← Back to Scanner
F

foreignpolicy.com

Posture Score: 51/100

Scanned May 30, 2026 at 2:24 PM UTC

Identity

60

Attack Surface

0

Reputation

92

Identity Findings

No MX records found
The domain has no MX records and cannot receive email.
💡 Publish MX records pointing to your mail server(s).
critical
Weak DKIM RSA key (~1296 bits) for selector 'google'
RSA keys shorter than 2048 bits are considered weak. Current key is approximately 1296 bits.
💡 Generate a new 2048-bit (or larger) RSA key pair and update the DKIM record.
high
Weak DKIM RSA key (~1296 bits) for selector 'mandrill'
RSA keys shorter than 2048 bits are considered weak. Current key is approximately 1296 bits.
💡 Generate a new 2048-bit (or larger) RSA key pair and update the DKIM record.
high
No MTA-STS record found
Without MTA-STS, mail transport encryption cannot be enforced and is vulnerable to downgrade attacks.
💡 Publish a _mta-sts TXT record and host a policy file at https://mta-sts.foreignpolicy.com/.well-known/mta-sts.txt
medium
No TLS-RPT record found
Without TLS-RPT, you will not receive reports about TLS negotiation failures.
💡 Publish a _smtp._tls TXT record (e.g. "v=TLSRPTv1; rua=mailto:tls-reports@foreignpolicy.com").
low
ARC check skipped — no MX records
Cannot assess ARC support without MX records.
low
No CAA iodef tag configured
No iodef tag is present in the CAA records. CA policy violation reports will not be sent.
💡 Add an iodef CAA record. Example: 0 iodef "mailto:security@example.com"
low
Very low TTL on TXT records: 60s
11 TXT records have a TTL of 60s or less (below 300s).
💡 Increase the TTL to at least 300 seconds unless frequent changes are expected.
low
Very low TTL on SPF record: 60s
The SPF record has a TTL of 60s or less (below 300s).
💡 Increase the TTL to at least 300 seconds unless frequent changes are expected.
low
SPF record is valid
The SPF record is properly configured with valid syntax and within lookup limits.
pass
SPF record length OK (213 bytes)
SPF record is within safe DNS packet size limits.
pass
DKIM cryptographic configuration is compliant
No RFC 8301 compliance issues detected in DKIM key configuration.
pass
DKIM key strength indicates modern key management
All DKIM keys use RSA-2048+ or Ed25519, consistent with current best practices.
pass
All external report destinations authorized
External DMARC report destinations have valid authorization records per RFC 7489 §7.1.
pass
Subdomains protected (sp=quarantine)
DMARC subdomain policy enforces quarantine or reject on unauthenticated subdomain mail.
pass
Meets bulk sender authentication requirements
Domain has SPF, DKIM, and DMARC — meeting Google/Yahoo 2024 bulk sender requirements for email authentication.
pass
IPv6 readiness is good
IPv6 records are present and properly configured.
pass
NS delegation is properly configured
All nameservers are responsive, consistent, and properly secured.
pass
DNS responses are consistent across all nameservers
All authoritative nameservers return consistent answers with proper AA flags.
pass
DKIM2 not detected
No DKIM key record with v=2 was found across common selectors. DKIM2 is an emerging standard and not yet widely deployed.
informational
DMARC alignment: adkim=r, aspf=r
DKIM alignment is relaxed, SPF alignment is relaxed.
informational
DMARC failure reporting: fo=1
Failure reports generated when any authentication mechanism fails.
informational
DMARCbis np tag absent
The DMARC record does not include the np (non-existent subdomain policy) tag. Consider adding np=reject to protect non-existent subdomains under DMARCbis.
informational
Deprecated DMARCbis tags found: pct, rf, ri
The DMARC record contains tags deprecated in DMARCbis: pct, rf, ri. Consider removing these for forward compatibility.
informational
DMARCbis psd tag absent
The DMARC record does not include the psd (public suffix domain) indicator. Consider adding psd=n to explicitly identify this as an organizational domain.
informational
REQUIRETLS not advertised
The primary MX does not advertise REQUIRETLS (RFC 8689). This is an emerging standard — MTA-STS and DANE provide adequate TLS enforcement for most deployments.
informational
DANE check skipped — no MX records
Cannot check DANE/TLSA without MX records.
informational
No BIMI record found
BIMI is not configured. Your brand logo will not display in supporting email clients.
informational
Open relay check skipped — no MX records
Cannot test for open relay without MX records.
informational
SMTP compliance check skipped — no MX records
Cannot test SMTP compliance without MX records.
informational
Port exposure check skipped — no MX records
Cannot scan ports without MX records.
informational
STARTTLS downgrade check skipped — no MX records
Cannot test STARTTLS without MX records.
informational
RFC 8058 one-click unsubscribe assessment
DKIM signing is configured. RFC 8058 compliance depends on List-Unsubscribe and List-Unsubscribe-Post headers being included in outbound messages and DKIM signatures.
informational
FCrDNS check skipped — no MX records
Cannot perform FCrDNS without MX records.
informational
SOA record parameters
Serial: 2404428185, Refresh: 10000s, Retry: 2400s, Expire: 604800s, Min TTL: 1800s
informational
Authorized certificate authorities
CAA records restrict certificate issuance to: letsencrypt.org, pki.goog; cansignhttpexchanges=yes, comodoca.com, ssl.com, digicert.com; cansignhttpexchanges=yes
informational

Attack Surface Findings

Non-responsive IP for www.foreignpolicy.com: 2606:4700:20::681a:b61
The subdomain www.foreignpolicy.com resolves to 2606:4700:20::681a:b61 which is not responding on ports 80 or 443. This may indicate a decommissioned server.
💡 Verify the server at 2606:4700:20::681a:b61 is operational or remove the DNS record for www.foreignpolicy.com.
medium
Non-responsive IP for www.foreignpolicy.com: 2606:4700:20::681a:a61
The subdomain www.foreignpolicy.com resolves to 2606:4700:20::681a:a61 which is not responding on ports 80 or 443. This may indicate a decommissioned server.
💡 Verify the server at 2606:4700:20::681a:a61 is operational or remove the DNS record for www.foreignpolicy.com.
medium
Non-responsive IP for www.foreignpolicy.com: 2606:4700:20::ac43:449f
The subdomain www.foreignpolicy.com resolves to 2606:4700:20::ac43:449f which is not responding on ports 80 or 443. This may indicate a decommissioned server.
💡 Verify the server at 2606:4700:20::ac43:449f is operational or remove the DNS record for www.foreignpolicy.com.
medium
Non-responsive IP for ftp.foreignpolicy.com: 2606:4700:20::681a:b61
The subdomain ftp.foreignpolicy.com resolves to 2606:4700:20::681a:b61 which is not responding on ports 80 or 443. This may indicate a decommissioned server.
💡 Verify the server at 2606:4700:20::681a:b61 is operational or remove the DNS record for ftp.foreignpolicy.com.
medium
Non-responsive IP for ftp.foreignpolicy.com: 2606:4700:20::681a:a61
The subdomain ftp.foreignpolicy.com resolves to 2606:4700:20::681a:a61 which is not responding on ports 80 or 443. This may indicate a decommissioned server.
💡 Verify the server at 2606:4700:20::681a:a61 is operational or remove the DNS record for ftp.foreignpolicy.com.
medium
Non-responsive IP for ftp.foreignpolicy.com: 2606:4700:20::ac43:449f
The subdomain ftp.foreignpolicy.com resolves to 2606:4700:20::ac43:449f which is not responding on ports 80 or 443. This may indicate a decommissioned server.
💡 Verify the server at 2606:4700:20::ac43:449f is operational or remove the DNS record for ftp.foreignpolicy.com.
medium
Non-responsive IP for ns1.foreignpolicy.com: 2606:4700:20::681a:a61
The subdomain ns1.foreignpolicy.com resolves to 2606:4700:20::681a:a61 which is not responding on ports 80 or 443. This may indicate a decommissioned server.
💡 Verify the server at 2606:4700:20::681a:a61 is operational or remove the DNS record for ns1.foreignpolicy.com.
medium
Non-responsive IP for ns1.foreignpolicy.com: 2606:4700:20::ac43:449f
The subdomain ns1.foreignpolicy.com resolves to 2606:4700:20::ac43:449f which is not responding on ports 80 or 443. This may indicate a decommissioned server.
💡 Verify the server at 2606:4700:20::ac43:449f is operational or remove the DNS record for ns1.foreignpolicy.com.
medium
Non-responsive IP for ns1.foreignpolicy.com: 2606:4700:20::681a:b61
The subdomain ns1.foreignpolicy.com resolves to 2606:4700:20::681a:b61 which is not responding on ports 80 or 443. This may indicate a decommissioned server.
💡 Verify the server at 2606:4700:20::681a:b61 is operational or remove the DNS record for ns1.foreignpolicy.com.
medium
Non-responsive IP for ns2.foreignpolicy.com: 2606:4700:20::681a:a61
The subdomain ns2.foreignpolicy.com resolves to 2606:4700:20::681a:a61 which is not responding on ports 80 or 443. This may indicate a decommissioned server.
💡 Verify the server at 2606:4700:20::681a:a61 is operational or remove the DNS record for ns2.foreignpolicy.com.
medium
Non-responsive IP for ns2.foreignpolicy.com: 2606:4700:20::681a:b61
The subdomain ns2.foreignpolicy.com resolves to 2606:4700:20::681a:b61 which is not responding on ports 80 or 443. This may indicate a decommissioned server.
💡 Verify the server at 2606:4700:20::681a:b61 is operational or remove the DNS record for ns2.foreignpolicy.com.
medium
Non-responsive IP for ns2.foreignpolicy.com: 2606:4700:20::ac43:449f
The subdomain ns2.foreignpolicy.com resolves to 2606:4700:20::ac43:449f which is not responding on ports 80 or 443. This may indicate a decommissioned server.
💡 Verify the server at 2606:4700:20::ac43:449f is operational or remove the DNS record for ns2.foreignpolicy.com.
medium
Non-responsive IP for vpn.foreignpolicy.com: 2606:4700:20::681a:b61
The subdomain vpn.foreignpolicy.com resolves to 2606:4700:20::681a:b61 which is not responding on ports 80 or 443. This may indicate a decommissioned server.
💡 Verify the server at 2606:4700:20::681a:b61 is operational or remove the DNS record for vpn.foreignpolicy.com.
medium
Non-responsive IP for vpn.foreignpolicy.com: 2606:4700:20::ac43:449f
The subdomain vpn.foreignpolicy.com resolves to 2606:4700:20::ac43:449f which is not responding on ports 80 or 443. This may indicate a decommissioned server.
💡 Verify the server at 2606:4700:20::ac43:449f is operational or remove the DNS record for vpn.foreignpolicy.com.
medium
Non-responsive IP for vpn.foreignpolicy.com: 2606:4700:20::681a:a61
The subdomain vpn.foreignpolicy.com resolves to 2606:4700:20::681a:a61 which is not responding on ports 80 or 443. This may indicate a decommissioned server.
💡 Verify the server at 2606:4700:20::681a:a61 is operational or remove the DNS record for vpn.foreignpolicy.com.
medium
Non-responsive IP for remote.foreignpolicy.com: 2606:4700:20::681a:b61
The subdomain remote.foreignpolicy.com resolves to 2606:4700:20::681a:b61 which is not responding on ports 80 or 443. This may indicate a decommissioned server.
💡 Verify the server at 2606:4700:20::681a:b61 is operational or remove the DNS record for remote.foreignpolicy.com.
medium
Non-responsive IP for remote.foreignpolicy.com: 2606:4700:20::ac43:449f
The subdomain remote.foreignpolicy.com resolves to 2606:4700:20::ac43:449f which is not responding on ports 80 or 443. This may indicate a decommissioned server.
💡 Verify the server at 2606:4700:20::ac43:449f is operational or remove the DNS record for remote.foreignpolicy.com.
medium
Non-responsive IP for remote.foreignpolicy.com: 2606:4700:20::681a:a61
The subdomain remote.foreignpolicy.com resolves to 2606:4700:20::681a:a61 which is not responding on ports 80 or 443. This may indicate a decommissioned server.
💡 Verify the server at 2606:4700:20::681a:a61 is operational or remove the DNS record for remote.foreignpolicy.com.
medium
Non-responsive IP for admin.foreignpolicy.com: 2606:4700:20::ac43:449f
The subdomain admin.foreignpolicy.com resolves to 2606:4700:20::ac43:449f which is not responding on ports 80 or 443. This may indicate a decommissioned server.
💡 Verify the server at 2606:4700:20::ac43:449f is operational or remove the DNS record for admin.foreignpolicy.com.
medium
Non-responsive IP for admin.foreignpolicy.com: 2606:4700:20::681a:b61
The subdomain admin.foreignpolicy.com resolves to 2606:4700:20::681a:b61 which is not responding on ports 80 or 443. This may indicate a decommissioned server.
💡 Verify the server at 2606:4700:20::681a:b61 is operational or remove the DNS record for admin.foreignpolicy.com.
medium
Non-responsive IP for admin.foreignpolicy.com: 2606:4700:20::681a:a61
The subdomain admin.foreignpolicy.com resolves to 2606:4700:20::681a:a61 which is not responding on ports 80 or 443. This may indicate a decommissioned server.
💡 Verify the server at 2606:4700:20::681a:a61 is operational or remove the DNS record for admin.foreignpolicy.com.
medium
Non-responsive IP for portal.foreignpolicy.com: 2606:4700:20::ac43:449f
The subdomain portal.foreignpolicy.com resolves to 2606:4700:20::ac43:449f which is not responding on ports 80 or 443. This may indicate a decommissioned server.
💡 Verify the server at 2606:4700:20::ac43:449f is operational or remove the DNS record for portal.foreignpolicy.com.
medium
Non-responsive IP for portal.foreignpolicy.com: 2606:4700:20::681a:a61
The subdomain portal.foreignpolicy.com resolves to 2606:4700:20::681a:a61 which is not responding on ports 80 or 443. This may indicate a decommissioned server.
💡 Verify the server at 2606:4700:20::681a:a61 is operational or remove the DNS record for portal.foreignpolicy.com.
medium
Non-responsive IP for portal.foreignpolicy.com: 2606:4700:20::681a:b61
The subdomain portal.foreignpolicy.com resolves to 2606:4700:20::681a:b61 which is not responding on ports 80 or 443. This may indicate a decommissioned server.
💡 Verify the server at 2606:4700:20::681a:b61 is operational or remove the DNS record for portal.foreignpolicy.com.
medium
Non-responsive IP for dev.foreignpolicy.com: 2606:4700:20::681a:b61
The subdomain dev.foreignpolicy.com resolves to 2606:4700:20::681a:b61 which is not responding on ports 80 or 443. This may indicate a decommissioned server.
💡 Verify the server at 2606:4700:20::681a:b61 is operational or remove the DNS record for dev.foreignpolicy.com.
medium
Non-responsive IP for dev.foreignpolicy.com: 2606:4700:20::ac43:449f
The subdomain dev.foreignpolicy.com resolves to 2606:4700:20::ac43:449f which is not responding on ports 80 or 443. This may indicate a decommissioned server.
💡 Verify the server at 2606:4700:20::ac43:449f is operational or remove the DNS record for dev.foreignpolicy.com.
medium
Non-responsive IP for dev.foreignpolicy.com: 2606:4700:20::681a:a61
The subdomain dev.foreignpolicy.com resolves to 2606:4700:20::681a:a61 which is not responding on ports 80 or 443. This may indicate a decommissioned server.
💡 Verify the server at 2606:4700:20::681a:a61 is operational or remove the DNS record for dev.foreignpolicy.com.
medium
Non-responsive IP for staging.foreignpolicy.com: 2606:4700:20::ac43:449f
The subdomain staging.foreignpolicy.com resolves to 2606:4700:20::ac43:449f which is not responding on ports 80 or 443. This may indicate a decommissioned server.
💡 Verify the server at 2606:4700:20::ac43:449f is operational or remove the DNS record for staging.foreignpolicy.com.
medium
Non-responsive IP for staging.foreignpolicy.com: 2606:4700:20::681a:b61
The subdomain staging.foreignpolicy.com resolves to 2606:4700:20::681a:b61 which is not responding on ports 80 or 443. This may indicate a decommissioned server.
💡 Verify the server at 2606:4700:20::681a:b61 is operational or remove the DNS record for staging.foreignpolicy.com.
medium
Non-responsive IP for staging.foreignpolicy.com: 2606:4700:20::681a:a61
The subdomain staging.foreignpolicy.com resolves to 2606:4700:20::681a:a61 which is not responding on ports 80 or 443. This may indicate a decommissioned server.
💡 Verify the server at 2606:4700:20::681a:a61 is operational or remove the DNS record for staging.foreignpolicy.com.
medium
Non-responsive IP for test.foreignpolicy.com: 2606:4700:20::681a:a61
The subdomain test.foreignpolicy.com resolves to 2606:4700:20::681a:a61 which is not responding on ports 80 or 443. This may indicate a decommissioned server.
💡 Verify the server at 2606:4700:20::681a:a61 is operational or remove the DNS record for test.foreignpolicy.com.
medium
Non-responsive IP for test.foreignpolicy.com: 2606:4700:20::ac43:449f
The subdomain test.foreignpolicy.com resolves to 2606:4700:20::ac43:449f which is not responding on ports 80 or 443. This may indicate a decommissioned server.
💡 Verify the server at 2606:4700:20::ac43:449f is operational or remove the DNS record for test.foreignpolicy.com.
medium
Non-responsive IP for test.foreignpolicy.com: 2606:4700:20::681a:b61
The subdomain test.foreignpolicy.com resolves to 2606:4700:20::681a:b61 which is not responding on ports 80 or 443. This may indicate a decommissioned server.
💡 Verify the server at 2606:4700:20::681a:b61 is operational or remove the DNS record for test.foreignpolicy.com.
medium
Non-responsive IP for api.foreignpolicy.com: 2606:4700:20::681a:b61
The subdomain api.foreignpolicy.com resolves to 2606:4700:20::681a:b61 which is not responding on ports 80 or 443. This may indicate a decommissioned server.
💡 Verify the server at 2606:4700:20::681a:b61 is operational or remove the DNS record for api.foreignpolicy.com.
medium
Non-responsive IP for api.foreignpolicy.com: 2606:4700:20::ac43:449f
The subdomain api.foreignpolicy.com resolves to 2606:4700:20::ac43:449f which is not responding on ports 80 or 443. This may indicate a decommissioned server.
💡 Verify the server at 2606:4700:20::ac43:449f is operational or remove the DNS record for api.foreignpolicy.com.
medium
Non-responsive IP for api.foreignpolicy.com: 2606:4700:20::681a:a61
The subdomain api.foreignpolicy.com resolves to 2606:4700:20::681a:a61 which is not responding on ports 80 or 443. This may indicate a decommissioned server.
💡 Verify the server at 2606:4700:20::681a:a61 is operational or remove the DNS record for api.foreignpolicy.com.
medium
Non-responsive IP for app.foreignpolicy.com: 2606:4700:20::ac43:449f
The subdomain app.foreignpolicy.com resolves to 2606:4700:20::ac43:449f which is not responding on ports 80 or 443. This may indicate a decommissioned server.
💡 Verify the server at 2606:4700:20::ac43:449f is operational or remove the DNS record for app.foreignpolicy.com.
medium
Non-responsive IP for app.foreignpolicy.com: 2606:4700:20::681a:a61
The subdomain app.foreignpolicy.com resolves to 2606:4700:20::681a:a61 which is not responding on ports 80 or 443. This may indicate a decommissioned server.
💡 Verify the server at 2606:4700:20::681a:a61 is operational or remove the DNS record for app.foreignpolicy.com.
medium
Non-responsive IP for app.foreignpolicy.com: 2606:4700:20::681a:b61
The subdomain app.foreignpolicy.com resolves to 2606:4700:20::681a:b61 which is not responding on ports 80 or 443. This may indicate a decommissioned server.
💡 Verify the server at 2606:4700:20::681a:b61 is operational or remove the DNS record for app.foreignpolicy.com.
medium
Non-responsive IP for cdn.foreignpolicy.com: 2606:4700:20::681a:a61
The subdomain cdn.foreignpolicy.com resolves to 2606:4700:20::681a:a61 which is not responding on ports 80 or 443. This may indicate a decommissioned server.
💡 Verify the server at 2606:4700:20::681a:a61 is operational or remove the DNS record for cdn.foreignpolicy.com.
medium
Non-responsive IP for cdn.foreignpolicy.com: 2606:4700:20::ac43:449f
The subdomain cdn.foreignpolicy.com resolves to 2606:4700:20::ac43:449f which is not responding on ports 80 or 443. This may indicate a decommissioned server.
💡 Verify the server at 2606:4700:20::ac43:449f is operational or remove the DNS record for cdn.foreignpolicy.com.
medium
Non-responsive IP for cdn.foreignpolicy.com: 2606:4700:20::681a:b61
The subdomain cdn.foreignpolicy.com resolves to 2606:4700:20::681a:b61 which is not responding on ports 80 or 443. This may indicate a decommissioned server.
💡 Verify the server at 2606:4700:20::681a:b61 is operational or remove the DNS record for cdn.foreignpolicy.com.
medium
Non-responsive IP for blog.foreignpolicy.com: 2606:4700:20::681a:a61
The subdomain blog.foreignpolicy.com resolves to 2606:4700:20::681a:a61 which is not responding on ports 80 or 443. This may indicate a decommissioned server.
💡 Verify the server at 2606:4700:20::681a:a61 is operational or remove the DNS record for blog.foreignpolicy.com.
medium
Non-responsive IP for blog.foreignpolicy.com: 2606:4700:20::681a:b61
The subdomain blog.foreignpolicy.com resolves to 2606:4700:20::681a:b61 which is not responding on ports 80 or 443. This may indicate a decommissioned server.
💡 Verify the server at 2606:4700:20::681a:b61 is operational or remove the DNS record for blog.foreignpolicy.com.
medium
Non-responsive IP for blog.foreignpolicy.com: 2606:4700:20::ac43:449f
The subdomain blog.foreignpolicy.com resolves to 2606:4700:20::ac43:449f which is not responding on ports 80 or 443. This may indicate a decommissioned server.
💡 Verify the server at 2606:4700:20::ac43:449f is operational or remove the DNS record for blog.foreignpolicy.com.
medium
Non-responsive IP for shop.foreignpolicy.com: 2606:4700:20::681a:a61
The subdomain shop.foreignpolicy.com resolves to 2606:4700:20::681a:a61 which is not responding on ports 80 or 443. This may indicate a decommissioned server.
💡 Verify the server at 2606:4700:20::681a:a61 is operational or remove the DNS record for shop.foreignpolicy.com.
medium
Non-responsive IP for shop.foreignpolicy.com: 2606:4700:20::681a:b61
The subdomain shop.foreignpolicy.com resolves to 2606:4700:20::681a:b61 which is not responding on ports 80 or 443. This may indicate a decommissioned server.
💡 Verify the server at 2606:4700:20::681a:b61 is operational or remove the DNS record for shop.foreignpolicy.com.
medium
Non-responsive IP for shop.foreignpolicy.com: 2606:4700:20::ac43:449f
The subdomain shop.foreignpolicy.com resolves to 2606:4700:20::ac43:449f which is not responding on ports 80 or 443. This may indicate a decommissioned server.
💡 Verify the server at 2606:4700:20::ac43:449f is operational or remove the DNS record for shop.foreignpolicy.com.
medium
Non-responsive IP for store.foreignpolicy.com: 2606:4700:20::681a:a61
The subdomain store.foreignpolicy.com resolves to 2606:4700:20::681a:a61 which is not responding on ports 80 or 443. This may indicate a decommissioned server.
💡 Verify the server at 2606:4700:20::681a:a61 is operational or remove the DNS record for store.foreignpolicy.com.
medium
Non-responsive IP for store.foreignpolicy.com: 2606:4700:20::ac43:449f
The subdomain store.foreignpolicy.com resolves to 2606:4700:20::ac43:449f which is not responding on ports 80 or 443. This may indicate a decommissioned server.
💡 Verify the server at 2606:4700:20::ac43:449f is operational or remove the DNS record for store.foreignpolicy.com.
medium
Non-responsive IP for store.foreignpolicy.com: 2606:4700:20::681a:b61
The subdomain store.foreignpolicy.com resolves to 2606:4700:20::681a:b61 which is not responding on ports 80 or 443. This may indicate a decommissioned server.
💡 Verify the server at 2606:4700:20::681a:b61 is operational or remove the DNS record for store.foreignpolicy.com.
medium
Non-responsive IP for support.foreignpolicy.com: 2606:4700:20::681a:a61
The subdomain support.foreignpolicy.com resolves to 2606:4700:20::681a:a61 which is not responding on ports 80 or 443. This may indicate a decommissioned server.
💡 Verify the server at 2606:4700:20::681a:a61 is operational or remove the DNS record for support.foreignpolicy.com.
medium
Non-responsive IP for support.foreignpolicy.com: 2606:4700:20::681a:b61
The subdomain support.foreignpolicy.com resolves to 2606:4700:20::681a:b61 which is not responding on ports 80 or 443. This may indicate a decommissioned server.
💡 Verify the server at 2606:4700:20::681a:b61 is operational or remove the DNS record for support.foreignpolicy.com.
medium
Non-responsive IP for support.foreignpolicy.com: 2606:4700:20::ac43:449f
The subdomain support.foreignpolicy.com resolves to 2606:4700:20::ac43:449f which is not responding on ports 80 or 443. This may indicate a decommissioned server.
💡 Verify the server at 2606:4700:20::ac43:449f is operational or remove the DNS record for support.foreignpolicy.com.
medium
Non-responsive IP for help.foreignpolicy.com: 2606:4700:20::ac43:449f
The subdomain help.foreignpolicy.com resolves to 2606:4700:20::ac43:449f which is not responding on ports 80 or 443. This may indicate a decommissioned server.
💡 Verify the server at 2606:4700:20::ac43:449f is operational or remove the DNS record for help.foreignpolicy.com.
medium
Non-responsive IP for help.foreignpolicy.com: 2606:4700:20::681a:a61
The subdomain help.foreignpolicy.com resolves to 2606:4700:20::681a:a61 which is not responding on ports 80 or 443. This may indicate a decommissioned server.
💡 Verify the server at 2606:4700:20::681a:a61 is operational or remove the DNS record for help.foreignpolicy.com.
medium
Non-responsive IP for help.foreignpolicy.com: 2606:4700:20::681a:b61
The subdomain help.foreignpolicy.com resolves to 2606:4700:20::681a:b61 which is not responding on ports 80 or 443. This may indicate a decommissioned server.
💡 Verify the server at 2606:4700:20::681a:b61 is operational or remove the DNS record for help.foreignpolicy.com.
medium
Non-responsive IP for docs.foreignpolicy.com: 2606:4700:20::681a:a61
The subdomain docs.foreignpolicy.com resolves to 2606:4700:20::681a:a61 which is not responding on ports 80 or 443. This may indicate a decommissioned server.
💡 Verify the server at 2606:4700:20::681a:a61 is operational or remove the DNS record for docs.foreignpolicy.com.
medium
Non-responsive IP for docs.foreignpolicy.com: 2606:4700:20::681a:b61
The subdomain docs.foreignpolicy.com resolves to 2606:4700:20::681a:b61 which is not responding on ports 80 or 443. This may indicate a decommissioned server.
💡 Verify the server at 2606:4700:20::681a:b61 is operational or remove the DNS record for docs.foreignpolicy.com.
medium
Non-responsive IP for docs.foreignpolicy.com: 2606:4700:20::ac43:449f
The subdomain docs.foreignpolicy.com resolves to 2606:4700:20::ac43:449f which is not responding on ports 80 or 443. This may indicate a decommissioned server.
💡 Verify the server at 2606:4700:20::ac43:449f is operational or remove the DNS record for docs.foreignpolicy.com.
medium
Non-responsive IP for status.foreignpolicy.com: 2606:4700:20::681a:b61
The subdomain status.foreignpolicy.com resolves to 2606:4700:20::681a:b61 which is not responding on ports 80 or 443. This may indicate a decommissioned server.
💡 Verify the server at 2606:4700:20::681a:b61 is operational or remove the DNS record for status.foreignpolicy.com.
medium
Non-responsive IP for status.foreignpolicy.com: 2606:4700:20::681a:a61
The subdomain status.foreignpolicy.com resolves to 2606:4700:20::681a:a61 which is not responding on ports 80 or 443. This may indicate a decommissioned server.
💡 Verify the server at 2606:4700:20::681a:a61 is operational or remove the DNS record for status.foreignpolicy.com.
medium
Non-responsive IP for status.foreignpolicy.com: 2606:4700:20::ac43:449f
The subdomain status.foreignpolicy.com resolves to 2606:4700:20::ac43:449f which is not responding on ports 80 or 443. This may indicate a decommissioned server.
💡 Verify the server at 2606:4700:20::ac43:449f is operational or remove the DNS record for status.foreignpolicy.com.
medium
Non-responsive IP for git.foreignpolicy.com: 2606:4700:20::681a:a61
The subdomain git.foreignpolicy.com resolves to 2606:4700:20::681a:a61 which is not responding on ports 80 or 443. This may indicate a decommissioned server.
💡 Verify the server at 2606:4700:20::681a:a61 is operational or remove the DNS record for git.foreignpolicy.com.
medium
Non-responsive IP for git.foreignpolicy.com: 2606:4700:20::681a:b61
The subdomain git.foreignpolicy.com resolves to 2606:4700:20::681a:b61 which is not responding on ports 80 or 443. This may indicate a decommissioned server.
💡 Verify the server at 2606:4700:20::681a:b61 is operational or remove the DNS record for git.foreignpolicy.com.
medium
Non-responsive IP for git.foreignpolicy.com: 2606:4700:20::ac43:449f
The subdomain git.foreignpolicy.com resolves to 2606:4700:20::ac43:449f which is not responding on ports 80 or 443. This may indicate a decommissioned server.
💡 Verify the server at 2606:4700:20::ac43:449f is operational or remove the DNS record for git.foreignpolicy.com.
medium
Non-responsive IP for ci.foreignpolicy.com: 2606:4700:20::ac43:449f
The subdomain ci.foreignpolicy.com resolves to 2606:4700:20::ac43:449f which is not responding on ports 80 or 443. This may indicate a decommissioned server.
💡 Verify the server at 2606:4700:20::ac43:449f is operational or remove the DNS record for ci.foreignpolicy.com.
medium
Non-responsive IP for ci.foreignpolicy.com: 2606:4700:20::681a:b61
The subdomain ci.foreignpolicy.com resolves to 2606:4700:20::681a:b61 which is not responding on ports 80 or 443. This may indicate a decommissioned server.
💡 Verify the server at 2606:4700:20::681a:b61 is operational or remove the DNS record for ci.foreignpolicy.com.
medium
Non-responsive IP for ci.foreignpolicy.com: 2606:4700:20::681a:a61
The subdomain ci.foreignpolicy.com resolves to 2606:4700:20::681a:a61 which is not responding on ports 80 or 443. This may indicate a decommissioned server.
💡 Verify the server at 2606:4700:20::681a:a61 is operational or remove the DNS record for ci.foreignpolicy.com.
medium
Non-responsive IP for jenkins.foreignpolicy.com: 2606:4700:20::681a:b61
The subdomain jenkins.foreignpolicy.com resolves to 2606:4700:20::681a:b61 which is not responding on ports 80 or 443. This may indicate a decommissioned server.
💡 Verify the server at 2606:4700:20::681a:b61 is operational or remove the DNS record for jenkins.foreignpolicy.com.
medium
Non-responsive IP for jenkins.foreignpolicy.com: 2606:4700:20::ac43:449f
The subdomain jenkins.foreignpolicy.com resolves to 2606:4700:20::ac43:449f which is not responding on ports 80 or 443. This may indicate a decommissioned server.
💡 Verify the server at 2606:4700:20::ac43:449f is operational or remove the DNS record for jenkins.foreignpolicy.com.
medium
Non-responsive IP for jenkins.foreignpolicy.com: 2606:4700:20::681a:a61
The subdomain jenkins.foreignpolicy.com resolves to 2606:4700:20::681a:a61 which is not responding on ports 80 or 443. This may indicate a decommissioned server.
💡 Verify the server at 2606:4700:20::681a:a61 is operational or remove the DNS record for jenkins.foreignpolicy.com.
medium
Non-responsive IP for grafana.foreignpolicy.com: 2606:4700:20::681a:a61
The subdomain grafana.foreignpolicy.com resolves to 2606:4700:20::681a:a61 which is not responding on ports 80 or 443. This may indicate a decommissioned server.
💡 Verify the server at 2606:4700:20::681a:a61 is operational or remove the DNS record for grafana.foreignpolicy.com.
medium
Non-responsive IP for grafana.foreignpolicy.com: 2606:4700:20::681a:b61
The subdomain grafana.foreignpolicy.com resolves to 2606:4700:20::681a:b61 which is not responding on ports 80 or 443. This may indicate a decommissioned server.
💡 Verify the server at 2606:4700:20::681a:b61 is operational or remove the DNS record for grafana.foreignpolicy.com.
medium
Non-responsive IP for grafana.foreignpolicy.com: 2606:4700:20::ac43:449f
The subdomain grafana.foreignpolicy.com resolves to 2606:4700:20::ac43:449f which is not responding on ports 80 or 443. This may indicate a decommissioned server.
💡 Verify the server at 2606:4700:20::ac43:449f is operational or remove the DNS record for grafana.foreignpolicy.com.
medium
Non-responsive IP for prometheus.foreignpolicy.com: 2606:4700:20::681a:b61
The subdomain prometheus.foreignpolicy.com resolves to 2606:4700:20::681a:b61 which is not responding on ports 80 or 443. This may indicate a decommissioned server.
💡 Verify the server at 2606:4700:20::681a:b61 is operational or remove the DNS record for prometheus.foreignpolicy.com.
medium
Non-responsive IP for prometheus.foreignpolicy.com: 2606:4700:20::ac43:449f
The subdomain prometheus.foreignpolicy.com resolves to 2606:4700:20::ac43:449f which is not responding on ports 80 or 443. This may indicate a decommissioned server.
💡 Verify the server at 2606:4700:20::ac43:449f is operational or remove the DNS record for prometheus.foreignpolicy.com.
medium
Non-responsive IP for prometheus.foreignpolicy.com: 2606:4700:20::681a:a61
The subdomain prometheus.foreignpolicy.com resolves to 2606:4700:20::681a:a61 which is not responding on ports 80 or 443. This may indicate a decommissioned server.
💡 Verify the server at 2606:4700:20::681a:a61 is operational or remove the DNS record for prometheus.foreignpolicy.com.
medium
Non-responsive IP for kibana.foreignpolicy.com: 2606:4700:20::ac43:449f
The subdomain kibana.foreignpolicy.com resolves to 2606:4700:20::ac43:449f which is not responding on ports 80 or 443. This may indicate a decommissioned server.
💡 Verify the server at 2606:4700:20::ac43:449f is operational or remove the DNS record for kibana.foreignpolicy.com.
medium
Non-responsive IP for kibana.foreignpolicy.com: 2606:4700:20::681a:a61
The subdomain kibana.foreignpolicy.com resolves to 2606:4700:20::681a:a61 which is not responding on ports 80 or 443. This may indicate a decommissioned server.
💡 Verify the server at 2606:4700:20::681a:a61 is operational or remove the DNS record for kibana.foreignpolicy.com.
medium
Non-responsive IP for kibana.foreignpolicy.com: 2606:4700:20::681a:b61
The subdomain kibana.foreignpolicy.com resolves to 2606:4700:20::681a:b61 which is not responding on ports 80 or 443. This may indicate a decommissioned server.
💡 Verify the server at 2606:4700:20::681a:b61 is operational or remove the DNS record for kibana.foreignpolicy.com.
medium
Non-responsive IP for elastic.foreignpolicy.com: 2606:4700:20::681a:a61
The subdomain elastic.foreignpolicy.com resolves to 2606:4700:20::681a:a61 which is not responding on ports 80 or 443. This may indicate a decommissioned server.
💡 Verify the server at 2606:4700:20::681a:a61 is operational or remove the DNS record for elastic.foreignpolicy.com.
medium
Non-responsive IP for elastic.foreignpolicy.com: 2606:4700:20::ac43:449f
The subdomain elastic.foreignpolicy.com resolves to 2606:4700:20::ac43:449f which is not responding on ports 80 or 443. This may indicate a decommissioned server.
💡 Verify the server at 2606:4700:20::ac43:449f is operational or remove the DNS record for elastic.foreignpolicy.com.
medium
Non-responsive IP for elastic.foreignpolicy.com: 2606:4700:20::681a:b61
The subdomain elastic.foreignpolicy.com resolves to 2606:4700:20::681a:b61 which is not responding on ports 80 or 443. This may indicate a decommissioned server.
💡 Verify the server at 2606:4700:20::681a:b61 is operational or remove the DNS record for elastic.foreignpolicy.com.
medium
DNSSEC is not enabled
No DNSKEY or DS records were found. DNS responses are not cryptographically authenticated.
💡 Enable DNSSEC by generating DNSKEY records and publishing DS records at the registrar.
medium
Domain enumerability: low
The domain has low enumerability. Proper NSEC3 configuration and limited CT exposure reduce the attack surface.
low
All MX records resolve correctly
No dangling MX records detected — all MX hostnames resolve to valid IP addresses.
pass
Explicit MX records present
The domain has explicit MX records — no implicit A-record fallback delivery.
pass
No internal information leakage detected
No non-routable IP addresses or internal references were found in public DNS records.
pass
No excessive DNS information exposure detected
No HINFO, LOC, RP records, version disclosures, or zone walking vulnerabilities were found.
pass
0 subdomain(s) discovered for foreignpolicy.com
Subdomains were enumerated via Certificate Transparency logs, DNS wordlist brute-forcing, and DNS record analysis.
informational
0 certificate(s) found in CT logs
Certificate Transparency logs contain 0 certificate(s) for foreignpolicy.com and its subdomains. Each certificate reveals subdomain names.
informational
Wildcard DNS record detected
A wildcard DNS record exists for *.foreignpolicy.com, resolving to 172.67.68.159, 104.26.11.97, 104.26.10.97. Wildcard records make subdomain brute-forcing less effective but may mask misconfigurations.
informational
Microsoft Autodiscover endpoint detected
The Autodiscover endpoint at autodiscover.foreignpolicy.com responded with HTTP 404.
informational

Reputation Findings

Missing Strict-Transport-Security on foreignpolicy.com
The Strict-Transport-Security header is not set on https://foreignpolicy.com.
💡 Add the Strict-Transport-Security header with a max-age of at least 31536000 (1 year) and include the includeSubDomains directive.
medium
Missing Strict-Transport-Security on webmail.foreignpolicy.com
The Strict-Transport-Security header is not set on https://webmail.foreignpolicy.com.
💡 Add the Strict-Transport-Security header with a max-age of at least 31536000 (1 year) and include the includeSubDomains directive.
medium
Not listed on any DNS blacklists
Domain and MX IPs checked against 55 DNSBLs — no listings found.
pass
security.txt present
Found security.txt at https://foreignpolicy.com/.well-known/security.txt.
pass
TLS certificate valid for 47 days
Certificate for foreignpolicy.com expires on 2026-07-17.
pass
Certificate issued by WE1
The certificate for foreignpolicy.com is issued by a third-party CA.
pass
Signature algorithm: ecdsa-with-sha256
The certificate for foreignpolicy.com uses an acceptable signature algorithm.
pass
ECC key: 256 bits
The certificate for foreignpolicy.com uses an adequate ECC key of 256 bits.
pass
SCTs present in certificate
The certificate for foreignpolicy.com contains Signed Certificate Timestamps.
pass
No weak ciphers detected
No known weak cipher suites detected on foreignpolicy.com.
pass
No disposable email provider MX records
MX records for foreignpolicy.com do not match known disposable email provider patterns.
pass
No wildcard MX records
No wildcard MX records detected for foreignpolicy.com.
pass
TLD has good reputation
The .com TLD is not on known abuse watchlists.
pass
DMARC reporting destinations look legitimate
DMARC rua/ruf addresses do not point to known URL shortener services.
pass
MX records point to stable infrastructure
No MX records point to known dynamic DNS service domains.
pass
Strong TLS configuration on primary MX
Primary MX (aspmx.l.google.com) uses TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 including Forward Secrecy.
pass
SMTP banner from hosted mail provider
The MX (aspmx.l.google.com) is a hosted mail service. Banner alignment is managed by the provider and not actionable by the domain owner.
pass
Google Safe Browsing DNS check — no flag detected
DNS-based Safe Browsing lookup returned no results. Full verification requires the Google Safe Browsing API key.
informational
Abuse contacts found for MX IPs
Abuse contact information retrieved via abusix.org DNS lookup.
informational
PhishTank — API key required
PhishTank phishing database check requires an API key.
informational
Sender Score — API key required
Sender Score reputation check requires an API key.
informational
Cisco Talos — API key required
Cisco Talos IP reputation check requires an API key.
informational
WHOIS lookup failed
Could not retrieve WHOIS data for foreignpolicy.com.
informational
Could not determine domain age
WHOIS creation date could not be parsed for foreignpolicy.com.
informational
Bulletproof Hosting Detection — API key required
Checking IPs against known bulletproof hosting providers requires a threat intelligence API key.
informational
Threat Intelligence Feeds — API key required
Checking domain against threat intelligence feeds requires API keys (e.g., VirusTotal, AbuseIPDB).
informational
Typosquat detected: oreignpolicy.com, foregnpolicy.com, foriegnpolicy.com
3 registered lookalike domain(s) that could be used for phishing against your brand. Domains with MX records can send and receive email, making them high-risk phishing vectors.
informational

Dependency Chains

DMARC Authentication Chain (SPF)
DMARC uses SPF to verify that emails come from authorized servers
SPF Record SPF record found and configured → DMARC Policy DMARC policy: quarantine
DMARC Authentication Chain (DKIM)
DMARC uses DKIM to verify that emails have not been tampered with
DKIM Signature DKIM signature missing → DMARC Policy DMARC policy: quarantine
⚠️ DKIM signature is missing. DMARC relies on DKIM to verify email integrity and prevent tampering. Without DKIM, DMARC alignment will fail for cryptographic verification.
Mail Server Identity: aspmx.l.google.com
PTR record proves mail server legitimacy
MX: aspmx.l.google.com Mail server at 209.85.203.27 → PTR Record Reverse DNS: dh-in-f27.1e100.net
Mail Server Identity: alt3.aspmx.l.google.com
PTR record proves mail server legitimacy
MX: alt3.aspmx.l.google.com Mail server at 192.178.213.27 → PTR Record Reverse DNS: yugrqzs-in-f27.1e100.net
Mail Server Identity: alt4.aspmx.l.google.com
PTR record proves mail server legitimacy
MX: alt4.aspmx.l.google.com Mail server at 142.251.127.27 → PTR Record Reverse DNS: lcfrai-in-f27.1e100.net
Mail Server Identity: alt1.aspmx.l.google.com
PTR record proves mail server legitimacy
MX: alt1.aspmx.l.google.com Mail server at 173.194.76.26 → PTR Record Reverse DNS: ws-in-f26.1e100.net
Mail Server Identity: alt2.aspmx.l.google.com
PTR record proves mail server legitimacy
MX: alt2.aspmx.l.google.com Mail server at 142.250.102.26 → PTR Record Reverse DNS: rb-in-f26.1e100.net
Mail Server Reputation: aspmx.l.google.com
RBL check ensures server is not blacklisted
MX: aspmx.l.google.com Mail server at 209.85.203.27 → RBL Status Not blacklisted
Mail Server Reputation: alt3.aspmx.l.google.com
RBL check ensures server is not blacklisted
MX: alt3.aspmx.l.google.com Mail server at 192.178.213.27 → RBL Status Not blacklisted
Mail Server Reputation: alt4.aspmx.l.google.com
RBL check ensures server is not blacklisted
MX: alt4.aspmx.l.google.com Mail server at 142.251.127.27 → RBL Status Not blacklisted
Mail Server Reputation: alt1.aspmx.l.google.com
RBL check ensures server is not blacklisted
MX: alt1.aspmx.l.google.com Mail server at 173.194.76.26 → RBL Status Not blacklisted
Mail Server Reputation: alt2.aspmx.l.google.com
RBL check ensures server is not blacklisted
MX: alt2.aspmx.l.google.com Mail server at 142.250.102.26 → RBL Status Not blacklisted
Enforced Encryption Chain
MTA-STS enforces TLS encryption to prevent man-in-the-middle attacks
TLS Support Mail servers support TLS encryption → MTA-STS Policy MTA-STS not configured
⚠️ MTA-STS policy is missing. Even with TLS support, you lack the enforcement layer that prevents attackers from stripping encryption (downgrade attacks).
Brand Identity Chain
BIMI displays your logo in email clients, but requires DMARC enforcement
DMARC Enforcement DMARC policy: quarantine → BIMI Record BIMI not configured
⚠️ BIMI record is missing. Even with DMARC enforcement, you need to configure BIMI to display your brand logo in supported email clients.
TLS Monitoring Chain
TLS-RPT provides reports about TLS connection failures
TLS Support Mail servers support TLS encryption → TLS-RPT Reporting TLS-RPT not configured
⚠️ TLS-RPT is not configured. Without TLS reporting, you have no visibility into TLS connection failures that may be impacting email delivery.

Security Checks

MX Records
✓
SPF Record
✓
DKIM Record
✗
DMARC Policy
✓
BIMI Record
✗
CAA Records
✓
DNSSEC
✗
MTA-STS
✗
TLS-RPT
✗

Embed Badge

Display your domain's security grade on your website or README:

foreignpolicy.com Email Security Grade
<img src="https://scan.ractermx.com/badge/foreignpolicy.com.svg" alt="Email Security Grade">

Want to re-scan this domain for updated results?

Scan foreignpolicy.com Again