highSPF authorizes huge IP ranges (ip4:40.92.0.0/15, ip4:52.100.0.0/15)
Very large ranges (ip4:40.92.0.0/15, ip4:52.100.0.0/15) let anyone inside them - for example any customer of the same cloud provider - send mail as you.
Public security report
maersk.com security rating
D
69/100
A means lowest risk and F means highest, like a school report card. How the score is calculated →
Scanned 2026-10-30 · 14 issue(s) found · 15 checks passed
What this scan found
CyberTrust assessed maersk.com passively — using only information that is publicly visible on the internet: DNS records, certificates, response headers and reachable services. The result is 69/100, grade D, where A means lowest risk and F means highest, like a school report card.
Email spoofing is blocked: maersk.com publishes a DMARC record with p=reject at 100% coverage, so mail forged from @maersk.com should be rejected by major providers.
Strongest area: external attack surface (100/100). Weakest area: HTTP security headers (6/100).
14 issue(s) need attention (1 high, 2 medium, 11 low), while 15 checks passed.
Infrastructure observed: mail is hosted by microsoft, DNS is served by akamai, traffic is fronted by akamai.
239 subdomain(s) of maersk.com resolve publicly.
Score by category
| Area | Score | Grade | Issues |
|---|---|---|---|
| DNS hygiene | 92 | A | 1 |
| email spoofing defences (SPF/DKIM/DMARC) | 52 | F | 2 |
| external attack surface | 100 | A | 0 |
| IP threat intelligence | — | — | 0 |
| reputation and credential exposure | 100 | A | 0 |
| TLS encryption and certificates | 64 | D | 2 |
| HTTP security headers | 6 | F | 9 |
Issues found (14)
mediumCertificate expires in 13 days
Only 13 days remain, which usually means automated renewal already failed - unattended, that becomes a full outage at expiry.
mediumHSTS not enabled
Without it, an attacker can strip SSL on the first HTTP request and keep the user on plaintext (SSL stripping), a common attack on public Wi-Fi.
lowNo OCSP stapling
The server does not staple the certificate revocation status. Every revocation check becomes an extra round trip to the CA, which slows the first visit and, if the CA endpoint is unreachable or the visitor's network blocks it, leaves the browser without a usable revocation status.
lowX-Content-Type-Options missing
Without it a file uploaded as an image can be executed as HTML/JavaScript on your domain, stealing same-site cookies and sessions.
lowHSTS preload not enabled
Even with HSTS on, the very first visit is still exposed to SSL-stripping: the header only takes effect after one successful HTTPS visit. Browsers ship a preload list (Chromium's list is used by Chrome, Edge, Safari and Firefox) so the first connection goes straight to HTTPS.
lowWeak DKIM key: 1024-bit RSA (selector selector1)
At 1024 bits (selector selector1) the key is considered weak; 1024-bit keys can be broken cheaply, letting attackers sign mail that passes DKIM.
lowCookies without Secure/HttpOnly (bm_sz)
Missing Secure lets cookies travel in plaintext; missing HttpOnly lets injected scripts steal sessions; missing SameSite enables CSRF. Affected: bm_sz.
lowContent Security Policy is weak (script-src 'unsafe-inline'; script-src 'unsafe-eval')
The policy is too permissive (script-src 'unsafe-inline'; script-src 'unsafe-eval'), so injected scripts still run while giving a false sense of security.
lowDNSSEC not enabled
Without it, attackers can poison caches or forge answers and send visitors to a lookalike server that harvests credentials.
lowNo Content Security Policy
Without it, any injected script runs: session theft, fake payment forms, or card-skimming scripts on compromised pages. CSP limits the damage even when something else fails.
lowsecurity.txt has expired
An expired Expires date makes reporters assume the contact is dead, so you lose a low-cost source of vulnerability reports.
lowServer reveals software versions
Exact versions let attackers look up ready-made exploits instead of probing - most intrusions start with a version scan.
lowNo clickjacking protection
Without it, attackers overlay a transparent frame of your page and trick users into clicking real actions such as transfers or password changes (clickjacking).
Checks passed
- Mail exchangers configured
- DMARC policy is enforced
- MTA-STS enforces encrypted mail delivery
- TLS reporting (TLS-RPT) enabled
- Name servers are redundant
- CAA restricts which CAs may issue certificates
- HSTS enabled
- Clickjacking protection enabled
- No API keys found in front-end bundles
- Only modern TLS versions are enabled
- No weak cipher suites accepted
- Certificate is valid and trusted
- No risky services found exposed
- No shadow-AI services exposed
- No mail-server IP on spam blocklists
What we detected
- mail provider
- microsoft
- dns provider
- akamai
- cdn
- akamai
- subdomain count
- 239
What could not be fully checked
- No BIMI record
BIMI shows your logo next to authenticated mail in supporting inboxes (requires an enforcing DMARC policy). It is a trust signal rather than a security control, so it does not affect your score. - Wildcard DNS in use
Every subdomain name resolves. This hides typos and can make phishing subdomains look legitimate. - No Referrer-Policy
Browsers default to strict-origin-when-cross-origin today; setting it explicitly is good hygiene. - No Permissions-Policy
Permissions-Policy disables powerful browser features (camera, microphone, geolocation) you do not use. - No security.txt
security.txt (RFC 9116) tells security researchers how to report vulnerabilities to you instead of posting them publicly. - Target resolves to a private address
- Website returned an error page — partly unassessed
The page returned HTTP 403 (often a firewall challenge for automated clients), so most header and content checks could not run. HSTS was still assessed where the response is reliable, but this category is only partially evaluated and its score should be read as incomplete. - Website not reachable
The site could not be fetched, so its response headers and page content were not checked. - HTTPS not available on port 443
The TLS checks could not run on this host, so its TLS configuration was not verified.
Frequently asked questions about maersk.com security
- Does maersk.com have DMARC protection against email spoofing?
- Yes. maersk.com publishes a DMARC record with p=reject at 100% coverage, so receiving providers should reject mail forged from @maersk.com.
- How is maersk.com's D security grade calculated?
- CyberTrust scores maersk.com passively across 6 area(s) — external attack surface 100/100; reputation and credential exposure 100/100; DNS hygiene 92/100; TLS encryption and certificates 64/100; email spoofing defences (SPF/DKIM/DMARC) 52/100; HTTP security headers 6/100 — and combines them by weight into the overall score of 69/100, which maps to grade D.
- What is the most serious issue found on maersk.com?
- SPF authorizes huge IP ranges (ip4:40.92.0.0/15, ip4:52.100.0.0/15) (severity high). Very large ranges (ip4:40.92.0.0/15, ip4:52.100.0.0/15) let anyone inside them - for example any customer of the same cloud provider - send mail as you. Fixing it is worth about +10 points.
- How many subdomains does maersk.com expose?
- This scan observed 239 publicly resolvable subdomain(s) for maersk.com. Verified owners get the full list, with each host's open ports and running services.
What a verified owner of maersk.com sees
Everything above is what anyone can observe from the internet. Domain owners who verify ownership additionally get the full asset inventory — every subdomain with its open ports and running services — look-alike and typosquatting domains registered against the brand, credential-exposure monitoring, and copy-paste fixes for each finding.
Verify ownership of maersk.com (free) → Open the live interactive report →