apple.com

Scanned 8 days ago · Aug 11, 2026, 9:22 PM

A-

TLS & Certificate

Protocol support, cipher strength and the certificate chain, evaluated the way a browser would.

Score80%
  • the server accepts 3 weak cipher suite(s): ECDHE-RSA-AES128-SHA256, AES256-GCM-SHA384, AES128-GCM-SHA256
  • no Strict-Transport-Security (HSTS) header
NegotiatedTLSv1.3, TLS_AES_256_GCM_SHA384
Forward secrecyYes
HSTSnot enabled

Protocol support

YesTLS 1.3
YesTLS 1.2
NoTLS 1.1 (deprecated)
NoTLS 1.0 (deprecated)

Cipher suites probed

Each suite below was tested with its own TLS 1.2 handshake, restricted to exactly that cipher - “accepted” means the server completed a handshake using it, not merely that it's listed as a possibility.

ECDHE-ECDSA-AES256-GCM-SHA384
SecureAccepted
ECDHE-RSA-AES256-GCM-SHA384
SecureAccepted
ECDHE-ECDSA-AES128-GCM-SHA256
SecureAccepted
ECDHE-RSA-AES128-GCM-SHA256
SecureAccepted
ECDHE-ECDSA-CHACHA20-POLY1305
SecureNot offered
ECDHE-RSA-CHACHA20-POLY1305
SecureNot offered
DHE-RSA-AES256-GCM-SHA384
SecureNot offered
DHE-RSA-AES128-GCM-SHA256
SecureNot offered
ECDHE-RSA-AES256-SHA384
WeakNot offered
ECDHE-RSA-AES128-SHA256
WeakAccepted
AES256-GCM-SHA384
WeakAccepted
AES128-GCM-SHA256
WeakAccepted
DES-CBC3-SHA
InsecureNot offered
RC4-SHA
InsecureNot offered
NULL-SHA
InsecureNot offered

Certificate

Subjectapple.com
IssuerApple Public EV Server ECC CA 1 - G1
Additional namesapple.com
ValidJun 17, 2026, 9:31 PM – Sep 15, 2026, 6:01 PM (expires in 35 days)
KeyEC prime256v1
Certificate chain3 certificate(s)
Trusted by common trust storesYes
Matches the scanned hostnameYes
Self-signedNo
C

Security Headers

The HTTP response headers browsers use to restrict what a page - or an attacker inside it - can do.

Score65%
  • no Permissions-Policy header
  • no Cross-Origin-Opener-Policy header
  • no Cross-Origin-Resource-Policy header
  • the Server header discloses "Apple"
  • cookie "geo" is missing the Secure flag
  • cookie "geo" is missing the HttpOnly flag
Content-Security-Policydefault-src 'self' blob: data: *.akamaized.net *.apple.com *.apple-mapkit.com *.cdn-apple.com *.organicfruitapps.com; child-src blob: mailto: embed.music.apple.com embed.podcasts.apple.com https://recyclingprogram.apple.com https://smb.apple.com https://nova.apple.com swdlp.apple.com www.apple.com www.instagram.com platform.twitter.com www.youtube-nocookie.com; img-src 'unsafe-inline' blob: data: *.apple.com *.apple-mapkit.com *.cdn-apple.com *.mzstatic.com; script-src 'unsafe-inline' 'unsafe-eval' blob: *.apple.com *.apple-mapkit.com www.instagram.com platform.twitter.com; style-src 'unsafe-inline' *.apple.com
Strict-Transport-Securitymax-age=31536000; includeSubdomains; preload
X-Content-Type-Optionsnosniff
X-Frame-OptionsSAMEORIGIN
Referrer-Policyno-referrer-when-downgrade
Permissions-Policynot set
Cross-Origin-Opener-Policynot set
Cross-Origin-Resource-Policynot set
Cookiesgeo (no flags)
A+

Email

Whether mail delivered to this domain is protected in transit, and whether SPF/DMARC stop it being spoofed.

Score100%
  • port 25 was not reachable on any mail server from our scanner (commonly blocked by cloud providers) - mail transport security could not be verified
SPFv=spf1 include:_spf.apple.com include:_spf-txn.apple.com ~all
DMARCv=DMARC1; p=quarantine; sp=reject; rua=mailto:[email protected]; ruf=mailto:[email protected];

Mail servers

mx-in.g.apple.comnot reachable on port 25 from our scanner
mx-in-sg.apple.comnot reachable on port 25 from our scanner
mx-in-hfd.apple.comnot reachable on port 25 from our scanner