Infrastructure
· 9 checks — DNS, redirects, IPv6, crawlability, URL variants, and domain intelligence rolled into one auditable list.CIPv6 ReadinessActionNo IPv6 supportREVIEW
IPv6 support is increasingly important for global accessibility. About 40% of internet users have IPv6 connectivity.
No AAAA records — same impact as 'no IPv6 (AAAA) records'; IPv6-preferring clients pay extra latency falling back to IPv4.
Source: Google IPv6 stats
BCrawlabilityno robots.txt, no sitemapREVIEW
robots.txt is optional but recommended. It tells search engine crawlers which pages to index.
No robots.txt — crawlers fetch /robots.txt and get 404; not breaking but means default crawl behavior with no directives or sitemap reference.
Learn more ▾ ▴
A minimal robots.txt with `User-agent: * / Allow: / / Sitemap: https://example.com/sitemap.xml` covers the basics. Without it, crawlers behave fine but lose the sitemap signal and can't be selectively blocked from crawl-traps.
Source: robotstxt.org
A sitemap helps search engines discover and index your pages more efficiently.
No sitemap.xml — Google relies on crawl-graph discovery alone, slowing indexing of deep or fresh URLs.
Learn more ▾ ▴
A sitemap accelerates Google's discovery of new and updated content. Most CMSes auto-generate one; static-site frameworks need a build-step plugin. Reference it from robots.txt and submit in Search Console to confirm Google can fetch it.
Source: sitemaps.org / Google Search Central
No robots.txt found
This is fine for most sites — a missing robots.txt allows all crawling by default.
No sitemap found
Adding a sitemap helps search engines discover your pages.
BURL Variantswww/non-www, trailing slash, HTTP→HTTPSREVIEW
www / non-www
HTTP → HTTPS
HTTP version does not redirect to HTTPS
BTLS Certificate Expiry & Recommendations213 days until leaf cert expires — 5 issues to addressREVIEW
Certificate validity
Recommended actions
- Prefer TLS 1.3 — TLS 1.2 is acceptable but TLS 1.3 removes RSA key exchange and improves latency
- Add includeSubDomains to the HSTS directive
- Add the preload directive and submit to hstspreload.org once max-age + includeSubDomains are in place
- Enable DNSSEC on your domain for DNS spoofing protection
- Enable OCSP stapling on your TLS server to remove a CA roundtrip and protect user privacy
BCDN & DeliveryAkamaiREVIEW
A+DNS Records1 A records, 24 ms lookupPASS
| A | 23.55.213.208 |
| AAAA | — |
| CNAME | — |
| NS | ext-ns1.morganstanley.net, ext-ns3.morganstanley.net, ext-ns5.morganstanley.net, ext-ns8.morganstanley.net, ext-ns10.morganstanley.net, ext-ns12.morganstanley.net |
| MX | 0 mx2.morganstanley.com 0 mx3.morganstanley.com 0 mx1.morganstanley.com 0 mx4.morganstanley.com |
| TXT | SPF v=spf1 ip4:199.89.64.0/18 ip4:205.228.0.0/17 include:_spf.morganstanley.neolane.... MS=D2F22D15AD6940E6D1595EEA2A82F8EBBE5A7860 MS=ms22717582 MS=ms34046956 MS=B11B1927AD6F301CCA14AE1952F7EE3F77FA0DA3 SFMC-4NiJy_Iak_jn9G4UG21BCIX17tC5te1FrgeULmPs jnbJ5VZLAykqqaTWX+bDebORqxQEF2Tl7P+GzZ2Dl9Umwn1FluefTvkKuMwDFxAASJ4HaDdjp5fiaaRJ... docusign=01cdb7c9-0689-4d6c-aec9-7755315fcd04 docusign=d0cb5a28-a75d-4b5a-b7ed-96a5bf28ee10 Dynatrace-site-verification=f820f38b-6bab-42a4-ba93-c510fc8d95f3__6ia8tdel7lkv90... SFMC-ZKL-mpN1wFcNGjkC0ncn5Q_10UG6bQIc3M75E28E SFMC-_U97wzs9WeIMRu1Ogz26fNvO8pRPAWR2iy1Mtw_E SFMC-ZhfGC4YE5f0EWQ_QB7l5jUeSmcma_nppruiyc2GX SFMC-hykCYq_Hy8fBF57ZZcOZ4wP9mzIlfOneUYxWGyKh mongodb-site-verification=PdOHldV5pWVTFD38TZFd0uP5pN2KAdKf atlassian-domain-verification=F4W/kDM8Hiptb7FLWF88569dinG0xp8RpJihH9P3eAb6axyjKq... apple-domain-verification=CCHirdPSdqNcSTdw apple-domain-verification=VGV4vVv8k7z8Xjd2 apple-domain-verification=4DolHYs99fzmivr2 uber-domain-verification=7c136cde-2819-42bd-80ee-10d198d9fedd wiz-domain-verification=f6c7c5c2412d5ec400952b27344f657966d572471626253f05913917... cisco-ci-domain-verification=37939da7e981bd61c0d4b47f2fb7f347a6b75ceffd7b48d0f8f... autodesk-domain-verification=mCe8qXoGUyvSDwovDrQS google-site-verification=RYsm-Dmew_1HnXd0D_d0THltS5_5OV9a93UEDCZMdFE pardot3032=e9d40f20fce719db3b64485e71711719a05cdf94d2e433e1d773b395d4dab68d asv=d4ce34268c259ec0685417e93e22ebaa canva-site-verification=wRuArEOQ89sOc-3mPb9Yqw domain-verification=16be90753d8401fbf6139f44696734fb44fa6db312f59df23562406bfc55... dell-technologies-domain-verification=morganstanley.com_b73208cd-f0f0-4209-ae0d-... intersight=0aeef0ed5bd1b17a293d9494f1cb28ad28e20c6932cb7d32860976057da38e65 docker-verification=6151843d-1f00-407e-a500-d4850180995c figma-domain-verification=3fe766178faeda5b2b958ababb0ed36ddd84097689805b66ac345b... openai-domain-verification=dv-nlk39T5F1QLeg5XfeVInXiAR paloaltonetworks-site-verification=6060c8d373330618e5e966df52c09fa09f16346261e23... liveramp-site-verification=vghYxD0cvpAU3QesU37b8LkwMct24AB-T3kD9acej_Y notion-domain-verification=a2JLYzSOnyHp7QG6byrW7teNCQn2l0sEOnddMlCRKIq anthropic-domain-verification-cfyw5b=NqiPvaPrHby3VqrH6D85nS6DO 00D300000000aex=1TBKe000000Gma9 00D7d000009nn5s=1TBdq0000000BTJ;00D7f000000APvU=1TBdq0000000BUv;00D4x000006sKZr=... jamf-site-verification=Fz84V5ZHFT1wPgjJL2ux3g 00DD3000000Cn7k=1TBD30000008OI5 00D590000004ehm=1TBDk0000000001 00DD6000000VTqm=1TBD6000000001T 00D2g0000008dHr=1TBD10000008OIZ 00D040000004cgp=1TBDc0000004C9W 00D1900000016Zs=1TBDV000000000k 00DD30000002Onx=1TBD30000004CEr 00DD30000002PfR=1TBD30000004CE4 00DD30000002NM3=1TBD30000004CCq 00DDh0000009aNs=1TBDh000000CaSP 00D8A000000MitH=1TBKR000000KyjL 00DDS000001zghE=1TBDS0000008OJr 00DDG00000NAnia=1TBDG0000000022 00D8J0000004eWj=1TBKQ000000CaRg 00D8N0000004z76=1TBDV000000001J 00DDi0000001bvB=1TBDi0000000014 00DDf000000QS8O=1TBDf0000004CAG 00DD10000004aBT=1TBD1000000CaSe lutron-domain-verification-wmvzvs=Ec6epeqkSMA3DDKlNTpbUSMAO 00Dj0000000JgIh=1TBKi000000KynY 00D50000000a4nt=1TBHt000000blL0 00D41000000e8Jh=1TBKk000000KyjV 00D3000000001T1=1TBHt0000004C9I 00Df40000003tA1=1TBKZ0000004CFL 00D6g00000364Az=1TBKf000000KykO |
| CAA | Lookup not available with standard resolver |
Multiple A records provide failover if one server goes down.
Single A record means a single point of failure — if that IP goes down, your site is unreachable until DNS TTL expires.
Learn more ▾ ▴
Add multiple A records for round-robin failover, or use a managed DNS provider with health-checked failover (Route 53, Cloudflare, NS1). Short TTL (60-300s) lets clients recover faster on outages.
Source: SRE practice / DNS architecture
CAA record lookup requires a specialized DNS resolver. This check will be available in a future update.
Informational: CAA (Certification Authority Authorization) records weren't checked in this scan.
A+Redirect Chain0 redirect(s), 16 ms totalPASS
https://morganstanley.com
16 ms · HTTP/1.1 FINAL
| # | URL | Status | Time | Protocol | Server |
|---|---|---|---|---|---|
| 1 | https://morganstanley.com | 301 | 16 ms | HTTP/1.1 | AkamaiGHost |
ADomain Intelligencemorganstanley.com — via CSC Corporate Domains, Inc., 30 years, 4 months old, hosted on AkamaiPASS
EXPIRED
May 23, 2026
213 days
Issued by Sectigo Limited
30 years, 4 months
Registered May 24, 1996
Not enabled
Protects against DNS spoofing
Akamai
ASN AS16625
23.55.213.208
CSC Corporate Domains, Inc.
Expiry timeline
Recommended actions
- Domain has EXPIRED — renew immediately to avoid total site outage
- Enable DNSSEC to protect visitors from DNS spoofing
- Enable registrar lock (clientTransferProhibited) to block unauthorized domain transfers
Consider enabling auto-renewal to prevent accidental expiration.
Domain expiry approaching — renew immediately and ensure auto-renew + alerting are configured.
Source: ICANN renewal policy
DNSSEC protects against DNS spoofing attacks. While not required, enabling DNSSEC adds an additional layer of security. Contact your DNS provider to enable it.
Without DNSSEC, an attacker who can poison your DNS can hijack your domain — and SSL certs alone don't stop them.
Learn more ▾ ▴
DNSSEC adds cryptographic signatures to DNS records, preventing forged responses from poisoning resolver caches. Without it, an attacker who controls the network path can redirect your domain to a malicious server before any HTTPS handshake happens. Most modern registrars (Cloudflare, Google Domains, Route 53) enable it with one toggle.
Source: ICANN / RFC 4033
The domain can be transferred without an unlock step. Enable registrar lock (clientTransferProhibited) in your registrar's control panel to protect against unauthorized or accidental transfers.
Without registrar lock, an attacker who phishes your registrar credentials can transfer the domain in minutes — total brand hijack.
Learn more ▾ ▴
Registrar lock (clientTransferProhibited, clientUpdateProhibited, clientDeleteProhibited) requires extra verification before any transfer/update/delete. Every major registrar offers it free. Combined with 2FA on your registrar account, it's the strongest defense against domain hijacking.
Source: ICANN / domain-security best practice