Skip to content
https://kpmg.com

Infrastructure

· 9 checks — DNS, redirects, IPv6, crawlability, URL variants, and domain intelligence rolled into one auditable list.
SCORE
91
GRADE
A
FIX
0
REVIEW
3
PASS
6
INFO
0
Probed from Madrid, Spain
301 Moved Permanently
Checks
9
6 PASS 3 REVIEW
C
IPv6 Readiness
Action
No IPv6 support
REVIEW
No IPv6 support
Info::
No IPv6 (AAAA) records found
IPv6 support is increasingly important for global accessibility. About 40% of internet users have IPv6 connectivity.
No IPv6 Support
About 40% of internet users have IPv6. Consider adding AAAA records.

IPv6 support is increasingly important for global accessibility. About 40% of internet users have IPv6 connectivity.

Why this matters

No AAAA records — same impact as 'no IPv6 (AAAA) records'; IPv6-preferring clients pay extra latency falling back to IPv4.

Source: Google IPv6 stats

B
TLS Certificate Expiry & Recommendations
54 days until leaf cert expires — 5 issues to address
REVIEW

Certificate validity

54
days left
0d 30d 60d 90d+

Recommended actions

  • Extend HSTS max-age to at least 31536000 (1 year) to meet the preload list criteria
  • Add includeSubDomains to the HSTS directive
  • Add the preload directive and submit to hstspreload.org once max-age + includeSubDomains are in place
  • Enable DNSSEC on your domain for DNS spoofing protection
  • Enable OCSP stapling on your TLS server to remove a CA roundtrip and protect user privacy
B
CDN & Delivery
Akamai
REVIEW
Akamai
Info::
Site is served via Akamai CDN
Got: server header
CDN Detected: Akamai
Provider Akamai Evidence server header
A+
DNS Records
2 A records, 80 ms lookup
PASS
2 A records, 80 ms lookup
Info::
Resolves to 2 IPv4 address(es)
Got: 23.211.15.163, 23.211.15.158
Info::
No IPv6 (AAAA) records
Info::
6 nameserver(s) configured
Got: a10-65.akam.net, a16-66.akam.net, a3-67.akam.net, a5-65.akam.net, a4-64.akam.net, a1-26.akam.net
Info::
2 mail exchanger(s) configured
Info::
CAA records not checked
CAA record lookup requires a specialized DNS resolver. This check will be available in a future update.
Info::
SPF record present in TXT
Info::
DNS resolution time: 80 ms
Got: 80 ms
A23.211.15.163, 23.211.15.158
AAAA—
CNAME—
NSa10-65.akam.net, a16-66.akam.net, a3-67.akam.net, a5-65.akam.net, a4-64.akam.net, a1-26.akam.net
MX
2 mxb-00120b02.gslb.pphosted.com
2 mxa-00120b02.gslb.pphosted.com
TXT
l4ts07sbxky1vdl8vwgqdrjrk7fqn01r
jwk77vj7ndm1d758cddr85kp84ygcv70
docusign=a5faf54f-16e6-4e54-b356-7a7d1c519563
_globalsign-domain-verification=jIdaeuXlX0O07OqRmdC5bLZ3MTxt7uuGJs2crTNPfu
_euei94tj6t6qx9ke9qkjygd7qygtw3q
google-gws-recovery-domain-verification=47166815
google-site-verification=403G4jqbyF-G0c_JncQdmifIs49o8LcWFgTQ5Ggukew
72am62j8s66v23uao60djgpja8
b9bvdpv8ffedcs6bj5ud53nu4i
notion-domain-verification=P8Awoy0hrqOCEi9Eq6CiBXMfv3TsBEdHg4gGD4KoPUQ
_p4wplmgveklhlp0qkyqqsur5alyzf1z
cnm5dlfjlk0mko63fc5v39dv34
d365mktkey=3Ot5GQ4n4slcBkw35CvAZxTOR8jLnlGxCdxN2FXNHxcx
_9k8cqmdaazii9h6laiiea691bzisxve
963ujm3ohgcbbprv2h5ee0fevl
bl5rur97lfb6l62u2pagairnjg
9ukhci54e7nra88tsrfb9rn7sg
3dlb3d4qfq61dakbii6v0p61sa
plm4h5/RjPEBIQxvCwHhwbzTNPJwQKwxmqRzD/2cGp99m9JGYOJIdmAUABNLiPfbfAr0GZOK3dCsLIaG...
google-site-verification=BrCQ3GoaWvXCMcNgj-llWtYLup-A5sO0bQuSADQaZrs
pardot788803=7ec388cf2ade1d67018859d8f52d8094292c1d0688accba8443fc9a3b8153662
_ico0vm6o7e8xhcih0t4al2m2b5rxsbr
flexera-domain-verification-fhbjdsqvvdjvdjxa
3vgmgghz3lwm416mfdcv00nsy4ny4h2n
docker-verification=4f024ce7-ef36-4683-bf3e-ab7ddf85f9e8
facebook-domain-verification=c76lagctm3xnxv58p872raxzgk612t
d365mktkey=tRbXxJdxNdjousDzjlHLNKGP8XCcH7OPtrzpqvJ7dFYx
00D2p0000013VVQ=1TBQu0000000hMj
jp2prm8agf3q7etdsiaq74dfmq
SPF v=spf1 include:_spf.kpmg.com ip4:205.220.184.29 ip4:185.183.31.56 ip4:205.220.17...
a0df0ed7-9760-47a0-9ced-760e213b91f7
notion-domain-verification=DirNMkhmK9c9y31fbchlvbz3WHMd9qJlnPFaANXAcKj
cisco-ci-domain-verification=4ddf75ea9c7641350cc094fcd50f85523b563f4abefb2ea174c...
j2a0ink153u6mnckfff0b4p5g
y1tdd07113swctkf39cm82xrc1zkh8bj
smartsheet-site-validation=jy6DWPStTCSXIKQD5gxLT11TjXmGgTnT
_r9nboj36pic2bztjvp11gpd7nlybjzo
m42veer0drrci68lh8buuina1s
+Ss1ybvbvf29NCOS1jI7ZytSUGu+6KWfqEAaAoSt09g=
facebook-domain-verification=zyzferd0kpm04en8wn4jnu4ooen5ct
jhlfjcaiakogfvqtd7o6ni3is5
17nb118fdl48kmkibsbdqnestm
_c4ucmm0nr7ebfr5dgbnq8q820agjmxx
_l635za1nmul3vkh9q2m5rfyfl6xlqmi
swisssign-check=5gx937BZyDEwppr7-1KfZSLuCxw
docusign=2ef4e2b3-dee1-4f09-8df2-b4659fa1562f
lpb3gdc1g7i68eg5nt97oje0uj
google-site-verification=KJuIbH28rHmzDspb4c0WjPHI9AQKKVcBFiCvQeXPgRc
successfactors-site-verification=NzNlNjdkZGY2ZjQ1NWY4Y2I1ZTkzODQxZDViMzQ1MDZlNTA...
DomainVerification=GVRY6PQAYN5HR0IAMXJNAABFX3GMID468F5660B9147F8KU9IGHUFEFNQDFPY...
_saml-domain-challenge.388a55f4-b312-4876-a7a2-ad855855bb3a.4ed2079f-05cf-4314-9...
access-domain-verification=1756dd6e4dfd33a5788e72d9fb51d9bccb1c129535a514a8a6789...
34ghdn8hqr6xjx9r0l0ljt97946nm5tb
cobua5285drag2eoj4mngflal8
_404t94h49418jftajimmb17x860bwy8
hxpktv20301qrqzkj7v7g9917vhb4kvt
flexera-domain-verification-rysaorskldiffwmc
_xndb7jsx4pm7e5uiu9vmh6fk0atf3uw
nioqnq398evc8ssjc5916rm23v
KoKNAowh10Ke2v66dHUMAM3MoRwqc63xKu9zz0pK2wHyze2Nbj2DfAzMqGM3pJazAoCdi3U0a52beTVh...
d365mktkey=7rUtGsQjup9Pqb0oseJRe45CAUyv0BCEgKUUCiWXMowx
d365mktkey=SLspPxqDlHoj3JXhWGKxcU69r6jK4tCArlc6EtedFW0x
lmy2rcqwbbbcs0f010chrgm4h84183pg
kvo55gfd8ri85tlrjugislosvq
google-site-verification=bJEhTqvZQtNkRRN2FSErdH6x883Psi31KkKdYkxQXec
msfpkey=6fidazg52izz1f7qxiepcwx9n
flexera-domain-verification-ifeigriavchxwjkt
smartsheet-site-validation=diZ_HtoZQq_LKPCJPXBw7FsNoanU9gWH
atlassian-domain-verification=1be3aDpvpkZaguwBickLNbwLB3CtIhdyOUsbgVbJLxzRXd26K8...
d365mktkey=KKya8mnxxoHLyxfnsxXYCup6cO5BshILMfiNX13AMcIx
scpl06frf4bh8jhmfs2k6cdupp
paloaltonetworks-site-verification=49390c49e9d930e1dd229c0fb93329a10854c77a595b7...
sending_domain788803=65d4a339d1b319e135ad20a966bf2a1ef5a4c1c14d1a2f0c77e3b2d7a4a...
CAALookup not available with standard resolver
Resolved in 80 ms

CAA record lookup requires a specialized DNS resolver. This check will be available in a future update.

Why this matters

Informational: CAA (Certification Authority Authorization) records weren't checked in this scan.

A
Redirect Chain
1 redirect(s), 64 ms total
PASS
1 redirect(s), 64 ms total
Info::
Single redirect
Got: https://kpmg.com → https://kpmg.com/xx/en.html (301)

https://kpmg.com

31 ms · HTTP/1.1

301

https://kpmg.com/xx/en.html

33 ms · HTTP/1.1 FINAL

#URLStatusTimeProtocolServer
1https://kpmg.com30131 msHTTP/1.1AkamaiGHost
2https://kpmg.com/xx/en.html20033 msHTTP/1.1

See the visual redirect chain in the HTTP Probe tab →

A+
Crawlability
robots.txt present, sitemap with 187 URLs
PASS
robots.txt present, sitemap with 187 URLs
Info::
robots.txt is present
Got: 215 bytes
Info::
sitemap.xml is present
Info::
sitemap.xml is valid XML
Info::
sitemap.xml contains 187 entries
Info::
Sitemap index with 187 child sitemaps
Info::
robots.txt references sitemap
robots.txt 200 OK
Size 215 B Sitemaps referenced 1 User-agents cludo, *, YouDaoBot Blocking No — crawling allowed
# Version 2024.10.16
# kpmg.com
User-agent: cludo
Allow:
User-agent: *
Allow: /
Disallow: /es/es.html?*utm_
Disallow: /es/es.html?*action
User-agent: YouDaoBot
Disallow: /
Sitemap: https://kpmg.com/sitemap-index.xml
sitemap.xml 200 OK
Type Sitemap Index URLs 187 entries Valid XML Yes
Child Sitemaps:
A+
URL Variants
www/non-www, trailing slash, HTTP→HTTPS
PASS
www/non-www, trailing slash, HTTP→HTTPS
Info::
www/non-www redirect configured correctly (preferred: non-www)
Info::
HTTP correctly 301-redirects to HTTPS

www / non-www

301https://www.kpmg.com/
200https://kpmg.com/

Preferred variant: non-www

HTTP → HTTPS

301http://kpmg.com/ → https://kpmg.com/xx/en.html

Consistent

A+
Domain Intelligence
kpmg.com — via Nom-iq Ltd. dba COM LAUDE, 33 years, 11 months old, hosted on Akamai
PASS
kpmg.com — via Nom-iq Ltd. dba COM LAUDE, 33 years, 11 months old, hosted on Akamai
Info::
Domain registered until Oct 20, 2026 (6 months remaining)
Info::
DNSSEC is not enabled
DNSSEC protects against DNS spoofing attacks. While not required, enabling DNSSEC adds an additional layer of security. Contact your DNS provider to enable it.
Info::
Registrar: Nom-iq Ltd. dba COM LAUDE
Warning::
Registrar lock is NOT enabled
The domain can be transferred without an unlock step. Enable registrar lock (clientTransferProhibited) in your registrar's control panel to protect against unauthorized or accidental transfers.
Info::
Hosting: Akamai
Got: AS20940
Domain expiry

97 days

October 20, 2026

SSL certificate

54 days

Issued by DigiCert Inc

Domain age

33 years, 11 months

Registered October 21, 1992

DNSSEC

Not enabled

Protects against DNS spoofing

Hosting

Akamai

ASN AS20940

23.211.15.163

Registrar

Nom-iq Ltd. dba COM LAUDE

Unlocked 6 NS records
Expiry timeline
Today
+1 year
Domain expiry SSL expiry Danger zone (≤30 days)
Recommended actions
  • Enable DNSSEC to protect visitors from DNS spoofing
  • Enable registrar lock (clientTransferProhibited) to block unauthorized domain transfers
Registrar Nom-iq Ltd. dba COM LAUDE
Created October 21, 1992 (33 years, 11 months ago)
Expires October 20, 2026 (6 months)
Last Updated September 16, 2025
Name Servers a1-26.akam.net, a10-65.akam.net, a16-66.akam.net, a3-67.akam.net, a4-64.akam.net, a5-65.akam.net
DNSSEC Not enabled
Hosting
IP Address 23.211.15.163
ASN AS20940 (AKAMAI-ASN1, NL)
Provider Akamai
Data source: rdap (0.3s)

DNSSEC protects against DNS spoofing attacks. While not required, enabling DNSSEC adds an additional layer of security. Contact your DNS provider to enable it.

Why this matters

Without DNSSEC, an attacker who can poison your DNS can hijack your domain — and SSL certs alone don't stop them.

Learn more ▾

DNSSEC adds cryptographic signatures to DNS records, preventing forged responses from poisoning resolver caches. Without it, an attacker who controls the network path can redirect your domain to a malicious server before any HTTPS handshake happens. Most modern registrars (Cloudflare, Google Domains, Route 53) enable it with one toggle.

Source: ICANN / RFC 4033

The domain can be transferred without an unlock step. Enable registrar lock (clientTransferProhibited) in your registrar's control panel to protect against unauthorized or accidental transfers.

Why this matters

Without registrar lock, an attacker who phishes your registrar credentials can transfer the domain in minutes — total brand hijack.

Learn more ▾

Registrar lock (clientTransferProhibited, clientUpdateProhibited, clientDeleteProhibited) requires extra verification before any transfer/update/delete. Every major registrar offers it free. Combined with 2FA on your registrar account, it's the strongest defense against domain hijacking.

Source: ICANN / domain-security best practice

A+
HTTP Probe Timing
Total 73 ms — DNS, TCP, TLS, TTFB, content transfer breakdown
PASS
DNS Lookup DNS Lookup — time to resolve the domain name to an IP address.
28 ms
TCP Connect TCP Connect — time to establish a TCP connection to the server.
1 ms
TLS Handshake TLS Handshake — time to complete the HTTPS encryption handshake.
12 ms
Time to First Byte Time to First Byte — how long the server takes to respond with the first byte of data.
73 ms
Total Time Total request time from DNS lookup through full response.
73 ms

Connection waterfall

DNS Lookup 28 ms TCP Connect 1 ms TLS Handshake 12 ms Server Processing 32 ms Content Transfer 0 ms
All checks on this page are automated. Results are estimates - run targeted manual reviews when the score affects a release decision.

Send Feedback