Public security report
93/100
A means lowest risk and F means highest, like a school report card. How the score is calculated →
Scanned 2026-10-30 · 4 issue(s) found · 12 checks passed · 1 check(s) could not complete
CyberTrust assessed stripe.com passively — using only information that is publicly visible on the internet: DNS records, certificates, response headers and reachable services. The result is 93/100, grade A, where A means lowest risk and F means highest, like a school report card.
Email spoofing is blocked: stripe.com publishes a DMARC record with p=reject at 100% coverage, so mail forged from @stripe.com should be rejected by major providers.
Strongest area: HTTP security headers (100/100). Weakest area: email spoofing defences (SPF/DKIM/DMARC) (84/100).
4 issue(s) need attention (4 low), while 12 checks passed.
Infrastructure observed: mail is hosted by google, DNS is served by route53, the web server identifies as nginx.
169 subdomain(s) of stripe.com resolve publicly.
1 check(s) could not complete (for example the provider refused the connection); they are excluded from the score rather than counted as passes.
| Area | Score | Grade | Issues |
|---|---|---|---|
| DNS hygiene | 92 | A | 1 |
| email spoofing defences (SPF/DKIM/DMARC) | 84 | B | 2 |
| external attack surface | 100 | A | 0 |
| IP threat intelligence | — | — | 0 |
| reputation and credential exposure | 100 | A | 0 |
| TLS encryption and certificates | 84 | B | 1 |
| HTTP security headers | 100 | A | 0 |
The server does not staple the certificate revocation status. Every revocation check becomes an extra round trip to the CA, which slows the first visit and, if the CA endpoint is unreachable or the visitor's network blocks it, leaves the browser without a usable revocation status.
At 1024 bits (selector google) the key is considered weak; 1024-bit keys can be broken cheaply, letting attackers sign mail that passes DKIM.
Without it an attacker on the network path can force a downgrade to plaintext and read or modify mail such as contracts and payment details.
Without it, attackers can poison caches or forge answers and send visitors to a lookalike server that harvests credentials.
Everything above is what anyone can observe from the internet. Domain owners who verify ownership additionally get the full asset inventory — every subdomain with its open ports and running services — look-alike and typosquatting domains registered against the brand, credential-exposure monitoring, and copy-paste fixes for each finding.
Verify ownership of stripe.com (free) → Open the live interactive report →