Automated public DNS and web checks; results may be incomplete. These are passive observations, not an assessment of the organization.

B81/100

Executive summary

wellsfargo.com

Good shape, with a few gaps worth closing this quarter.

Partial coverage: the score is based on 95% of applicable check weight. 1 unverified check(s) are excluded, not counted as failures.

2026-11-15 18:20 UTC

Print report / PDF

Useful for your IT provider or a colleague. Anyone with the link can view the report.

Track your progress

Fix the findings, then come back and rescan. Your scan history is saved in this browser so you can see exactly what improved.

Email security24/25

Good83% coverage

Spoofing email from this domain is hard.

Encryption & certificate25/25

Good

Traffic to the site is encrypted and the certificate is valid.

Browser protections25/30

Good

The site instructs browsers to block common attacks.

DNS infrastructure3/15

Critical

The domain's infrastructure lacks basic protections.

Help someone else check their domain

Share this public report with a colleague. They can review the evidence and check their own domain.

Get the report badge

What to do first

1.
Turn on DNS signing for your domain
Signing helps resolvers detect forged answers about your domain.
Who can fix it: Your domain registrar or DNS provider
How to verify after the fix
```
dig +short DS wellsfargo.com
```
2.
Choose which companies may issue certificates for your domain
This reduces the chance of a certificate being issued by a provider you did not choose.
Who can fix it: Your domain registrar or DNS provider
How to verify after the fix
```
dig +short CAA wellsfargo.com
```

A starting point, not a security guarantee.

What this grade means

Tested hostname: wellsfargo.com
Website request: GET https://wellsfargo.com/ → https://www.wellsfargo.com/
Scan time: 2026-11-15 18:20:09 UTC
Grading method: Version 2How grading works
Unverified or excluded checks: DKIM — digital signature on email · Not detected (common selectors only)

This is a snapshot of the public configuration checks listed in this report. It does not verify the site's owner, business legitimacy, application security, or absence of vulnerabilities. It is not a security certification.

Get the badge

Show the live grade for wellsfargo.com in a README, docs or site footer. The badge links to the public report and refreshes every 24 hours.

Scan shown on this page: ⁦2026-11-15 18:20:09 UTC⁩. The badge may display a cached result for up to 24 hours. Open the linked report to check its scan time.

Markdown

[![Domain Armor grade](https://getmirror.online/badge/wellsfargo.com.svg)](https://getmirror.online/report/wellsfargo.com)

HTML

<a href="https://getmirror.online/report/wellsfargo.com"><img src="https://getmirror.online/badge/wellsfargo.com.svg" alt="Domain Armor grade"></a>

Badge URL

https://getmirror.online/badge/wellsfargo.com.svg

Scan history

AI fix plan

Pick scans from this browser's history. The AI compares them, explains what changed and builds a prioritized, step-by-step plan.

Scans to analyze

0 of 6 selected

B81/10011/15/26, 06:20 PMCurrent

The current scan is always included.

AI-generated from your scan results only. Review each step before applying it; nothing is sent to or changed on the domain.

Technical detail

Click a check to see the public data, a verification command, a safe fix recommendation and documentation sources.

Email security

24/25

Encryption & certificate

25/25

Browser protections

25/30

DNS infrastructure

3/15

Public DNS records

A	wellsfargo.com	23.214.22.133 23.214.22.134
AAAA	wellsfargo.com	—
MX	wellsfargo.com	20 mx0b-00004003.pphosted.com 10 mxb-00004003.gslb.pphosted.com 10 mxa-00004003.gslb.pphosted.com 20 mx0a-00004003.pphosted.com
NS	wellsfargo.com	edns1.ultradns.com a2-64.akam.net edns1.ultradns.net edns1.ultradns.biz a1-189.akam.net edns1.ultradns.org a24-66.akam.net
TXT	wellsfargo.com	liveramp-site-verification=eTqekxddhK8on3hD12UkjC56Be8HZGRuzGG9BwQxfRM hcp-domain-verification=bed540868e214034c62df7863b2f90e7b217905a6c69831138e93312bcca62c2 XKNBNPXX3FGJAJI4IGHIWBRYY6IBLYJKA9TFFIQU poppulo-domain-verification=a43ab4c6-cf0c-408d-892c-910d39b46aec mongodb-site-verification=pdRPv2gbrHzIqdzHpPtCUwOMZBHgPbIQ mongodb-site-verification=jqcFvnzHPnWaB8kuVRCCbrQN1zJQRPQT slack-domain-verification=TZylPJmHnWc38hjAZndFjbqpORzFahh0CXOLCYBI google-site-verification=JhIekmpe90l9Nsvux7qqfwNmrhbJDI1xKSXsMWlXzYs cisco-ci-domain-verification=60939a4d2f539880950cf4f6cd4e97b18a07e85391ff5671f2b7045b2be84f9 facebook-domain-verification=5m0hrk0snw5sgvxwxdump2kob1wm5u cisco-ci-domain-verification=27d3d23d53cbc01f28bb1e90d2772e1ef8671ef1306d8a6aea2dd98b16973b99 google-site-verification=I_ja-LuIqEJ76WNc4saij8AC-JrnkDqe3--MBdH2LHU atlassian-domain-verification=3iSn26f6aafKa7o1mfwsx1tZl9Ach7BhUpRmglO24La1WPXoyanfEd3zs1Y0VqiL apple-domain-verification=fjpdn_0YZHIPxbMISJedC6zNIlntneK35XOgGcoDH_M v=spf1 include:%{ir}.%{v}.%{d}.spf.has.pphosted.com ~all cisco-ci-domain-verification=611fc9e560697d73912de2f3755da55f7277c7811d44297c0a0a567a21e7a249 docusign=182ba0bd-f7cc-423a-b69f-6597f3418125 SFMC-RBMdi4jKmGLzx309qUUmF_jRLq0ZhtELtiy7L3Qh MS=ms55239285 docusign=fa86331e-ce88-4150-9e03-49999c4542a5 yahoo-verification-key=obqVt160b6+HxLHztMj4LYjtSIXf2WUl7wuBDv+AZpE=
TXT	_dmarc.wellsfargo.com	v=DMARC1; p=reject; fo=1; rua=mailto:dmarc_rua@emaildefense.proofpoint.com,mailto:tn1d3s4FQU@dmarc.inboxmonster.com; ruf=mailto:dmarc-ruf@wellsfargo.com;
CAA	wellsfargo.com	—
DS	wellsfargo.com	—

Fix priorities

Sorted by risk: severity first, confirmed issues before hardening gaps, then effort and score impact.

1MediumDNSSEC — signed DNS recordsHardening gap+7
2LowCAA — who may issue certificatesHardening gap+5
3LowReferrer-PolicyHardening gap+3
4LowPermissions-PolicyHardening gap+2

To verify

Couldn't be confirmed from public data, so excluded from the score. Checking them clarifies your posture; it doesn't guarantee a score change.

DKIM — digital signature on email

Indicative alignment

Best-practice mapping of public findings to common frameworks. Passive scanning tests public configuration only; it doesn't prove compliance or a violation.

Google & Yahoo sender rulesIncomplete evidence · 1 unverified
SPF, DKIM and DMARC are required for bulk senders to Gmail and Yahoo; missing them risks rejected or spam-foldered mail.
PCI DSS v4.0No gaps observed
TLS, certificate and browser-header protections relate to PCI DSS v4.0 requirements 4.2 and 6.4 for payment pages.
NIS2 / vendor due diligence2 observed gaps
Vendor risk reviews under NIS2/DORA and cyber-insurance questionnaires check these public signals.
DNSSEC — signed DNS records CAA — who may issue certificates
SOC 2 / ISO 27001 baselineNo gaps observed
Baseline external hygiene commonly expected in SOC 2 and ISO 27001 audits.

Indicative alignment only, based on public configuration. It doesn't establish whether a framework applies to you, and it isn't legal advice, an audit or a certification.

Head-to-head vs competitor

How do you stack up against competitors?

The check reads public data only and makes no changes to the domain. Recommendations are intended for the domain owner.

Is your domain as secure? Scan it free, no sign-up

All pre-scanned domains

wellsfargo.com

Good shape, with a few gaps worth closing this quarter.

Partial coverage: the score is based on 95% of applicable check weight. 1 unverified check(s) are excluded, not counted as failures.

2026-11-15 18:20 UTC

Useful for your IT provider or a colleague. Anyone with the link can view the report.

What to do first

Turn on DNS signing for your domain

Signing helps resolvers detect forged answers about your domain.

Who can fix it: Your domain registrar or DNS provider

How to verify after the fix

dig +short DS wellsfargo.com

Choose which companies may issue certificates for your domain

This reduces the chance of a certificate being issued by a provider you did not choose.

Who can fix it: Your domain registrar or DNS provider

How to verify after the fix

dig +short CAA wellsfargo.com

What this grade means

Tested hostname

wellsfargo.com

Website request

GET https://wellsfargo.com/ → https://www.wellsfargo.com/

Scan time

2026-11-15 18:20:09 UTC

Grading method

Version 2How grading works

Unverified or excluded checks

DKIM — digital signature on email · Not detected (common selectors only)

Technical detail

Click a check to see the public data, a verification command, a safe fix recommendation and documentation sources.

Email security

24/25

Encryption & certificate

25/25

Browser protections

25/30

DNS infrastructure

3/15

Public DNS records

A	wellsfargo.com	23.214.22.133 23.214.22.134
AAAA	wellsfargo.com	—
MX	wellsfargo.com	20 mx0b-00004003.pphosted.com 10 mxb-00004003.gslb.pphosted.com 10 mxa-00004003.gslb.pphosted.com 20 mx0a-00004003.pphosted.com
NS	wellsfargo.com	edns1.ultradns.com a2-64.akam.net edns1.ultradns.net edns1.ultradns.biz a1-189.akam.net edns1.ultradns.org a24-66.akam.net
TXT	wellsfargo.com	liveramp-site-verification=eTqekxddhK8on3hD12UkjC56Be8HZGRuzGG9BwQxfRM hcp-domain-verification=bed540868e214034c62df7863b2f90e7b217905a6c69831138e93312bcca62c2 XKNBNPXX3FGJAJI4IGHIWBRYY6IBLYJKA9TFFIQU poppulo-domain-verification=a43ab4c6-cf0c-408d-892c-910d39b46aec mongodb-site-verification=pdRPv2gbrHzIqdzHpPtCUwOMZBHgPbIQ mongodb-site-verification=jqcFvnzHPnWaB8kuVRCCbrQN1zJQRPQT slack-domain-verification=TZylPJmHnWc38hjAZndFjbqpORzFahh0CXOLCYBI google-site-verification=JhIekmpe90l9Nsvux7qqfwNmrhbJDI1xKSXsMWlXzYs cisco-ci-domain-verification=60939a4d2f539880950cf4f6cd4e97b18a07e85391ff5671f2b7045b2be84f9 facebook-domain-verification=5m0hrk0snw5sgvxwxdump2kob1wm5u cisco-ci-domain-verification=27d3d23d53cbc01f28bb1e90d2772e1ef8671ef1306d8a6aea2dd98b16973b99 google-site-verification=I_ja-LuIqEJ76WNc4saij8AC-JrnkDqe3--MBdH2LHU atlassian-domain-verification=3iSn26f6aafKa7o1mfwsx1tZl9Ach7BhUpRmglO24La1WPXoyanfEd3zs1Y0VqiL apple-domain-verification=fjpdn_0YZHIPxbMISJedC6zNIlntneK35XOgGcoDH_M v=spf1 include:%{ir}.%{v}.%{d}.spf.has.pphosted.com ~all cisco-ci-domain-verification=611fc9e560697d73912de2f3755da55f7277c7811d44297c0a0a567a21e7a249 docusign=182ba0bd-f7cc-423a-b69f-6597f3418125 SFMC-RBMdi4jKmGLzx309qUUmF_jRLq0ZhtELtiy7L3Qh MS=ms55239285 docusign=fa86331e-ce88-4150-9e03-49999c4542a5 yahoo-verification-key=obqVt160b6+HxLHztMj4LYjtSIXf2WUl7wuBDv+AZpE=
TXT	_dmarc.wellsfargo.com	v=DMARC1; p=reject; fo=1; rua=mailto:dmarc_rua@emaildefense.proofpoint.com,mailto:tn1d3s4FQU@dmarc.inboxmonster.com; ruf=mailto:dmarc-ruf@wellsfargo.com;
CAA	wellsfargo.com	—
DS	wellsfargo.com	—

Indicative alignment

Best-practice mapping of public findings to common frameworks. Passive scanning tests public configuration only; it doesn't prove compliance or a violation.

Google & Yahoo sender rulesIncomplete evidence · 1 unverified

SPF, DKIM and DMARC are required for bulk senders to Gmail and Yahoo; missing them risks rejected or spam-foldered mail.

PCI DSS v4.0No gaps observed

TLS, certificate and browser-header protections relate to PCI DSS v4.0 requirements 4.2 and 6.4 for payment pages.

NIS2 / vendor due diligence2 observed gaps

Vendor risk reviews under NIS2/DORA and cyber-insurance questionnaires check these public signals.

DNSSEC — signed DNS records CAA — who may issue certificates

SOC 2 / ISO 27001 baselineNo gaps observed

Baseline external hygiene commonly expected in SOC 2 and ISO 27001 audits.

Indicative alignment only, based on public configuration. It doesn't establish whether a framework applies to you, and it isn't legal advice, an audit or a certification.

wellsfargo.com

Track your progress

Help someone else check their domain

What to do first

What this grade means

Get the badge

Scan history

AI fix plan

Scans to analyze

Technical detail

Email security

Encryption & certificate

Browser protections

DNS infrastructure

Public DNS records

Is your domain as secure? Scan it free, no sign-up

wellsfargo.com

Track your progress

Help someone else check their domain

What to do first

What this grade means

Get the badge

Scan history

AI fix plan

Scans to analyze

Technical detail

Email security

Encryption & certificate

Browser protections

DNS infrastructure

Public DNS records

Is your domain as secure? Scan it free, no sign-up

Agent access & discovery signals