Does wise.com have DMARC protection against email spoofing?

Yes. wise.com publishes a DMARC record with p=reject at 100% coverage, so receiving providers should reject mail forged from @wise.com.

How is wise.com's B security grade calculated?

CyberTrust scores wise.com passively across 6 area(s) — external attack surface 100/100; reputation and credential exposure 100/100; email spoofing defences (SPF/DKIM/DMARC) 92/100; TLS encryption and certificates 88/100; DNS hygiene 84/100; HTTP security headers 36/100 — and combines them by weight into the overall score of 86/100, which maps to grade B.

How many subdomains does wise.com expose?

This scan observed 56 publicly resolvable subdomain(s) for wise.com. Verified owners get the full list, with each host's open ports and running services.

Public security report

wise.com security rating

86/100

A means lowest risk and F means highest, like a school report card. How the score is calculated →

Scanned 2026-10-30 · 10 issue(s) found · 18 checks passed

Re-scan wise.com now

What this scan found

CyberTrust assessed wise.com passively — using only information that is publicly visible on the internet: DNS records, certificates, response headers and reachable services. The result is 86/100, grade B, where A means lowest risk and F means highest, like a school report card.

Email spoofing is blocked: wise.com publishes a DMARC record with p=reject at 100% coverage, so mail forged from @wise.com should be rejected by major providers.

Strongest area: external attack surface (100/100). Weakest area: HTTP security headers (36/100).

10 issue(s) need attention (10 low), while 18 checks passed.

Infrastructure observed: mail is hosted by google, DNS is served by cloudflare, traffic is fronted by cloudflare, the web server identifies as cloudflare.

56 subdomain(s) of wise.com resolve publicly.

Score by category

Area	Score	Grade	Issues
DNS hygiene	84	B	2
email spoofing defences (SPF/DKIM/DMARC)	92	A	1
external attack surface	100	A	0
IP threat intelligence	—	—	0
reputation and credential exposure	100	A	0
TLS encryption and certificates	88	B	1
HTTP security headers	36	F	6

Issues found (10)

lowContent Security Policy is weak (script-src 'unsafe-inline'; script-src 'unsafe-eval')

The policy is too permissive (script-src 'unsafe-inline'; script-src 'unsafe-eval'), so injected scripts still run while giving a false sense of security.

4 asset(s) affected · worth +2 points · how to set HSTS, CSP and other security headers →

lowNo Content Security Policy

Without it, any injected script runs: session theft, fake payment forms, or card-skimming scripts on compromised pages. CSP limits the damage even when something else fails.

3 asset(s) affected · worth +2 points · how to set HSTS, CSP and other security headers →

lowNo clickjacking protection

Without it, attackers overlay a transparent frame of your page and trick users into clicking real actions such as transfers or password changes (clickjacking).

3 asset(s) affected · worth +2 points · how to set HSTS, CSP and other security headers →

lowWeak DKIM key: 1024-bit RSA (selector k1)

At 1024 bits (selector k1) the key is considered weak; 1024-bit keys can be broken cheaply, letting attackers sign mail that passes DKIM.

1 asset(s) affected · worth +2 points · look up DKIM keys with the free DKIM tool →

lowNo OCSP stapling

The server does not staple the certificate revocation status. Every revocation check becomes an extra round trip to the CA, which slows the first visit and, if the CA endpoint is unreachable or the visitor's network blocks it, leaves the browser without a usable revocation status.

3 asset(s) affected · worth +1 points · check a certificate with the free SSL tool →

lowHSTS preload not enabled

Even with HSTS on, the very first visit is still exposed to SSL-stripping: the header only takes effect after one successful HTTPS visit. Browsers ship a preload list (Chromium's list is used by Chrome, Edge, Safari and Firefox) so the first connection goes straight to HTTPS.

2 asset(s) affected · worth +1 points · how to set HSTS, CSP and other security headers →

lowNo CAA record

Without it any CA may issue certificates for your domain, enabling a lookalike site with a valid padlock.

1 asset(s) affected · worth +1 points · see who can issue certificates with the free CAA tool →

lowDNSSEC not enabled

Without it, attackers can poison caches or forge answers and send visitors to a lookalike server that harvests credentials.

1 asset(s) affected · worth +1 points · what DNSSEC prevents and how to enable it →

lowHSTS max-age is only 3 days

At 3 days the protection expires between visits, periodically reopening the window for SSL stripping.

1 asset(s) affected · worth +1 points · how to set HSTS, CSP and other security headers →

lowsecurity.txt has expired

An expired Expires date makes reporters assume the contact is dead, so you lose a low-cost source of vulnerability reports.

1 asset(s) affected · worth +1 points · how to set HSTS, CSP and other security headers →

Checks passed

Mail exchangers configured
SPF record is valid
DMARC policy is enforced
BIMI brand logo published
MTA-STS enforces encrypted mail delivery
TLS reporting (TLS-RPT) enabled
Name servers are redundant
HSTS enabled
Clickjacking protection enabled
MIME sniffing disabled
Content Security Policy in place
No API keys found in front-end bundles
Only modern TLS versions are enabled
No weak cipher suites accepted
Certificate is valid and trusted
No risky services found exposed
No shadow-AI services exposed
No mail-server IP on spam blocklists

What we detected

mail provider: google
dns provider: cloudflare
cdn: cloudflare
web server: cloudflare
subdomain count: 56

What could not be fully checked

No Referrer-Policy 6 host(s)
Browsers default to strict-origin-when-cross-origin today; setting it explicitly is good hygiene.
No security.txt
security.txt (RFC 9116) tells security researchers how to report vulnerabilities to you instead of posting them publicly.
No Permissions-Policy 5 host(s)
Permissions-Policy disables powerful browser features (camera, microphone, geolocation) you do not use.
Website returned an error page — partly unassessed
The page returned HTTP 404 (often a firewall challenge for automated clients), so most header and content checks could not run. HSTS was still assessed where the response is reliable, but this category is only partially evaluated and its score should be read as incomplete.
TLS 1.3 not enabled 2 host(s)
TLS 1.3 is faster and removes legacy cryptography. Recommended, but not required.
RSA key exchange still accepted 2 host(s)
Static RSA key exchange is kept for old clients. It lacks forward secrecy but is not scored when ECDHE is available.

Frequently asked questions about wise.com security

Does wise.com have DMARC protection against email spoofing?: Yes. wise.com publishes a DMARC record with p=reject at 100% coverage, so receiving providers should reject mail forged from @wise.com.
How is wise.com's B security grade calculated?: CyberTrust scores wise.com passively across 6 area(s) — external attack surface 100/100; reputation and credential exposure 100/100; email spoofing defences (SPF/DKIM/DMARC) 92/100; TLS encryption and certificates 88/100; DNS hygiene 84/100; HTTP security headers 36/100 — and combines them by weight into the overall score of 86/100, which maps to grade B.
What is the most serious issue found on wise.com?: Content Security Policy is weak (script-src 'unsafe-inline'; script-src 'unsafe-eval') (severity low). The policy is too permissive (script-src 'unsafe-inline'; script-src 'unsafe-eval'), so injected scripts still run while giving a false sense of security. Fixing it is worth about +2 points.
How many subdomains does wise.com expose?: This scan observed 56 publicly resolvable subdomain(s) for wise.com. Verified owners get the full list, with each host's open ports and running services.

What a verified owner of wise.com sees

Everything above is what anyone can observe from the internet. Domain owners who verify ownership additionally get the full asset inventory — every subdomain with its open ports and running services — look-alike and typosquatting domains registered against the brand, credential-exposure monitoring, and copy-paste fixes for each finding.

Verify ownership of wise.com (free) → Open the live interactive report →