Skip to content
https://deloitte.com

Infrastructure

· 9 checks — DNS, redirects, IPv6, crawlability, URL variants, and domain intelligence rolled into one auditable list.
SCORE
85
GRADE
B
FIX
1
REVIEW
3
PASS
5
INFO
0
Probed from New York, United Stated
302 Found
Checks
9
5 PASS 3 REVIEW 1 FIX
D
CDN & Delivery
Action
No CDN detected
FIX
No CDN detected
Warning::
No CDN detected
A CDN can significantly improve load times for users around the world by caching content at edge nodes closer to them.
No CDN detected

Consider using a CDN to improve global delivery speed and reduce origin load.

B
Redirect Chain
2 redirect(s), 151 ms total
REVIEW
2 redirect(s), 151 ms total
Warning::
2 redirects before reaching final URL
Each redirect adds latency. Try to minimize the chain to 1 hop.
Info::
WWW normalization redirect
Info::
Uses 302 (temporary) redirect
If permanent, use 301 instead.
Got: https://deloitte.com

https://deloitte.com

117 ms · HTTP/1.0

302

https://www.deloitte.com/

20 ms · HTTP/1.1

301

https://www.deloitte.com/us/en.html

14 ms · HTTP/1.1 FINAL

#URLStatusTimeProtocolServer
1https://deloitte.com302117 msHTTP/1.0BigIP
2https://www.deloitte.com/30120 msHTTP/1.1
3https://www.deloitte.com/us/en.html20014 msHTTP/1.1

See the visual redirect chain in the HTTP Probe tab →

Each redirect adds latency. Try to minimize the chain to 1 hop.

Why this matters

Redirect chain — each hop adds latency; combine into one redirect where possible.

Source: Google Search Central / web.dev

If permanent, use 301 instead.

Why this matters

302 (Found) is for genuinely temporary redirects — if this redirect is permanent, switch to 301 to preserve SEO equity.

Learn more ▾

Search engines treat 302 as temporary, keeping the original URL indexed and not transferring full link equity to the destination. Use 301 (Moved Permanently) for permanent redirects (HTTP→HTTPS, www-vs-non-www, URL restructures).

Source: Google Search Central

C
IPv6 Readiness
Action
No IPv6 support
REVIEW
No IPv6 support
Info::
No IPv6 (AAAA) records found
IPv6 support is increasingly important for global accessibility. About 40% of internet users have IPv6 connectivity.
No IPv6 Support
About 40% of internet users have IPv6. Consider adding AAAA records.

IPv6 support is increasingly important for global accessibility. About 40% of internet users have IPv6 connectivity.

Why this matters

No AAAA records — same impact as 'no IPv6 (AAAA) records'; IPv6-preferring clients pay extra latency falling back to IPv4.

Source: Google IPv6 stats

B
TLS Certificate Expiry & Recommendations
154 days until leaf cert expires — 4 issues to address
REVIEW

Certificate validity

154
days left
0d 30d 60d 90d+

Recommended actions

  • Prefer TLS 1.3 — TLS 1.2 is acceptable but TLS 1.3 removes RSA key exchange and improves latency
  • Enable HSTS: Strict-Transport-Security: max-age=31536000; includeSubDomains
  • Enable DNSSEC on your domain for DNS spoofing protection
  • Enable OCSP stapling on your TLS server to remove a CA roundtrip and protect user privacy
A+
DNS Records
1 A records, 24 ms lookup
PASS
1 A records, 24 ms lookup
Info::
Resolves to 1 IPv4 address(es)
Got: 170.194.135.123
Info::
Single A record — no DNS redundancy
Multiple A records provide failover if one server goes down.
Info::
No IPv6 (AAAA) records
Info::
4 nameserver(s) configured
Got: auth111.ns.uu.net, dmtu.mt.ns.els-gms.att.net, dbru.br.ns.els-gms.att.net, auth120.ns.uu.net
Info::
4 mail exchanger(s) configured
Info::
CAA records not checked
CAA record lookup requires a specialized DNS resolver. This check will be available in a future update.
Info::
SPF record present in TXT
Info::
DNS resolution time: 24 ms
Got: 24 ms
A170.194.135.123
AAAA—
CNAME—
NSauth111.ns.uu.net, dmtu.mt.ns.els-gms.att.net, dbru.br.ns.els-gms.att.net, auth120.ns.uu.net
MX
100 mx2.hc5291-32.iphmx.com
100 mx1.hc5291-32.iphmx.com
100 mx2.deloitte.iphmx.com
100 mx1.deloitte.iphmx.com
TXT
amazonses:j6yo6t64fzWubtgQlyZoS8FVzI2viowM7qHOyiFliJE=
docker-verification=f9d9773a-6b64-4259-897d-3bcad558ef18
miro-verification=069d9fcb497e6de74804baa2b411ec4d2f0d93c4
mongodb-site-verification=x3Jx2OgGjX0NWH7y29KOsPXBzq2xOyb8
facebook-domain-verification=ajccfsv4yv7doxqrsss18sc2a5xo2f
facebook-domain-verification=kfow0fjjnp6vg2596iwns517h7idna
facebook-domain-verification=lj27ke4el7sd5soeflzcq7fvthqp4z
ms-domain-verification=3eaa728c-6e69-4592-8e47-5ad00a7621d1
ms-domain-verification=6b3fc0d4-bae5-4ef4-94ff-773ba8da41c1
ms-domain-verification=6b66dfb5-4ce6-4be1-a830-f4ac8d1310de
ms-domain-verification=85f5d93c-1c3a-424a-9fc0-7b2f92656b02
ms-domain-verification=a7f62058-ae74-4d62-925b-8cd2c823e6c8
ms-domain-verification=fbdbfbb1-79d6-4dd6-a94c-7e27aeede2b4
smartsheet-site-validation=58PJ_xrezU3GAu4S8NQ5hVaYFutUbPoe
smartsheet-site-validation=DLwgvodywck_t1KodlipGbx5y71KqKMK
smartsheet-site-validation=WVjFZI0fz9DwyOTI4nm_43gYK5n-OeGs
smartsheet-site-validation=b9sHeo5bFEMRugNbaGkpJWob18BbOuUu
smartsheet-site-validation=iyjIJfzahNE6kuOHOR91Or7kIc6abmHr
onetrust-domain-verification=a0cb4cb0176842ddb6cc0d1e6b30cfaa
onetrust-domain-verification=e45edee6d55f4a6793d107a58b327ab2
vmware-cloud-verification-928910b5-2214-48fc-b9b5-8ec60b3c769e
adobe-idp-site-verification=002048dc-2aea-458b-bb29-791643c0f141
workplace-domain-verification=51e42aa1-5d13-4625-ba00-75633c560b52
_pki-validation.deloitte.com BE30-D20A-41FB-EF15-8E2D-C571-5EED-018D
google-site-verification=P1E8DzV0j2B3zOrdR4CKgKAsx8W7Pii9K7Kko_7odV0
google-site-verification=VqNZVwcHvGeE-00TrFz_tWEDenz_VWX7QFT7w2V7Zds
google-site-verification=WwTh62UFLuVO4NB3C-foXAWDqICm8eGSkJz6I0uRnOI
notion-domain-verification=XE9QsKNeN7aCCXSeX4Ymm5eHOwhuzIZDaMtuyJW7r7E
_globalsign-domain-verification=vyumsZIe1LYnrCL8ZlJH-NXh2eMZrwXzzjC2yx2C1X
pardot915781=d16eadcd15c9f6d9157298f7c66d2856aed39c09fc767a94f221e6ee8e182537
“globalsign-domain-verification=xvsKIQGhtZ6jwzGdOjBUQX-wVgxGb7zufzOZ9OOu2v”
gfOX5sGfwlwlEa5QH08PgYUk76w74cYQ/KsfLDK75v8Ca8FXi1JU1mAUwemvoGiax7zM/j789qAhEFUk...
rnCcnGUhJtnj7Dq1gWGxZoz0YXHOPauyX91hX5wihVjIHvsjyYkNYk7yZYoIU8mJsDkoZz0T2Lwn5qxJ...
taFQDZYQ4B9aWHNqaQcvoaUKicrnPXZHa73/1SFbNBWwlh/yJqcnwFi9QUaDbaCvpYXcZ1qoWBs9wIO/...
vkvBmbPA+CEZ5pWKq8YTllvoSelYHocVAc1F1MxhvwHpvSeL06QW/KBfA7APLHIaOn4atyCbLwK/pW5N...
Dynatrace-site-verification=1327f658-4179-4c86-b459-aac7a6074990__lqmfr7i83e92uu...
Dynatrace-site-verification=c807c4b8-5f81-4e5b-a562-e2179a6e98be__png1csh1sk74vt...
cisco-ci-domain-verification=6667927c28e9635a2787b791f46ffadbf1fb3801ac39a3350af...
atlassian-domain-verification=0w/TMAc83LcJu5YTSFzxnj6MW69Gio5eeSCReTAR27x74fY6Rb...
atlassian-domain-verification=AZk4U7rbpRjt1c7hmKkq5KxchbKTIjRpEfeCCQaFPZBsiyXacf...
atlassian-domain-verification=Avdx4aNpjAqVK0CXBdk3LjsX8IedcDaO3S6NLfa87po/WVqWlJ...
atlassian-domain-verification=EfLYC2tpmPaKRp3lz27Y2iYwmCwP4keVaK5lh6G3awKbYxa8FS...
atlassian-domain-verification=L66arn4qBGevIGd4OOXp0hTjhjoR56WGrIN8oXNxQQ73Y/5xz0...
atlassian-domain-verification=aWBXK4CToKSDQKox0FfH5L7WV1QWYA21gaNDI3Fh7X4cPbRK77...
atlassian-domain-verification=cbRyDSpfZZfDXfcRLY974B1uZcMwhfR1HLD3ZpquWdYWqQgPLt...
atlassian-domain-verification=dLIlQmiccBluXbPKKS2tmGyncaHbmIFz3KnvSIXX3Vgc6yYh1N...
atlassian-domain-verification=qV2z9qonymDWt1ae/+D6nob8qkRlgxKNpMrtNpuA06nh4C9EFE...
“atlassian-domain-verification=TERygaFH40lyOd2hmJGtCA2w1aJwx6y7tFKDkgG/KbegUOj...
figma-domain-verification=d532e1c25356008253917e65570709b0c2fe444363b20c0f96f555...
wrike-verification=Mzc0MDg3MDo1ZjNiMDkyNmRjMTEyMzI5NDMzNGNkMjU1ZGI1OGIzMTQzZWVlM...
successfactors-site-verification=OGEzOWMxYjBkYmVkYjI0NmE2MmZkY2VlYzAyZjQxYTE1OTd...
postman-domain-verification=207357b0d60c639b2931c4bfdd9e00911d341b5bab47164f4155...
SPF v=spf1 exists:%{i}.spf.deloitte.iphmx.com ip4:216.71.141.160 ip4:216.71.142.133 ...
ms-domain-verification=605c1e01-4999-4c93-bdd6-fdcb5e7cb6ea
windsurf-verification=HcfTjQWAwnnDnSFDl50nlzDQLJcTZ_6lsZgHW2weN2U=
postman-domain-verification=5eeeb5c0e9e96fbd937249a78c9ccf94e40bbbf0ee6b914dce88...
mandrill_verify.6syEE4UgRBO6vliSsD-x3w
_hd3kks368uvrb51eyd0tgz8n4het5o9
00D0N000001OoKn=1TBQF0000000ALx
airtable-verification=1a2651cc21da05868d21cd5010cb5f32
00Dcs000000fYiT=1TBeq000000026g
_vdrf97p5957fu6jvfub00k9qrldxalb
MS=ms56848644
f41rg020epvqa1udg6dk8vnldr
i2v4398p4mr7isidk5m2m07qv5
kvv9vh7skvjjnomntfc4kdtv0g
eWYEBL0vTNp90Fi7pEMtOzvgtis
23kj3245lkjrhgj93546jlkn409u43
meltwater_sso_20200304_t3-2419
nintex.620f098cf8ca120069984ddc
6scd3246wfq8n1bdk16qkm8j7bd0rlzg
_2otnbk4jjjscmd3zfxms84dekhtsayr
_mmgohapk735rgqlnigl1da8rcvllf4u
dgmns2vzpnlnphj0pntm0n7yvl1sp6ny
zsd2n3g4rl31pfxlw81702hk0pbllzl2
0d9fe004-c548-4223-8c67-8903fbba1813
39371e02-bed7-420a-9971-6e831d6f9aca
5143609f-7781-41ba-8ba2-bbd534e1f2f4
fb4b35da-5e65-483d-a65e-078e9fc651cb
900D-006E-9F22-BC89-5750-7541-F89B-898E
wework-site-verification=vp4qMcALtPDFdcgh
apple-domain-verification=UcKAb76mMaql2vzH
apple-domain-verification=ief0G6Jz6BJWeXOs
apple-domain-verification=napZz00kIG32Dy04
apple-domain-verification=rmhHVHjzVLtO96zj
ZFtKkwOG/SXsZZTZtr/b4zrQAaVwCNBlyWFKLqpFre8=
SFMC-hTyRrbEjHJ1btDpowzJgQGKGonybh8xpCK71yKGN
docusign=a75b33c9-7b03-45ee-b6a1-3a99a0f47350
docusign=cfe8eeb7-e212-463b-84dc-3b26ba007ffc
jamf-site-verification=bYr74rSiPjWRuKxgOF-4aw
qase-718cb5cdf5a0eb716518f749b71970f045de84da
zoho-verification=zb55022907.zmverify.zoho.in
gobe-site-verification=k7bubwzMAtYv81jvt@f.VS5LV4Z44f
pendo-domain-verification=Q8LbOJ9sw-d4mT7aJ_tNZgvqJ3k
amazonses:3gDBjS5XtzhWTFkZH1/PION25LVUJE2w3P9msyC8obQ=
amazonses:HNqPQ9Fn0hXRINP17zT1M6Eu9x6jZHlTJ4ZghRxwSRU=
amazonses:KqplkkmBX8hwCIu00k7M5swKxVRDb+9J2UGKA4PRq3A=
amazonses:PJ0KY/BF3ifqpmkDq2YtkyR5ikzN2rIZbJaIZOR4uYg=
CAALookup not available with standard resolver
Resolved in 24 ms

Multiple A records provide failover if one server goes down.

Why this matters

Single A record means a single point of failure — if that IP goes down, your site is unreachable until DNS TTL expires.

Learn more ▾

Add multiple A records for round-robin failover, or use a managed DNS provider with health-checked failover (Route 53, Cloudflare, NS1). Short TTL (60-300s) lets clients recover faster on outages.

Source: SRE practice / DNS architecture

CAA record lookup requires a specialized DNS resolver. This check will be available in a future update.

Why this matters

Informational: CAA (Certification Authority Authorization) records weren't checked in this scan.

A+
Crawlability
robots.txt present, sitemap with 79 URLs
PASS
robots.txt present, sitemap with 79 URLs
Info::
robots.txt is present
Got: 503 bytes
Info::
sitemap.xml is present
Info::
sitemap.xml is valid XML
Info::
sitemap.xml contains 79 entries
Info::
Sitemap index with 79 child sitemaps
Info::
robots.txt references sitemap
robots.txt 200 OK
Size 503 B Sitemaps referenced 2 User-agents * Blocking No — crawling allowed
User-agent: *
Sitemap: https://www.deloitte.com/sitemap_index.xml
Sitemap: https://www.deloitte.com/sitemap_altlang_index.xml

Disallow: /languages/
Disallow: /content/websites/languages/
Disallow: /content/experience-fragments/websites/languages/
Disallow: /content/dam/*/no-index/
Disallow: /content/dam/*/no-index/
Disallow: /content/dam/*/*/no-index/
Disallow: /content/dam/assets/*/no-index/*
Disallow: /*/*/search-results.html
Disallow: /us/en/noindex/*
Disallow: /content/websites/us/en/noindex/*
sitemap.xml 200 OK
Type Sitemap Index URLs 79 entries Valid XML Yes
Child Sitemaps:
A
URL Variants
www/non-www, trailing slash, HTTP→HTTPS
PASS
www/non-www, trailing slash, HTTP→HTTPS
Warning::
HTTP→HTTPS redirect uses 302 instead of 301
Got: 302 temporary redirect Expected: 301 permanent redirect

www / non-www

403https://www.deloitte.com/
200https://deloitte.com/

HTTP → HTTPS

302http://deloitte.com/ → https://www.deloitte.com/

Use 301 (permanent) instead of 302 (temporary)

A+
Domain Intelligence
deloitte.com — via Network Solutions, LLC, 31 years, 5 months old, hosted on DTTS-ASN - Deloitte Touche Tohmatsu Services, Inc., US
PASS
deloitte.com — via Network Solutions, LLC, 31 years, 5 months old, hosted on DTTS-ASN - Deloitte Touche Tohmatsu Services, Inc., US
Info::
Domain registered until Apr 21, 2027 (1 years remaining)
Info::
DNSSEC is not enabled
DNSSEC protects against DNS spoofing attacks. While not required, enabling DNSSEC adds an additional layer of security. Contact your DNS provider to enable it.
Info::
Registrar: Network Solutions, LLC
Warning::
Registrar lock is NOT enabled
The domain can be transferred without an unlock step. Enable registrar lock (clientTransferProhibited) in your registrar's control panel to protect against unauthorized or accidental transfers.
Info::
Hosting: DTTS-ASN - Deloitte Touche Tohmatsu Services, Inc., US
Got: AS26342
Domain expiry

281 days

April 21, 2027

SSL certificate

154 days

Issued by Sectigo Limited

Domain age

31 years, 5 months

Registered April 20, 1995

DNSSEC

Not enabled

Protects against DNS spoofing

Hosting

DTTS-ASN - Deloitte Touche Tohmatsu Services, Inc., US

ASN AS26342

170.194.135.123

Registrar

Network Solutions, LLC

Unlocked 4 NS records
Expiry timeline
Today
+1 year
Domain expiry SSL expiry Danger zone (≤30 days)
Recommended actions
  • Enable DNSSEC to protect visitors from DNS spoofing
  • Enable registrar lock (clientTransferProhibited) to block unauthorized domain transfers
Registrar Network Solutions, LLC
Created April 20, 1995 (31 years, 5 months ago)
Expires April 21, 2027 (1 years)
Last Updated October 13, 2025
Name Servers auth111.ns.uu.net, auth120.ns.uu.net, dbru.br.ns.els-gms.att.net, dmtu.mt.ns.els-gms.att.net
DNSSEC Not enabled
Hosting
IP Address 170.194.135.123
ASN AS26342 (DTTS-ASN - Deloitte Touche Tohmatsu Services, Inc., US)
Provider DTTS-ASN - Deloitte Touche Tohmatsu Services, Inc., US
Data source: rdap (0.1s)

DNSSEC protects against DNS spoofing attacks. While not required, enabling DNSSEC adds an additional layer of security. Contact your DNS provider to enable it.

Why this matters

Without DNSSEC, an attacker who can poison your DNS can hijack your domain — and SSL certs alone don't stop them.

Learn more ▾

DNSSEC adds cryptographic signatures to DNS records, preventing forged responses from poisoning resolver caches. Without it, an attacker who controls the network path can redirect your domain to a malicious server before any HTTPS handshake happens. Most modern registrars (Cloudflare, Google Domains, Route 53) enable it with one toggle.

Source: ICANN / RFC 4033

The domain can be transferred without an unlock step. Enable registrar lock (clientTransferProhibited) in your registrar's control panel to protect against unauthorized or accidental transfers.

Why this matters

Without registrar lock, an attacker who phishes your registrar credentials can transfer the domain in minutes — total brand hijack.

Learn more ▾

Registrar lock (clientTransferProhibited, clientUpdateProhibited, clientDeleteProhibited) requires extra verification before any transfer/update/delete. Every major registrar offers it free. Combined with 2FA on your registrar account, it's the strongest defense against domain hijacking.

Source: ICANN / domain-security best practice

A+
HTTP Probe Timing
Total 115 ms — DNS, TCP, TLS, TTFB, content transfer breakdown
PASS
DNS Lookup DNS Lookup — time to resolve the domain name to an IP address.
9 ms
TCP Connect TCP Connect — time to establish a TCP connection to the server.
23 ms
TLS Handshake TLS Handshake — time to complete the HTTPS encryption handshake.
64 ms
Time to First Byte Time to First Byte — how long the server takes to respond with the first byte of data.
115 ms
Total Time Total request time from DNS lookup through full response.
115 ms

Connection waterfall

DNS Lookup 9 ms TCP Connect 23 ms TLS Handshake 64 ms Server Processing 20 ms Content Transfer 0 ms
All checks on this page are automated. Results are estimates - run targeted manual reviews when the score affects a release decision.

Send Feedback