626253f0591391775555cfe
TXT	_dmarc.morganstanley.com	v=DMARC1; p=reject; fo=1; rua=mailto:dmarc_rua@emaildefense.proofpoint.com,mailto:morganstanley@rua.netcraft.com; ruf=mailto:dmarc_ruf@emaildefense.proofpoint.com,mailto:morganstanley@ruf.netcraft.com; adkim=s;
CAA	morganstanley.com	—
DS	morganstanley.com	—

Indicative alignment

Best-practice mapping of public findings to common frameworks. Passive scanning tests public configuration only; it doesn't prove compliance or a violation.

Google & Yahoo sender rulesIncomplete evidence · 1 unverified

SPF, DKIM and DMARC are required for bulk senders to Gmail and Yahoo; missing them risks rejected or spam-foldered mail.

PCI DSS v4.02 observed gaps

TLS, certificate and browser-header protections relate to PCI DSS v4.0 requirements 4.2 and 6.4 for payment pages.

HTTP → HTTPS redirect CSP — protection from script injection

NIS2 / vendor due diligence2 observed gaps

Vendor risk reviews under NIS2/DORA and cyber-insurance questionnaires check these public signals.

DNSSEC — signed DNS records CAA — who may issue certificates

SOC 2 / ISO 27001 baseline1 observed gaps

Baseline external hygiene commonly expected in SOC 2 and ISO 27001 audits.

CSP — protection from script injection

Indicative alignment only, based on public configuration. It doesn't establish whether a framework applies to you, and it isn't legal advice, an audit or a certification.

morganstanley.com

Track your progress

Help someone else check their domain

What to do first

What this grade means

Get the badge

Scan history

AI fix plan

Scans to analyze

Technical detail

Email security

Encryption & certificate

Browser protections

DNS infrastructure

Public DNS records

Is your domain as secure? Scan it free, no sign-up

morganstanley.com

Track your progress

Help someone else check their domain

What to do first

What this grade means

Get the badge

Scan history

AI fix plan

Scans to analyze

Technical detail

Email security

Encryption & certificate

Browser protections

DNS infrastructure

Public DNS records

Is your domain as secure? Scan it free, no sign-up

Agent access & discovery signals