vercel.com Security Audit on CyberFurl

Preparing the security report

Privacy controls

CyberFurl can load analytics only after you opt in. Core product features work without analytics consent.

vercel.com Security Audit — DNS, Email & SSL Report

Security report

Completed

CyberFurl completed the core public checks, but the combined audit score is still calculating while the remaining weighted evidence is validated.

Unified external risk score across DNS, email, web, malware, breach exposure, and technical readiness signals. Final scoring will publish once the remaining evidence settles.

Monitor DomainCheck another

Latest report

Ready to share

8/23/2026, 1:56:22 PM UTC

Coverage

7/7 stages

100% collected

Leading signal

Still evaluating

Waiting for scored data

Priority area

Still evaluating

DNS settings need attention

Immediate priority

DNS settings need attention

DNSSEC is not enabled.

Email the full report to get the DNS fix checklist.

Score status

Latest saved external posture

8/23/2026, 1:56:22 PM UTC

—Combined scoreCalculating7/7 stages

Coverage7/7 stages

Signals5 surfaced

StatusScore will publish as the remaining evidence settles

Email security

CyberFurl checks the public email authentication records for vercel.com including SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail), and DMARC (Domain-based Message Authentication, Reporting, and Conformance). These protocols determine whether emails from vercel.com can be trusted by receiving mail servers and whether they are likely to reach the inbox or be flagged as spam.

Email score

—/N/A

Risk level

Pending

Key finding

Email protection needs attention

Get the full email deliverability breakdown in the PDF report

Public findings

Issues at a glance

A public summary of the checks that surfaced the strongest visible signals in this report.

Check

Status

Severity

Explanation

DNS settings need attention

Review

warning

Business Impact: DNS hijacking risk and potential downtime. DNSSEC is not enabled.

Email protection needs attention

Review

warning

Business Impact: Attackers may impersonate your domain in phishing campaigns. Missing controls: SPF, DKIM, DMARC…

Web security needs attention

Review

warning

Business Impact: Increased exposure to browser-based attacks. Present: HSTS, CSP, X-Frame-Options, X-Content-Typ…

4 issues found that need attention

Get the full remediation workbook with step-by-step fixes delivered to your inbox.

View Complete Findings

Executive summary

CyberFurl is still gathering trustworthy public posture evidence for vercel.com. Keep this tab open while the combined audit stages finish collecting evidence.

Email the full report for the business summary, supporting context, and prioritized actions.

Control and exposure map

One primary exposure, one strongest control, and the remaining stages arranged as report rows instead of equal-weight dashboard tiles.

Primary exposure

DNS posture

Failed

DNS settings need attention

—

Scan failed · partial data

DNSSEC

Not enabled

Resolver and record checks were included in this audit.

DNSSEC

Off

Resolver health

Unknown

Strongest control

Email authenticity

SPF, DKIM, DMARC, and MX coverage were included.

—

Scan failed · partial data

Audit frame

Coverage

100% collected

7/7 stages

Signals

4 issues to review

Freshness

Ready to share externally

Checked today

Web security

Failed

Web security needs attention

—

Scan failed · partial data

HSTSPresent

CSPPresent

Present: HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy. Missing: Permi…

Malware intelligence

Limited detail

Threat telemetry is still being validated

—

Scan failed · partial data

Signals0

VerdictUnknown

Threat-feed telemetry and blacklist reputation were reviewed without an active hit.

Supporting evidence

Domain, infrastructure, and incident proof

Saved signals that support the scored audit without introducing another score layer.

Email Authentication (SPF, DKIM, DMARC)

Public section

Email security deep dive

Status

completed

Saved SPF, DKIM, DMARC, BIMI, MTA-STS, TLS-RPT, DANE, and MX evidence was included from the latest shared email scan.

Included in the current public preview

SPF recordMissing

DKIM selectorsMissing

DMARC pMissing

DMARC spNot set

DMARC pct100

DMARC ruaNot set

DMARC rufNot set

MX routes0

BIMIUnknown

MTA-STSUnknown

TLS-RPTUnknown

DANEUnknown

DMARC policyp= pct=100 rua= ruf=

DNS Configuration

Public section

DNS Records snapshot

Saved DNS records were included from the latest shared DNS scan.

Included in the current public preview

completed

SSL/TLS Certificate

Public section

SSL/TLS certificate panel

Saved certificate validity, protocol support, negotiated cipher, and transport-hardening evidence was included from the latest TLS scan.

Included in the current public preview

completed

IssuerCN=R12,O=Let's Encrypt,C=US

Valid fromMay 23, 2026

Valid toAugust 21, 2026

Days remaining55 days · Caution

TLS versionsTLSv1.3, TLSv1.2

Cipher suite gradeA

Negotiated cipherTLS_AES_128_GCM_SHA256

HSTSMissing

OCSP staplingUnknown

CT logsUnknown

Accepted cipherTLS_AES_128_GCM_SHA256

Certificate

SubjectCN=*.vercel.com

IssuerCN=R12,O=Let's Encrypt,C=US

TLS Protocols

TLSv1.3Supported

TLSv1.2Supported

TLSv1.1Not supported

TLSv1.0Not supported

Cipher Suites

Cipher

Protocol

Strength

TLS_AES_128_GCM_SHA256TLSv1.3strong

ECDHE-RSA-AES256-GCM-SHA384TLSv1.2strong

DHE-RSA-AES256-GCM-SHA384TLSv1.2strong

ECDHE-RSA-CHACHA20-POLY1305TLSv1.2strong

ECDHE-RSA-AES128-GCM-SHA256TLSv1.2strong

Subject Alternative Names (2)

*.vercel.comvercel.com

Web Security Headers

Security Headers

Strict-Transport-Security

PRESENT

max-age=31536000; includeSubDomains; preload

Content-Security-Policy

PRESENT

default-src 'self' vercel.com *.vercel.com assets.vercel.com *.vercel.sh vercel.live wss://*.vercel.com *.codesandbox.io localhost:* chrome-extension://* https://www.youtube-nocookie.com https://risk.clearbit.com https://react-tweet.vercel.app/*;script-src 'self' 'unsafe-eval' 'unsafe-inline' 'inline-speculation-rules' https://snap.licdn.com https://www.youtube.com cdn.vercel-insights.com va.vercel-scripts.com vercel.com *.vercel.com assets.vercel.com *.vercel.sh vercel.live wss://*.vercel.com *.codesandbox.io localhost:* chrome-extension://* https://www.youtube-nocookie.com https://risk.clearbit.com https://react-tweet.vercel.app/* cdp.vercel.com;style-src 'self' 'unsafe-inline' vercel.com *.vercel.com assets.vercel.com *.vercel.sh vercel.live wss://*.vercel.com *.codesandbox.io localhost:* chrome-extension://* https://www.youtube-nocookie.com https://risk.clearbit.com https://react-tweet.vercel.app/*;img-src 'self' blob: data: *.github.io avatars.githubusercontent.com user-images.githubusercontent.com vercel.com vercel.live *.vercel.sh assets.vercel.com cdn.raster.app https://images.ctfassets.net https://www.google.com https://i.ytimg.com https://s3.amazonaws.com pbs.twimg.com https://www.gravatar.com https://lishhsx6kmthaacj.public.blob.vercel-storage.com https://fvqcrhkhgatlyl2m.public.blob.vercel-storage.com;media-src 'self' blob: data: vercel.com *.vercel.com assets.vercel.com *.vercel.sh vercel.live wss://*.vercel.com *.codesandbox.io localhost:* chrome-extension://* https://www.youtube-nocookie.com https://risk.clearbit.com https://react-tweet.vercel.app/*;connect-src 'self' data: *.ingest.sentry.io *.ingest.us.sentry.io wss://ws-us3.pusher.com sockjs-use3.pusher.com react-tweet.vercel.app https://*.contentful.com www.vercel-status.com unpkg.com vercel.com *.vercel.com assets.vercel.com *.vercel.sh vercel.live wss://*.vercel.com *.codesandbox.io localhost:* chrome-extension://* https://www.youtube-nocookie.com https://risk.clearbit.com https://react-tweet.vercel.app/* cdp.vercel.com;font-src 'self' vercel.com assets.vercel.com vercel.live fonts.gstatic.com *.vercel.sh;frame-ancestors 'self' https://vercel.com https://app.contentful.com https://*.contentful.com https://*.vercel.sh https://*.vercel.com

X-Frame-Options

PRESENT

DENY

X-Content-Type-Options

PRESENT

nosniff

Referrer-Policy

PRESENT

origin-when-cross-origin

X-XSS-Protection

PRESENT

Feature-Policy

PRESENT

fullscreen 'self'; camera 'none'

X-DNS-Prefetch-Control

PRESENT

X-Download-Options

PRESENT

noopen

Access-Control-Allow-Origin

PRESENT

Cache-Control

PRESENT

public, max-age=0, must-revalidate

Server

PRESENT

Vercel

X-Powered-By

PRESENT

Next.js, Payload

Permissions-Policy

MISSING ESSENTIAL

All Response Headers30 headers

Strict-Transport-Security

PRESENT

max-age=31536000; includeSubDomains; preload

Content-Security-Policy

PRESENT

X-Frame-Options

PRESENT

DENY

X-Content-Type-Options

PRESENT

nosniff

Referrer-Policy

PRESENT

origin-when-cross-origin

X-XSS-Protection

PRESENT

Feature-Policy

PRESENT

fullscreen 'self'; camera 'none'

X-DNS-Prefetch-Control

PRESENT

X-Download-Options

PRESENT

noopen

Access-Control-Allow-Origin

PRESENT

Cache-Control

PRESENT

public, max-age=0, must-revalidate

Server

PRESENT

Vercel

X-Powered-By

PRESENT

Next.js, Payload

Accept-CH

PRESENT

Sec-CH-Prefers-Color-Scheme

Age

PRESENT

Content-Disposition

PRESENT

inline

Content-Encoding

PRESENT

Content-Type

PRESENT

text/html; charset=utf-8

Critical-Ch

PRESENT

Sec-CH-Prefers-Color-Scheme

Date

PRESENT

Thu, 09 Jul 2026 21:28:59 GMT

ETag

PRESENT

W/"253bce88f0832f6e2553e76f3f0a830a"

Set-Cookie

PRESENT

empty value

Transfer-Encoding

PRESENT

chunked

Vary

PRESENT

rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch

X-Matched-Path

PRESENT

/precomputed/exp~eyJhbGciOiJIUzI1NiJ9._g.11TATYb5FttlmLiMUwNMf65pWZ7VBH5gjjcVoQS1BOE/home/eyJhbGciOiJIUzI1NiJ9._g.11TATYb5FttlmLiMUwNMf65pWZ7VBH5gjjcVoQS1BOE/redesign-2026

X-Nextjs-Prerender

PRESENT

X-Nextjs-Stale-Time

PRESENT

300

X-Pathname

PRESENT

X-Vercel-Cache

PRESENT

HIT

X-Vercel-Id

PRESENT

iad1::2bj4m-1783632539394-550ac2385fa7

Infrastructure & Other Headers17 headers

Accept-CH

PRESENT

Sec-CH-Prefers-Color-Scheme

Age

PRESENT

Content-Disposition

PRESENT

inline

Content-Encoding

PRESENT

Content-Type

PRESENT

text/html; charset=utf-8

Critical-Ch

PRESENT

Sec-CH-Prefers-Color-Scheme

Date

PRESENT

Thu, 09 Jul 2026 21:28:59 GMT

ETag

PRESENT

W/"253bce88f0832f6e2553e76f3f0a830a"

Set-Cookie

PRESENT

empty value

Transfer-Encoding

PRESENT

chunked

Vary

PRESENT

rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch

X-Matched-Path

PRESENT

/precomputed/exp~eyJhbGciOiJIUzI1NiJ9._g.11TATYb5FttlmLiMUwNMf65pWZ7VBH5gjjcVoQS1BOE/home/eyJhbGciOiJIUzI1NiJ9._g.11TATYb5FttlmLiMUwNMf65pWZ7VBH5gjjcVoQS1BOE/redesign-2026

X-Nextjs-Prerender

PRESENT

X-Nextjs-Stale-Time

PRESENT

300

X-Pathname

PRESENT

X-Vercel-Cache

PRESENT

HIT

X-Vercel-Id

PRESENT

iad1::2bj4m-1783632539394-550ac2385fa7

Subdomains & Infrastructure

Public section

IP intelligence

Saved resolved IP, ASN, provider, and location evidence was included from the latest shared infrastructure snapshot.

Included in the current public preview

completed

Resolved IPs (7)

64.239.109.1

64.239.109.193

64.239.123.193

64.239.123.65

76.76.21.112

64.239.109.129

3.173.22.110

Hosting Provider

Unknown

Organization

Unknown

ASN

Unknown

Country

Unknown

Infrastructure

Unknown

Reverse DNS

vercel.com

SubdomainDiscovery

Subdomain footprint

13 public hostnames were included in the latest saved enumeration snapshot.

Saved 7/9/2026, 9:29:29 PM UTC

Completed

Discovered13

Subdomain inventory (13)

Subdomain

IP Address

Status

vercel.com64.239.109.1Live

ns1.vercel-dns.com—Live

ns2.vercel-dns.com—Live

backup.vercel.com64.239.109.193Live

appserver.vercel.com64.239.123.193Live

apps.vercel.com64.239.109.193Live

app.vercel.com64.239.123.65Live

app-dev.vercel.com64.239.109.1Live

api.vercel.com76.76.21.112Live

api-v1.vercel.com64.239.109.129Live

admin2.vercel.com64.239.123.65Live

admin1.vercel.com64.239.123.193Live

admin.vercel.com3.173.22.110Live

PortScan

Network exposure

2 open port(s) and 0 closed port(s) found in the latest saved port scan.

Saved 7/9/2026, 9:29:29 PM UTC

Completed

Total Open Ports

Total Closed Ports

Filtered / Blocked

Open Ports (2)

Unknown

open

80/TCP

Unknown

open

443/TCP

All Scanned Ports7 total ports

Port

Protocol

Service

State

21tcp—filtered

22tcp—filtered

25tcp—filtered

8080tcp—filtered

8443tcp—filtered

TracerouteAPI

Network route telemetry

Traceroute collected 0 hop(s) but did not confirm destination.

Saved 6/26/2026, 1:25:51 PM UTC

Completed

Hop Count

Route Reached

Avg RTT

0.0 ms

Min RTT

0.0 ms

Max RTT

0.0 ms

First Hop

Unknown

Final Hop

Unknown

WHOIS & Registration

Public section

WHOIS panel

Saved registrar, lifecycle, and nameserver evidence was included from the latest WHOIS lookup.

Included in the current public preview

completed

Registrar

Amazon Registrar, Inc.

Privacy Protection

Yes

Expiry Health

1138 days · Healthy

Created

Oct 4, 1999

Updated

May 16, 2026

Expires

Oct 4, 2029

Nameservers (4)

a.zeit-world.co.uk

b.zeit-world.org

e.zeit-world.com

f.zeit-world.net

EPP Status Codes

clientTransferProhibited

Immediate priorities

DNS settings need attention

Business Impact: DNS hijacking risk and potential downtime.
DNSSEC is not enabled.

Warning

Next step

Email the full report to get the DNS fix checklist.

Email protection needs attention

Business Impact: Attackers may impersonate your domain in phishing campaigns.
Missing controls: SPF, DKIM, DMARC.

Warning

Next step

Email the full report to get the email authentication checklist.

Web security needs attention

Business Impact: Increased exposure to browser-based attacks.
Present: HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy. Missing: Permissions-Policy.

Warning

Next step

Email the full report to get the web hardening checklist.

Report context

Frequently Asked Questions

Is vercel.com safe?

CyberFurl has collected publicly observable security signals for vercel.com but a final composite score has not yet been computed. The report covers DNS, email authentication, web security headers, and SSL/TLS evidence gathered on August 23, 2026 at 1:56 PM UTC.

Is DNSSEC enabled on vercel.com?

No. CyberFurl found that DNSSEC is not enabled on vercel.com (status: unsigned). Without DNSSEC, DNS responses cannot be cryptographically verified, leaving the domain potentially vulnerable to cache-poisoning and man-in-the-middle attacks on DNS resolution.

Does vercel.com use HTTP security headers?

CyberFurl scanned the HTTP response headers served by vercel.com. 5/6. Properly configured security headers protect visitors from clickjacking, cross-site scripting, and information disclosure.

Does vercel.com use a valid SSL/TLS certificate?

CyberFurl verified the TLS configuration for vercel.com: certificate issued by CN=R12,O=Let's Encrypt,C=US. A trusted TLS certificate ensures that traffic between visitors and vercel.com is encrypted and that the server identity is verified.

Who is the registrar for vercel.com?

vercel.com is registered with Amazon Registrar, Inc.. The registration is scheduled to expire on Active. CyberFurl monitors WHOIS records to detect registrar changes, upcoming expirations, and domain status flags that could affect security.

When does vercel.com's domain registration expire?

According to CyberFurl's WHOIS lookup, the vercel.com registration expires on Active. Expired domains can be snatched by attackers for phishing or malware distribution. CyberFurl can alert you as the expiration date approaches.

How many subdomains were discovered for vercel.com?

CyberFurl's passive enumeration discovered 13 subdomains associated with vercel.com. Examples include: vercel.com, ns1.vercel-dns.com, ns2.vercel-dns.com. The full inventory appears in the infrastructure evidence section. Unmonitored subdomains are a common blind spot — expired certificates or misconfigured services on forgotten subdomains can become silent entry points for attackers.

What ports are exposed on vercel.com?

CyberFurl's network scan found 2 open ports on vercel.com. Exposed services: 80/tcp (unknown), 443/tcp (unknown). Open ports represent potential entry points for attackers. Unused services should be closed and exposed services kept patched and monitored continuously.

When was vercel.com last scanned by CyberFurl?

The current public report for vercel.com reflects security data collected on August 23, 2026 at 1:56 PM UTC. CyberFurl continuously refreshes public reports as new evidence is gathered. Enable continuous monitoring to receive real-time alerts the moment security-relevant changes are detected.

How does CyberFurl collect security information about vercel.com?

CyberFurl relies exclusively on publicly observable signals — no intrusive probing or credentials are required. Data sources include: DNS record queries (A, AAAA, MX, TXT, NS, CAA, PTR), SSL/TLS certificate inspection via standard TLS handshake, HTTP response header analysis, WHOIS registry lookups, passive subdomain enumeration, non-intrusive port reconnaissance, network route telemetry (traceroute), and public threat intelligence feeds.

Why can security findings change between scans for vercel.com?

Security posture is dynamic. Findings for vercel.com can change when: SSL/TLS certificates are renewed or expire, DNS records are updated (MX, SPF, DMARC, NS changes), new subdomains are provisioned or decommissioned, HTTP security headers are added or removed from server configuration, hosting or CDN infrastructure changes, or threat intelligence databases are updated with new indicators of compromise.

Can I monitor vercel.com for security changes?

Yes. CyberFurl's continuous monitoring tracks DNS record changes, SSL/TLS certificate expiry and reissuance, email authentication policy updates (SPF, DKIM, DMARC), WHOIS registration changes, new subdomain discoveries, open port changes, and threat intelligence hits for vercel.com. Enable continuous monitoring to receive alerts the moment security-relevant changes occur.

Learn More

DMARC DKIM DNSSEC CVE Database OWASP Top 10 DDoS Mitigation TLS/SSL Security

vercel.com External Security Audit & Risk Exposure Report

vercel.com Email Deliverability & DMARC Authentication

Issues at a glance

vercel.com Executive Summary & Key Threat Intelligence

vercel.com Attack Surface: DNS, Web & Exposure Analysis

DNS posture

Email Authentication (SPF, DKIM, DMARC)

DNS Configuration

SSL/TLS Certificate

Web Security Headers

Security Headers

Subdomains & Infrastructure

Open Ports (2)

WHOIS & Registration

vercel.com Vulnerability Fixes & Recommended Actions

Frequently Asked Questions

Related Reports

Learn More