DNS report
netflix.com
Complete DNS, mail, web and security analysis.
Cached report
Report created: 2026-09-19 22:54:53 EDT
12 h 54 min ago
Refresh report
DNS cache tools
If you have recently made DNS changes and they are not yet reflected in the report, you can try to flush the DNS cache of these public resolvers: The domain name will be copied to your clipboard automatically when clicking on a button
Category Status Test Details
WHOIS0.3 ms
Domain Status
Source: WHOIS (port 43) whois.markmonitor.com
RegistrarMarkMonitor, Inc.
Name Serversns-1372.awsdns-43.org
ns-659.awsdns-18.net
ns-81.awsdns-10.com
ns-1984.awsdns-56.co.uk
WHOIS NS match DNS
Updated Date2025-10-09 12:13:44+0000
Creation Date1997-11-11 05:00:00+0000
Registry Expiry Date✅ 2027-11-10 00:00:00+0000
Domain StatusclientUpdateProhibited (https://www.icann.org/epp#clientUpdateProhibited)
clientTransferProhibited (https://www.icann.org/epp#clientTransferProhibited)
clientDeleteProhibited (https://www.icann.org/epp#clientDeleteProhibited)
serverUpdateProhibited (https://www.icann.org/epp#serverUpdateProhibited)
serverTransferProhibited (https://www.icann.org/epp#serverTransferProhibited)
serverDeleteProhibited (https://www.icann.org/epp#serverDeleteProhibited)
Registrar lock enabled
The domain exposes a transfer lock status, such as clientTransferProhibited or serverTransferProhibited.
PARENT0.0 ms
Domain NS records
Nameserver records returned by the parent servers are:

ns-81.awsdns-10.com [2600:9000:5300:5100::1] (GLUE) [TTL=172800]
ns-659.awsdns-18.net [205.251.194.147, 2600:9000:5302:9300::1] (NO GLUE) [TTL=172800]
ns-1984.awsdns-56.co.uk [205.251.199.192, 2600:9000:5307:c000::1] (NO GLUE) [TTL=172800]
ns-1372.awsdns-43.org [205.251.197.92, 2600:9000:5305:5c00::1] (NO GLUE) [TTL=172800]

m.gtld-servers.net was kind enough to give us that information.
TLD Parent Check
m.gtld-servers.net has information for your TLD.
This is a good thing as there are some other domain extensions like "co.us" for example that are missing a direct check.
Your nameservers are listed
m.gtld-servers.net has your nameservers listed.
This is a must if you want to be found as anyone that does not know your DNS servers will first ask the parent nameservers.
DNS Parent sent Glue
1 of 4 nameservers sent GLUE.

The parent nameserver a.gtld-servers.net is not sending out GLUE for every nameserver listed, meaning it is sending your nameserver hostnames without their corresponding A records. This is acceptable, but it requires an extra A record lookup, which may slightly delay DNS resolution. This often occurs when nameservers are on a different TLD (e.g., domain.com with nameserver ns.otherdomain.com).
Nameservers A records
Every nameserver listed has A records.
This is a must if you want to be found.
NS4372.7 ms
NS records from your NameServers
NS records returned by the currently delegated nameservers are:

Hostname IP TTL Latency Last SOA change Last WHOIS change
ns-1372.awsdns-43.org 205.251.197.92 14400 26 ms N/A 2025-10-09 12:13:44+0000
ns-1984.awsdns-56.co.uk 205.251.199.192 14400 38 ms N/A 2025-10-09 12:13:44+0000
ns-659.awsdns-18.net 205.251.194.147 14400 234 ms N/A 2025-10-09 12:13:44+0000
ns-81.awsdns-10.com 2600:9000:5300:5100::1 14400 35 ms N/A 2025-10-09 12:13:44+0000

All NS records have the same TTL: 14400 seconds.

Public Resolver
🌐 Cloudflare (GLOBAL)
1.1.1.1
🌐 Google DNS (GLOBAL)
8.8.8.8
🌐 Quad9 (GLOBAL)
9.9.9.9
OpenDNS (US)
208.67.222.222
CIRA Canadian Shield (CA)
149.112.121.10
CleanBrowsing (EU)
185.228.168.9
Quad9 (MX)
149.112.112.112
OpenDNS (ZA)
208.67.220.220
AdGuard DNS (EU)
94.140.14.14
ControlD (EU)
76.76.2.0
Yandex (RU)
77.88.8.8
114DNS (CN)
114.114.114.114
Mismatched NS records
The NS records at all your nameservers are identical to those listed by the parent.
DNS servers responded
All nameservers listed at the parent server responded.
Name of nameservers are valid
All of the NS records that your nameservers report seem valid.
Multiple Nameservers
You have 4 nameservers. According to RFC2182 section 5, this is recommended.
Missing nameservers reported by parent
All NS records are the same at the parent and at your nameservers.
Missing nameservers reported by your nameservers
All nameservers returned by the parent server are the same as the ones reported by your nameservers.
Domain CNAMEs
OK. RFC1912 2.4 and RFC2181 10.3 state that there should be no CNAMEs if an NS (or any other) record is present.
NSs CNAME check
OK. RFC1912 2.4 and RFC2181 10.3 state that there should be no CNAMEs if an NS (or any other) record is present.
Different subnets
All nameservers are on the same subnet (can be a risk).
Recursive Queries
ns-1372.awsdns-43.org → ✅ does not allow recursion (good)
ns-1984.awsdns-56.co.uk → ✅ does not allow recursion (good)
ns-659.awsdns-18.net → ✅ does not allow recursion (good)
ns-81.awsdns-10.com → ✅ does not allow recursion (good)
Same Glue
Mismatch between parent GLUE and zone A records:
ns-81.awsdns-10.com → Parent: 2600:9000:5300:5100::1 | Zone: 205.251.192.81
ns-659.awsdns-18.net → Parent: 205.251.194.147, 2600:9000:5302:9300::1 | Zone: 205.251.194.147
ns-1984.awsdns-56.co.uk → Parent: 205.251.199.192, 2600:9000:5307:c000::1 | Zone: 205.251.199.192
ns-1372.awsdns-43.org → Parent: 205.251.197.92, 2600:9000:5305:5c00::1 | Zone: 205.251.197.92
Make sure both match to comply with DNS best practices.
NS Self-IP Consistency
Some nameservers return IPs that differ from their declared A records:
ns-81.awsdns-10.com → Declared: 2600:9000:5300:5100::1 | Resolved: 205.251.192.81
Check your NS host A records are correct and publicly resolvable.
Glue for NS records
GLUE was not sent when I asked your nameservers for your NS records.
This is ok but you should know that in this case an extra A record lookup is required.
The nameservers without glue are:
    205.251.197.92
    205.251.199.192
    205.251.194.147
    205.251.192.81
You can fix this by adding A records to your nameservers.
Nameservers are lame
All the nameservers listed at the parent servers answer authoritatively for your domain.
IPs of nameservers are public
Ok. Looks like the IP addresses of your nameservers are public.
This is a good thing because it will prevent DNS delays and other problems.
DNS servers allow TCP connection
OK. Seems all your DNS servers allow TCP connections.
This is a good thing and useful even if UDP connections are used by default.
Different autonomous systems
All authoritative name servers appear to be in the same autonomous system: AS16509.
Using a single AS reduces resiliency and increases the blast radius of network incidents.
Consider hosting your NS records across multiple autonomous systems.


WARNING: Single point of failure.
Stealth NS records sent
Ok. No stealth NS records are sent
DNSSEC146.1 ms
Zone signed
DNSSEC: Unsigned
No RRSIG record found. The zone is not signed with DNSSEC.
DNSKEY records
No DNSKEY records found.
DS record in parent
No DS record found in the parent zone.
NSEC/NSEC3 record
No NSEC or NSEC3 record found when querying a non-existent subdomain.
This may indicate a misconfiguration or lack of proper DNSSEC denial-of-existence support.
SOA0.1 ms
SOA Record
The SOA (Start of Authority) record is:
    Primary nameserver: ns-81.awsdns-10.com
    Hostmaster E-mail address: awsdns-hostmaster@amazon@com
    Serial #: 1
    Refresh: 7200
    Retry: 900
    Expire: 1209600
    Default TTL: 1800
NSs have same SOA serial
Inconsistent SOA serials returned by your nameservers: 0, 1
SOA MNAME entry
OK. ns-81.awsdns-10.com is listed at the parent servers.
SOA Serial
Your SOA serial number is: 1. This does not match the recommended YYYYMMDDnn format.
SOA REFRESH
Your SOA REFRESH interval is: 7200. OK.
SOA RETRY
Your SOA RETRY value is: 900. OK.
SOA EXPIRE
Your SOA EXPIRE number is: 1209600. Looks OK.
SOA MINIMUM TTL
Minimum TTL is low (1800). Recommended: 1h+ (3600).
A low minimum TTL results in more frequent DNS queries, which can increase server load. A higher value improves cache efficiency.
MX
...
MX Records
TXT0.1 ms
TXT Records
Host Type Value Size TTL
netflix.com TXT "1password-site-verification=BXCRTZRWNVG4PFLIYFIBWSYHX4" 54 30
netflix.com TXT "5f5a7676-2a28-4400-a64e-465626e5ff6b" 36 30
netflix.com TXT "8cd468d7d5994fcc9d350683a8cb07a1" 32 30
netflix.com TXT "anthropic-domain-verification-vxqysx=XDtJHKRTpvy6QvuMuyVMXbMxT" 62 30
netflix.com TXT "apple-domain-verification=Ohlo8qLyb9N4JaIm" 42 30
netflix.com TXT "apple-domain-verification=U1j_Aj0pS5fid78Cag85YGM14jHrzxM-S2ICXc8rGxg" 69 30
netflix.com TXT "appspace-domain-verification=59cd40985507690b0ac0e2c83d24dd6dfa24c7d7571f00b7401e01d5c12332af" 93 30
netflix.com TXT "asv=4853f01b1e9226ed9d0031284948059f" 36 30
netflix.com TXT "atlassian-domain-verification=TX0Efjn8bXAu0o9GAHyYowM0mcu4oDPHFf10cqaDXFCvU9tRB7R/A9oeQcDmEAD8" 94 30
netflix.com TXT "bluebeam-verification=ivn6qi30eug84iz4njykvb8jenp2wm" 52 30
netflix.com TXT "canva-site-verification=DW6T-OKEapKu9QB9ChMocw" 46 30
netflix.com TXT "deepl-domain-verification=f6610dd4c1414006bd6382c115542467" 58 30
netflix.com TXT "docker-verification=5f9a055c-22b9-4d40-be7f-5af4171e1e71" 56 30
netflix.com TXT "docusign=f249396f-8150-48f8-8bd2-705be6e03826" 45 30
netflix.com TXT "docusign=f3d36bef-ec7d-42e5-9334-626611acb127" 45 30
netflix.com TXT "dropbox-domain-verification=htwo11xk2yl1" 40 30
netflix.com TXT "e6060ec6-b362-4acb-9a1f-b80e99d17753" 36 30
netflix.com TXT "elevenlabs=yhxq_JyMuzy2_pQ5B-M4HJ8sZaFLLiQGelMOuBcTWE4" 54 30
netflix.com TXT "facebook-domain-verification=k65vedr09b2tp2q144ho1zewp3xsc6" 59 30
netflix.com TXT "freepik-domain-verification=eeb4ee5ff6237e57ea15d2369b574c68" 60 30
netflix.com TXT "google-site-verification=9DgwSKXMlFzcnW-HuGWef6aVVHWDCQNehxHTq0Ps9IA" 68 30
netflix.com TXT "google-site-verification=F6fRKDfeR1Uqz8qJvmH3HmQQxpu9JYY9GJUFeV3hU3Y" 68 30
netflix.com TXT "google-site-verification=VQKoV3pv-QYIDfbQa1N4r97x8W07veRTK6JhWUavIuc" 68 30
netflix.com TXT "google-site-verification=Wn4h4x_Gf8Zs5qiw88ZingFRjLUNzga-zJXts2UPics" 68 30
netflix.com TXT "google-site-verification=YVxAf7gFR4vFk1RkUwiYt3pzl2AVUP6aPdBgV1qtwcw" 68 30
netflix.com TXT "google-site-verification=a8Lak2UwVjIlmH1xRYU3mJ6nSQ7rJnyf2VKWtH4nKZI" 68 30
netflix.com TXT "google-site-verification=nCi1QdlMabPJOvtQNCo5KaPyDfwog9pDr3d8IN767YA" 68 30
netflix.com TXT "h1-domain-verification=AYCqXFtcqVzAhHLWr58GvY2WrbTfkGeMsijza2jPS2E1qcn1" 71 30
netflix.com TXT "infoblox-domain-mastery=83433630723145c8e700674aa65ad12bf58d7cd22434a5527c383d131ccc354a77" 90 30
netflix.com TXT "jamf-site-verification=vqjVdHx1f_q52DK-WclChA" 45 30
netflix.com TXT "klaviyo-site-verification=UM4UEX" 32 30
netflix.com TXT "klaviyo-site-verification=WwbqJa" 32 30
netflix.com TXT "logmein-verification-code=4FVB4FQ17eVMyHCC7RAApS4Zp" 51 30
netflix.com TXT "logmein-verification-code=905b1ed4-1c2e-466f-b24c-756e6ca39eb5" 62 30
netflix.com TXT "loom-verification=0004053852" 28 30
netflix.com TXT "lucidlink-verification=8XRGA7HR9S7XZ469MR70GSABB0" 49 30
netflix.com TXT "lucidlink-verification=BC5DTMP5YWAJHDNPRF5ASW8QA0" 49 30
netflix.com TXT "lucidlink-verification=GSM5VV6S2T2DZADV5JM8WPBYZM" 49 30
netflix.com TXT "lucidlink-verification=TZFHBCZT2MG33J59D4FB3W9EKG" 49 30
netflix.com TXT "luma-ai-domain-verification-340eet=BLdaj62h2qtpk2yvLLYFNuMA9" 60 30
netflix.com TXT "miro-verification=9ac407d6774b2ec4313b004d40204399e37f3b48" 58 30
netflix.com TXT "neat-pulse-domain-verification-6X6Z7kX=56aa4659-fdcc-42df-802e-f1cce082b1ea" 75 30
netflix.com TXT "notion-domain-verification=MHmHAv2mrRGxVuA3rhIRmz6vwrsAEbsqCR6yRIycSoj" 70 30
netflix.com TXT "smartsheet-site-validation=zZPtdlBFlbl-n54tmRUUcd6Bd8lllpAR" 59 30
netflix.com TXT "sso-domain-verification-7wfrk6=LfxRM5a023zTb2jO6QWeDcZ9e" 56 30
netflix.com TXT "tiktok-domain-verification=e8242b26316716e951678da03b794de5a838482929d5b62ea2e0a3b4baf843f3" 91 30
netflix.com TXT "unity-sso-verification=46eb4cbd-e316-4691-84c2-4f4bce784d84" 59 30
netflix.com TXT "v=spf1 include:_spf_ipv4.netflix.com include:_spf.google.com include:amazonses.com include:servers.mcsv.net include:_spf.salesforce.com include:_spf.createsend.com -all" 168 30
netflix.com TXT "zapier-domain-verification-challenge=d740d03c-47a4-491c-934d-c61bdba6099e" 73 30
Duplicate TXT records
Multiple TXT records were found for the same host/selector. This can break email authentication.
Host/Selector Type Count Status Details
netflix.com Verification 2 Warn Multiple verification tokens detected for Apple verification token. Only one is usually required.
netflix.com Verification 7 Warn Multiple verification tokens detected for Google verification token. Only one is usually required.
SPF
...
SPF Analysis
DMARC27.4 ms
DMARC Configuration
DMARC Record was found:
v=DMARC1; p=reject; fo=1; rua=mailto:[email protected],mailto:[email protected],mailto:[email protected];ruf=mailto:[email protected],mailto:[email protected],mailto:[email protected]

Policy summary:
  • Policy: reject
  • Subdomain policy: reject
  • Percentage applied: 100%
Report settings:Parsed DMARC tags:
TagValueDescription
vDMARC1Version (must be DMARC1)
prejectPolicy for domain
spdefault (sp=reject)Subdomain policy
ruamailto:[email protected],mailto:[email protected],mailto:[email protected]Aggregate report URI(s)
rufmailto:[email protected],mailto:[email protected],mailto:[email protected]Forensic report URI(s)
fo1Failure reporting options
pctdefault (pct=100)Percentage of mail to apply policy to
adkimdefault (adkim=r)Alignment mode for DKIM
aspfdefault (aspf=r)Alignment mode for SPF
ridefault (ri=86400)Report interval (in seconds)
rfdefault (rf=afrf)Report format
Your real DMARC is:
v=DMARC1; p=reject; sp=reject; rua=mailto:[email protected],mailto:[email protected],mailto:[email protected]; ruf=mailto:[email protected],mailto:[email protected],mailto:[email protected]; fo=1; pct=100; adkim=r; aspf=r; ri=86400; rf=afrf;
DMARC Evaluation Score: 2/3
To improve your score:
  • Missing DKIM/SPF alignment settings (adkim, aspf), default to relaxed.
MTA-STS / TLS-RPT145.4 ms
Mail TLS security
TXT _mta-stsNot found
Policy URLhttps://mta-sts.netflix.com/.well-known/mta-sts.txt (HTTP 0, policy missing)
Modenot set
Authorized MXnot set
max_agenot set
Policy fileNo valid MTA-STS policy file was fetched.
TXT _smtp._tlsNot found
MTA-STS score 0/5
Recommendations:
  • Publish an _mta-sts TXT record containing v=STSv1; id=. Change id whenever the HTTPS policy changes.
  • Publish the MTA-STS policy at https://mta-sts.netflix.com/.well-known/mta-sts.txt with version: STSv1, mode, mx, and max_age.
  • Use mode: enforce to prevent delivery to MX hosts that do not satisfy the TLS policy.
  • Add at least one mx: line matching the domain's legitimate MX hosts.
  • Set max_age to at least 604800 seconds once the policy is stable.
  • Publish an _smtp._tls TXT record with v=TLSRPTv1; rua=mailto:tlsrpt@yourdomain to receive TLS reports.
DKIM
...
DKIM Records Detected
BIMI46.8 ms
BIMI Record
No BIMI record found at: default._bimi.netflix.com.
SSL
...
SSL Certificate Summary
CAA
...
CAA Records
HSTS
...
HSTS
HTTPS
...
HTTPS
HTTPS (DNS)
...
HTTPS DNS record
WWW
...
A Record
AXFR
(Zone Transfer)1584.4 ms
AXFR status for the zone
AXFR test could not be determined for netflix.com.
Nameservers tested:
    ns-1372.awsdns-43.org, ns-1984.awsdns-56.co.uk, ns-659.awsdns-18.net, ns-81.awsdns-10.com
Security note
Zone transfers (AXFR) should be disabled in production unless explicitly required and restricted.
Leaving AXFR open allows anyone to enumerate your entire DNS zone (subdomains, MX, TXT, internal hosts, etc.).
PORTS
...
Open ports detected (3.211.157.115)
PORTS
...
Open ports detected (54.160.93.182)
PORTS
...
Open ports detected (3.225.92.8)
PORTS
Open ports detected (2600:1f18:631e:2f84:4f7a:4092:e2e9:c617)
IPv6 scan skipped: this DNSprobe server does not currently have outbound IPv6 connectivity.
PORTS
Open ports detected (2600:1f18:631e:2f85:93a9:f7b0:d18:89a7)
IPv6 scan skipped: this DNSprobe server does not currently have outbound IPv6 connectivity.
PORTS
Open ports detected (2600:1f18:631e:2f83:49ee:beaa:2dfd:ae8f)
IPv6 scan skipped: this DNSprobe server does not currently have outbound IPv6 connectivity.
REPUTATION
...
IP in blacklists (3.211.157.115)
REPUTATION
...
IP in blacklists (54.160.93.182)
REPUTATION
...
IP in blacklists (3.225.92.8)
REPUTATION
...
IP in blacklists (2600:1f18:631e:2f84:4f7a:4092:e2e9:c617)
REPUTATION
...
IP in blacklists (2600:1f18:631e:2f85:93a9:f7b0:d18:89a7)
REPUTATION
...
IP in blacklists (2600:1f18:631e:2f83:49ee:beaa:2dfd:ae8f)
DNS found
...
Test Details
Website Preview0.0 ms
Snapshot is generated through DNSprobe's rendering proxy and may be served from a short cache.
Security Headers1323.9 ms
Score: 49/100 (F)
Failing, very weak or absent security headers

HeaderValue
HTTP/2
HTTP/2 200
HTTP version reported by the server.
set-cookie
flwssn=dca157e7-592f-4606-858c-7c2a0b321317; Max-Age=10800; Domain=.netflix.com; Path=/ nfvdid=BQFmAAEBEKvhw-w73DJ-hB6Iy39uZK5AmsSzfup7fCuvDhOpIwKakS_s-rbC4PDFIMxmOcBtLGpj_e7oxBblyvTt02Wlss3KuQzTLD84qegNa6toBtNQzQ%3D%3D; Domain=.netflix.com; Path=/; Max-Age=31536000 SecureNetflixId=v%3D3%26mac%3DAQEAEQABABTAPH6DTCzrmyickRKY27WLEPY3_Jk_4mQ.%26dt%3D1789872903444; Domain=.netflix.com; Expires=Mon, 20 Sep 2027 02:55:03 GMT; Path=/; HttpOnly; Secure; SameSite=Strict NetflixId=v%3D3%26ct%3DBgjHlOvcAxLBAR9RiA7V9UrLlPm_VvHrOsHV5FlTb6CCPXab1pee1xEp9T_YdymcDJu1PWkw6ORy7PcocD42fLejv88g49PDpngVAV3gP1PfSxhvnLmU_cB4LhGM33z3Ne6ZDKKt6CxOLP8ye46lnRFEocpiBhODplOqtI5YYqQc32BOM2ACew1HoM_5bWD0A_NexwbLLWGfQWHi_iTCqTcchoAD2t0G0ZoFQD9NVSyQcAx84FSEqweZdIjtFsB2PwFtPjcvTIYFYaAYBiIOCgyJ4wwBfv9P5pyRhWQ.; Domain=.netflix.com; Expires=Mon, 20 Sep 2027 02:55:03 GMT; Path=/; HttpOnly; Secure; SameSite=Lax gsid=9a946af8-754e-4e3f-b51b-5337044c13ad; Max-Age=86400; Expires=Mon, 21 Sep 2026 02:55:03 GMT; Path=/; Domain=.netflix.com; Secure; HTTPOnly; SameSite=None
Session cookies should include the Secure attribute to ensure they are never sent over unencrypted connections.
Missing HttpOnly attribute.
Missing SameSite attribute.
expires
None
Legacy caching header. Prefer Cache-Control.
cache-control
no-cache, no-store, must-revalidate
Controls caching. For sensitive pages consider 'no-store'.
pragma
no-cache
Legacy HTTP/1.0 directive. Prefer Cache-Control.
content-type
text/html; charset=utf-8
Declares MIME type; pair with X-Content-Type-Options: nosniff.
content-encoding
gzip
Compression used for the response (gzip, br…).
vary
None
Tells caches which request headers affect the response.
date
Sun, 20 Sep 2026 02:55:03 GMT
Origin date of the response.
age
None
Indicates how long the response has been cached.
x-powered-by
Not defined
May reveal framework/version. Removing lowers fingerprinting.
strict-transport-security
max-age=31536000; includeSubDomains
Enforces HTTPS for a period, strengthening TLS.
Strong HSTS but without 'preload'.
x-xss-protection
1; mode=block; report=https://www.netflix.com/ichnaea/log/freeform/xssreport
Deprecated. X-XSS-Protection sets the configuration for the legacy XSS Auditor in older browsers.
The recommended value used to be "X-XSS-Protection: 1; mode=block" but you should now look at Content Security Policy instead.
x-content-type-options
nosniff
Stops MIME sniffing. Only valid value: 'nosniff'.
x-permitted-cross-domain-policies
Not defined
Controls Flash/Adobe cross-domain policies. Use 'none'.
Prefer X-Permitted-Cross-Domain-Policies: none.
referrer-policy
Not defined
Controls referrer information sent on navigation.
Recommended: strict-origin-when-cross-origin.
permissions-policy
Not defined
Restricts powerful features (camera, mic, geolocation…).
Add a Permissions-Policy to restrict powerful features.
expect-ct
Not defined
Deprecated control, should be removed if present.
x-frame-options
DENY
Protects against clickjacking. Prefer CSP frame-ancestors today.
Prefer CSP frame-ancestors over X-Frame-Options.
content-security-policy
Not defined
CSP limits content sources to mitigate XSS.
No CSP detected; add one to mitigate XSS.
cross-origin-embedder-policy
Not defined
COEP is part of cross-origin isolation (with COOP).
cross-origin-embedder-policy-report-only
Not defined
COEP in report-only mode (not enforced).
cross-origin-opener-policy
Not defined
COOP isolates browsing context groups when set to same-origin.
cross-origin-opener-policy-report-only
Not defined
COOP in report-only mode (not enforced).
cross-origin-resource-policy
Not defined
CORP restricts who can load this resource.
access-control-allow-origin
Not defined
CORS: which origins are allowed to read this response.
access-control-allow-methods
Not defined
CORS: which methods are allowed.
access-control-allow-headers
Not defined
CORS: which request headers are allowed.
alt-svc
Not defined
Advertises alternative services (e.g., HTTP/3 via QUIC).
Other detected headers
Additional headers returned by the server. Shown for information only and not included in the score.
HeaderValue
serverenvoy
content-security-policy-report-onlydefault-src https: wss: 'unsafe-inline' 'unsafe-eval'; font-src https: data: ; img-src https: data: blob: ; media-src https: blob: ; worker-src https: blob: ; report-uri https://www.netflix.com/log/www/csp/1;
accept-chSec-CH-UA-Platform-Version,Sec-CH-UA-Model
x-robots-tagindex
x-netflix.request.growth.session.id9a946af8-754e-4e3f-b51b-5337044c13ad
x-envoy-upstream-service-time306
x-b3-traceid6aaf4b07e76f226b11fddc5c0249bea2
x-request-id9526387e-75b1-4f13-a602-cbbf472a6d35
x-envoy-decorator-operationlo_svc
via2 i-05fda7d069eeb5714 (eu-west-1), 1.1 c000.nyc001.ix.nflxvideo.net (FTL-L4-Ws2Q)
x-originating-urlhttp://www.netflix.com/ca/
x-netflix-cookieandmsl.profileguid.matchNA
x-netflix-headerandcookie.profileguid.matchNA
x-netflix-headerandmsl.profileguid.matchNA
x-netflix.nfstatus1_1
x-netflix.proxy.execution-time315
x-netflix.zuul.netty.content.compressor.targetgzip
Recommended starter configuration (.htaccess)
Starter configuration to copy and adapt. CSP, CORS and cookie rewriting are intentionally commented because they can break some sites if enabled blindly.


#BEGIN SECURITY HEADERS

# -------------------------------------------------------
# Safe baseline
# -------------------------------------------------------
<IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteCond %{HTTPS} !=on
  RewriteCond %{HTTP:X-Forwarded-Proto} !https [NC]
  RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
</IfModule>

Options -Indexes

<IfModule mod_headers.c>
  # Reduce fingerprinting
  # The Server header usually cannot be removed from .htaccess; configure it at the web server level if needed.
  Header always unset X-Powered-By
  Header always unset X-Redirect-By

  # TLS / transport security (only when HTTPS)
  Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" env=HTTPS

  # MIME sniffing protection
  Header always set X-Content-Type-Options "nosniff"

  # Referrer policy
  Header always set Referrer-Policy "strict-origin-when-cross-origin"

  # Adobe cross-domain policy
  Header always set X-Permitted-Cross-Domain-Policies "none"

  # Clickjacking protection (consistent with CSP frame-ancestors 'self')
  Header always set X-Frame-Options "SAMEORIGIN"

  # Cross-Origin isolation headers (sane defaults)
  Header always set Cross-Origin-Opener-Policy "same-origin"
  Header always set Cross-Origin-Resource-Policy "same-origin"
  # COEP is powerful but can break third-party embeds/resources if not CORP/CORS-enabled.
  # Header always set Cross-Origin-Embedder-Policy "require-corp"

  # Deprecated header; modern browsers rely on CSP instead, but some scanners still like to see it.
  Header always set X-XSS-Protection "0"

  # Permissions-Policy (balanced: blocks sensitive features, allows reasonable ones on self)
  Header always set Permissions-Policy "accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), midi=(), payment=(), usb=(), display-capture=(), autoplay=(self), encrypted-media=(self), fullscreen=(self), picture-in-picture=(self), clipboard-write=(self), publickey-credentials-get=(self)"

  # Vary (keep small; don’t add Referer/User-Agent unless you truly vary by them)
  Header always merge Vary "Accept-Encoding"
</IfModule>

# -------------------------------------------------------
# Cache-Control (HTML pages)
# -------------------------------------------------------
<IfModule mod_headers.c>
  # Apply to HTML responses (works for WordPress permalinks too). Requires Apache 2.4+ expressions.
  # If you do not use a page cache (LiteSpeed Cache, cache plugins, etc.), you can uncomment the line below. Keep it commented if a page cache is active.
  # Header always set Cache-Control "private, no-cache, must-revalidate" "expr=%{CONTENT_TYPE} =~ m#^text/html#"
  # Header always unset Pragma "expr=%{CONTENT_TYPE} =~ m#^text/html#"
  # Header always unset Expires "expr=%{CONTENT_TYPE} =~ m#^text/html#"
</IfModule>

# -------------------------------------------------------
# CSP - Content Security Policy (minimal safe baseline)
# -------------------------------------------------------
<IfModule mod_headers.c>
  # (Keeps your current intent; strengthen later with default-src/script-src/etc.)
  # Adjust img-src, script-src, style-src, font-src, connect-src as needed (e.g., add trusted CDNs).
  # Header always set Content-Security-Policy "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'self'; img-src 'self' data: https:; script-src 'self'; style-src 'self'; font-src 'self' data:; connect-src 'self'; form-action 'self'; upgrade-insecure-requests"
</IfModule>

# -------------------------------------------------------
# CORS - Cross-Origin Ressource Sharing (optional; keep commented unless needed)
# -------------------------------------------------------
<IfModule mod_headers.c>
  # IMPORTANT:
  # - Do NOT enable global CORS unless you have a real API need.
  # If you need CORS, uncomment and set a fixed allowlist.
  # SetEnvIf Origin "^https?://(netflix\.com|www\.netflix\.com)(:\d{1,5})?$" CORS_ALLOW_ORIGIN=$0
  # Header always set Access-Control-Allow-Origin "%{CORS_ALLOW_ORIGIN}e" env=CORS_ALLOW_ORIGIN
  # Header always merge Vary "Origin" env=CORS_ALLOW_ORIGIN
  # Header always set Access-Control-Allow-Methods "GET, POST, OPTIONS" env=CORS_ALLOW_ORIGIN
  # Header always set Access-Control-Allow-Headers "Content-Type, Authorization" env=CORS_ALLOW_ORIGIN
  # Header always set Access-Control-Max-Age "86400" env=CORS_ALLOW_ORIGIN
</IfModule>

# -------------------------------------------------------
# Cookies hardening (optional)
# -------------------------------------------------------
<IfModule mod_headers.c>
  # Apache only: uses Header edit/edit* to append Secure/HttpOnly/SameSite when missing. Not valid / not supported reliably on LiteSpeed/OpenLiteSpeed.
  # Header always edit* Set-Cookie "(?i)^((?:(?!;\s*Secure).)+)$" "$1; Secure" env=HTTPS
  # Header always edit* Set-Cookie "(?i)^((?:(?!;\s*HttpOnly).)+)$" "$1; HttpOnly"
  # Header always edit* Set-Cookie "(?i)^((?:(?!;\s*SameSite=).)+)$" "$1; SameSite=Lax"
</IfModule>

# -------------------------------------------------------
# Reporting headers (optional)
# -------------------------------------------------------
<IfModule mod_headers.c>
  # Header always set Reporting-Endpoints "default=\"https://netflix.com/reporting\""
  # Header always set Cross-Origin-Opener-Policy-Report-Only "same-origin"
  # Header always set Cross-Origin-Embedder-Policy-Report-Only "require-corp"
</IfModule>

#END SECURITY HEADERS
WHOIS426.9 ms
Source: WHOIS (port 43) whois.markmonitor.com
WHOIS Summary
Domain Name: netflix.com
Registry Domain ID: 1404215_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.markmonitor.com
Registrar URL: http://www.markmonitor.com
Updated Date: 2025-10-09 12:13:44+0000
Creation Date: 1997-11-11 05:00:00+0000
Registrar Registration Expiration Date: 2027-11-10 00:00:00+0000
Registrar: MarkMonitor, Inc.
Registrar IANA ID: 292
Registrar Abuse Contact: https://corp.markmonitor.com/domain/ui/abuse-report
Registrar Abuse Contact Phone: +1.2086851750
Domain Status: clientUpdateProhibited (https://www.icann.org/epp#clientUpdateProhibited)
Domain Status: clientTransferProhibited (https://www.icann.org/epp#clientTransferProhibited)
Domain Status: clientDeleteProhibited (https://www.icann.org/epp#clientDeleteProhibited)
Domain Status: serverUpdateProhibited (https://www.icann.org/epp#serverUpdateProhibited)
Domain Status: serverTransferProhibited (https://www.icann.org/epp#serverTransferProhibited)
Domain Status: serverDeleteProhibited (https://www.icann.org/epp#serverDeleteProhibited)
Registrant Organization: Netflix, Inc.
Registrant Country: US
Registrant Email: Select Request Email Form at https://domains.markmonitor.com/whois/netflix.com
Tech Email: Select Request Email Form at https://domains.markmonitor.com/whois/netflix.com
Name Server: ns-1372.awsdns-43.org
Name Server: ns-659.awsdns-18.net
Name Server: ns-81.awsdns-10.com
Name Server: ns-1984.awsdns-56.co.uk
DNSSEC: unsigned
URL of the ICANN WHOIS Data Problem Reporting System: http://wdprs.internic.net/ >>> Last update of WHOIS database: 2026-09-20T02:53:18+0000 <<<
For more information on WHOIS status codes, please visit:
If you wish to contact this domain’s Registrant or Technical contact, and such email address is not visible above, you may do so via our web form, pursuant to ICANN’s Temporary Specification. To verify that you are not a robot, please enter your email address to receive a link to a page that facilitates email communication with the relevant contact(s).
If you have a legitimate interest in viewing the non-public WHOIS details, send your request and the reasons for your request to [email protected] and specify the domain name in the subject line. We will review that request and may ask for supporting documentation and explanation.
The data in MarkMonitor’s WHOIS database is provided for information purposes, and to assist persons in obtaining information about or related to a domain name’s registration record. While MarkMonitor believes the data to be accurate, the data is provided "as is" with no guarantee or warranties regarding its accuracy.
By submitting a WHOIS query, you agree that you will use this data only for lawful purposes and that, under no circumstances will you use this data to: (1) allow, enable, or otherwise support the transmission by email, telephone, or facsimile of mass, unsolicited, commercial advertising, or spam; or (2) enable high volume, automated, or electronic processes that send queries, data, or email to MarkMonitor (or its systems) or the domain name contacts (or its systems).
MarkMonitor reserves the right to modify these terms at any time.
By submitting this query, you agree to abide by this policy.
MarkMonitor Domain Management(TM) Protecting companies and consumers in a digital world.
Contact us at +1.8007459229 In Europe, at +44.02032062220 --
https: //www.icann.org/resources/pages/epp-status-codes
https: //domains.markmonitor.com/whois/contact/netflix.com
Web-based WHOIS:
Visit MarkMonitor at https: //www.markmonitor.com
WHOIS RAW
Domain Name: netflix.com
Registry Domain ID: 1404215_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.markmonitor.com
Registrar URL: http://www.markmonitor.com
Updated Date: 2025-10-09T12:13:44+0000
Creation Date: 1997-11-11T05:00:00+0000
Registrar Registration Expiration Date: 2027-11-10T00:00:00+0000
Registrar: MarkMonitor, Inc.
Registrar IANA ID: 292
Registrar Abuse Contact: https://corp.markmonitor.com/domain/ui/abuse-report
Registrar Abuse Contact Phone: +1.2086851750
Domain Status: clientUpdateProhibited (https://www.icann.org/epp#clientUpdateProhibited)
Domain Status: clientTransferProhibited (https://www.icann.org/epp#clientTransferProhibited)
Domain Status: clientDeleteProhibited (https://www.icann.org/epp#clientDeleteProhibited)
Domain Status: serverUpdateProhibited (https://www.icann.org/epp#serverUpdateProhibited)
Domain Status: serverTransferProhibited (https://www.icann.org/epp#serverTransferProhibited)
Domain Status: serverDeleteProhibited (https://www.icann.org/epp#serverDeleteProhibited)
Registrant Organization: Netflix, Inc.
Registrant Country: US
Registrant Email: Select Request Email Form at https://domains.markmonitor.com/whois/netflix.com
Tech Email: Select Request Email Form at https://domains.markmonitor.com/whois/netflix.com
Name Server: ns-1372.awsdns-43.org
Name Server: ns-659.awsdns-18.net
Name Server: ns-81.awsdns-10.com
Name Server: ns-1984.awsdns-56.co.uk
DNSSEC: unsigned
URL of the ICANN WHOIS Data Problem Reporting System: http://wdprs.internic.net/
>>> Last update of WHOIS database: 2026-09-20T02:53:18+0000 <<<

For more information on WHOIS status codes, please visit:
  https://www.icann.org/resources/pages/epp-status-codes

If you wish to contact this domain’s Registrant or Technical
contact, and such email address is not visible above, you may do so via our web
form, pursuant to ICANN’s Temporary Specification. To verify that you are not a
robot, please enter your email address to receive a link to a page that
facilitates email communication with the relevant contact(s).

Web-based WHOIS:
  https://domains.markmonitor.com/whois/contact/netflix.com

If you have a legitimate interest in viewing the non-public WHOIS details, send
your request and the reasons for your request to [email protected]
and specify the domain name in the subject line. We will review that request and
may ask for supporting documentation and explanation.

The data in MarkMonitor’s WHOIS database is provided for information purposes,
and to assist persons in obtaining information about or related to a domain
name’s registration record. While MarkMonitor believes the data to be accurate,
the data is provided "as is" with no guarantee or warranties regarding its
accuracy.

By submitting a WHOIS query, you agree that you will use this data only for
lawful purposes and that, under no circumstances will you use this data to:
  (1) allow, enable, or otherwise support the transmission by email, telephone,
or facsimile of mass, unsolicited, commercial advertising, or spam; or
  (2) enable high volume, automated, or electronic processes that send queries,
data, or email to MarkMonitor (or its systems) or the domain name contacts (or
its systems).

MarkMonitor reserves the right to modify these terms at any time.

By submitting this query, you agree to abide by this policy.

MarkMonitor Domain Management(TM)
Protecting companies and consumers in a digital world.

Visit MarkMonitor at https://www.markmonitor.com
Contact us at +1.8007459229
In Europe, at +44.02032062220
--
RDAP
426.5 ms
Source: RDAP rdap.org → rdap.verisign.com → rdap.markmonitor.com
Domain Name:NETFLIX.COM
Registry Domain ID:1404215_DOMAIN_COM-VRSN
RDAP self:https://rdap.verisign.com/com/v1/domain/netflix.com
Updated Date:2025-10-09 12:13:44
Creation Date:1997-11-11 05:00:00
Registry Expiry Date:✅ 2027-11-10 05:00:00
Registrar:MarkMonitor Inc.
Registrar Abuse Contact Email:[email protected]
Registrar Abuse Contact Phone:+1.2086851750
Domain Status:clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited
clientTransferProhibited https://icann.org/epp#clientTransferProhibited
clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited
serverDeleteProhibited https://icann.org/epp#serverDeleteProhibited
serverTransferProhibited https://icann.org/epp#serverTransferProhibited
serverUpdateProhibited https://icann.org/epp#serverUpdateProhibited
Name Servers:ns-1372.awsdns-43.org
ns-1984.awsdns-56.co.uk
ns-659.awsdns-18.net
ns-81.awsdns-10.com
WHOIS NS match DNS
DNSSEC:unsigned (delegationSigned=false)
RDAP notices:Terms of Service — https://www.verisign.com/domain-names/registration-data-access-protocol/terms-service/index.xhtml
Status Codes — https://icann.org/epp
RDDS Inaccuracy Complaint Form — https://icann.org/wicf
Registrar
Registrar:
Name MarkMonitor Inc.
Handle: 292
Abuse contact:
Phone +1.2086851750
RDAP JSON (raw)
{
    "objectClassName": "domain",
    "handle": "1404215_DOMAIN_COM-VRSN",
    "ldhName": "NETFLIX.COM",
    "links": [
        {
            "value": "https://rdap.verisign.com/com/v1/domain/netflix.com",
            "rel": "self",
            "href": "https://rdap.verisign.com/com/v1/domain/netflix.com",
            "type": "application/rdap+json"
        },
        {
            "value": "https://rdap.verisign.com/com/v1/domain/netflix.com",
            "rel": "related",
            "href": "https://rdap.markmonitor.com/rdap/domain/NETFLIX.COM",
            "type": "application/rdap+json"
        }
    ],
    "status": [
        "client delete prohibited",
        "client transfer prohibited",
        "client update prohibited",
        "server delete prohibited",
        "server transfer prohibited",
        "server update prohibited"
    ],
    "entities": [
        {
            "objectClassName": "entity",
            "handle": "292",
            "roles": [
                "registrar"
            ],
            "links": [
                {
                    "href": "http://www.markmonitor.com",
                    "type": "text/html",
                    "value": "https://rdap.markmonitor.com/rdap/",
                    "rel": "about"
                }
            ],
            "publicIds": [
                {
                    "type": "IANA Registrar ID",
                    "identifier": "292"
                }
            ],
            "vcardArray": [
                "vcard",
                [
                    [
                        "version",
                        [],
                        "text",
                        "4.0"
                    ],
                    [
                        "fn",
                        [],
                        "text",
                        "MarkMonitor Inc."
                    ]
                ]
            ],
            "entities": [
                {
                    "objectClassName": "entity",
                    "roles": [
                        "abuse"
                    ],
                    "vcardArray": [
                        "vcard",
                        [
                            [
                                "version",
                                [],
                                "text",
                                "4.0"
                            ],
                            [
                                "fn",
                                [],
                                "text",
                                ""
                            ],
                            [
                                "tel",
                                {
                                    "type": "voice"
                                },
                                "uri",
                                "tel:+1.2086851750"
                            ],
                            [
                                "email",
                                [],
                                "text",
                                "[email protected]"
                            ]
                        ]
                    ]
                }
            ]
        }
    ],
    "events": [
        {
            "eventAction": "registration",
            "eventDate": "1997-11-11T05:00:00Z"
        },
        {
            "eventAction": "expiration",
            "eventDate": "2027-11-10T05:00:00Z"
        },
        {
            "eventAction": "last changed",
            "eventDate": "2025-10-09T12:13:44Z"
        },
        {
            "eventAction": "last update of RDAP database",
            "eventDate": "2026-09-20T02:54:58Z"
        }
    ],
    "secureDNS": {
        "delegationSigned": false
    },
    "nameservers": [
        {
            "objectClassName": "nameserver",
            "ldhName": "NS-1372.AWSDNS-43.ORG"
        },
        {
            "objectClassName": "nameserver",
            "ldhName": "NS-1984.AWSDNS-56.CO.UK"
        },
        {
            "objectClassName": "nameserver",
            "ldhName": "NS-659.AWSDNS-18.NET"
        },
        {
            "objectClassName": "nameserver",
            "ldhName": "NS-81.AWSDNS-10.COM"
        }
    ],
    "rdapConformance": [
        "rdap_level_0",
        "icann_rdap_technical_implementation_guide_1",
        "icann_rdap_response_profile_1"
    ],
    "notices": [
        {
            "title": "Terms of Service",
            "description": [
                "Service subject to Terms of Use."
            ],
            "links": [
                {
                    "href": "https://www.verisign.com/domain-names/registration-data-access-protocol/terms-service/index.xhtml",
                    "type": "text/html",
                    "value": "https://rdap.verisign.com/com/v1/domain/netflix.com",
                    "rel": "terms-of-service"
                }
            ]
        },
        {
            "title": "Status Codes",
            "description": [
                "For more information on domain status codes, please visit https://icann.org/epp"
            ],
            "links": [
                {
                    "href": "https://icann.org/epp",
                    "type": "text/html",
                    "value": "https://rdap.verisign.com/com/v1/domain/netflix.com",
                    "rel": "glossary"
                }
            ]
        },
        {
            "title": "RDDS Inaccuracy Complaint Form",
            "description": [
                "URL of the ICANN RDDS Inaccuracy Complaint Form: https://icann.org/wicf"
            ],
            "links": [
                {
                    "href": "https://icann.org/wicf",
                    "type": "text/html",
                    "value": "https://rdap.verisign.com/com/v1/domain/netflix.com",
                    "rel": "help"
                }
            ]
        }
    ]
}

You like this tool?

Buy Me A Coffee

Processed in 0.009 seconds.
Made with with PHP and a bit of JS.
Lines of code: 20,351

⚙️ Configuration
(Check / Uncheck All)