A-

visa.com

Scanned 2 hours ago · Oct 14, 2026, 7:56 AM

A-

TLS & Certificate

Protocol support, cipher strength and the certificate chain, evaluated the way a browser would.

Score80%

the server accepts 2 weak cipher suite(s): AES256-GCM-SHA384, AES128-GCM-SHA256
no Strict-Transport-Security (HSTS) header

NegotiatedTLSv1.3, TLS_AES_256_GCM_SHA384

Forward secrecyYes

HSTSnot enabled

Protocol baseline

YesTLS 1.3 enabled

YesTLS 1.2 enabled

YesTLS 1.1 disabled

YesTLS 1.0 disabled

Cipher suites probed

Each suite below was tested with its own TLS 1.2 handshake, restricted to exactly that cipher - "accepted" means the server completed a handshake using it, not merely that it's listed as a possibility.

ECDHE-ECDSA-AES256-GCM-SHA384

SecureAccepted

ECDHE-RSA-AES256-GCM-SHA384

SecureAccepted

ECDHE-ECDSA-AES128-GCM-SHA256

SecureAccepted

ECDHE-RSA-AES128-GCM-SHA256

SecureAccepted

ECDHE-ECDSA-CHACHA20-POLY1305

SecureNot offered

ECDHE-RSA-CHACHA20-POLY1305

SecureNot offered

DHE-RSA-AES256-GCM-SHA384

SecureNot offered

DHE-RSA-AES128-GCM-SHA256

SecureNot offered

ECDHE-RSA-AES256-SHA384

WeakNot offered

ECDHE-RSA-AES128-SHA256

WeakNot offered

AES256-GCM-SHA384

WeakAccepted

AES128-GCM-SHA256

WeakAccepted

DES-CBC3-SHA

InsecureNot offered

RC4-SHA

InsecureNot offered

NULL-SHA

InsecureNot offered

Certificate

Subjectvisa.com

IssuerCloudflare TLS Issuing ECC CA 3

Additional namesvisa.com

ValidSep 19, 2026, 3:03 AM – Apr 6, 2027, 3:03 AM (expires in 174 days)

KeyEC prime256v1

Signature algorithmunknown

SHA-256 fingerprint08:24:FB:E3:3A:25:22:54:82:9D:72:AD:BF:53:78:80:EC:06:C5:0D:19:C1:3B:3B:A3:DD:01:B4:D5:0D:38:A0

Certificate chain4 certificate(s)

Trusted by common trust storesYes

Matches the scanned hostnameYes

Self-signedNo

Security Headers

The HTTP response headers browsers use to restrict what a page - or an attacker inside it - can do.

Score75%

no Permissions-Policy header
no Cross-Origin-Opener-Policy header
no Cross-Origin-Resource-Policy header
the Server header discloses "cloudflare"

Content-Security-Policydefault-src 'self' *.google.com policy.cookiereports.com cdn.visa.com usa.visa.com *.googletagmanager.com *.googleapis.com *.doubleclick.net *.google-analytics.com *.googlesyndication.com googleads.g.doubleclick.net *.3gl.net *.gstatic.com collect.tealiumiq.com 'unsafe-inline';img-src * data:;

Strict-Transport-Securitymax-age=31536000; includeSubDomains

X-Content-Type-Optionsnosniff

X-Frame-OptionsSAMEORIGIN

Referrer-Policystrict-origin-when-cross-origin

Permissions-Policynot set

Cross-Origin-Opener-Policynot set

Cross-Origin-Resource-Policynot set

Cookies__cflb (Secure, HttpOnly); _cfuvid (Secure, HttpOnly)

A+

Email

Whether mail delivered to this domain is protected in transit, and whether SPF/DMARC stop it being spoofed.

Score100%

SPFv=spf1 ip4:198.241.162.0/24 ip4:198.241.168.0/24 ip4:198.241.159.0/24 ip4:72.46.234.0/24 ip4:66.185.181.0/24 ip4:198.241.174.0/24 ip4:74.116.91.0/24 ip4:198.80.42.3 ip4:69.20.125.232 ip4:198.241.175.106 ip4:216.251.253.98 ip4:67.208.216.61 ip4:198.247.174.175 ip4:67.220.120.24 ip4:66.185.186.2 ip4:198.241.171.12 ip4:204.75.142.27 ip4:66.165.175.189 ip4:67.192.139.34 ip4:67.192.157.83 ip4:174.143.100.191 ip4:198.241.158.43 ip4:198.241.207.0/24 ip4:198.241.206.0/24 exists:%{i}.spf.hc3429-92.iphmx.com exists:%{i}.spf.hc5864-50.iphmx.com ~all

DMARCv=DMARC1; p=quarantine; sp=quarantine; fo=1; rua=mailto:[email protected]; ruf=mailto:[email protected]; rf=afrf;

MX records4 found: portal1i.visa.com, portal3i.visa.com, portal2i.visa.com, portal4i.visa.com

Mail servers

Each mail port is probed with a full TLS handshake - STARTTLS on 25, 587, 143 and 110, implicit TLS on 465, 993 and 995 - to read the certificate actually bound to it. Only inbound SMTP on port 25 affects the grade.

portal1i.visa.comMX preference 10

25 SMTPTLSv1.2, ECDHE-RSA-AES256-GCM-SHA384

587 Submissionno response - the port is filtered, or blocked between our scanner and the host

465 SMTPSno response - the port is filtered, or blocked between our scanner and the host

143 IMAPno response - the port is filtered, or blocked between our scanner and the host

993 IMAPSno response - the port is filtered, or blocked between our scanner and the host

110 POP3no response - the port is filtered, or blocked between our scanner and the host

995 POP3Sno response - the port is filtered, or blocked between our scanner and the host

Certificate on port 25

Subjectportali.visa.com

IssuerSSL.com RSA SSL subCA

Additional namesportali.visa.com, portal1i.visa.com, portal2i.visa.com, portal3i.visa.com, portal4i.visa.com, portalmgr.trusted.visa.com, portalmgr.visa.com, quarantine.trusted.visa.com, spamquarantine.trusted.visa.com

ValidFeb 10, 2026, 9:13 PM – Feb 10, 2027, 9:13 PM (expires in 120 days)

KeyRSA 2048 bit

Signature algorithmunknown

SHA-256 fingerprint2E:BF:7A:BA:BE:0B:EC:87:8F:C3:AA:85:A7:70:3E:82:37:24:CF:AE:DF:89:BB:AA:F7:DC:37:AE:EE:07:6C:24

Certificate chain3 certificate(s)

Trusted by common trust storesYes

Matches the scanned hostnameYes

Self-signedNo

portal3i.visa.comMX preference 10

25 SMTPTLSv1.2, ECDHE-RSA-AES256-GCM-SHA384

587 Submissionconnection refused - nothing is listening on this port

465 SMTPSconnection refused - nothing is listening on this port

143 IMAPno response - the port is filtered, or blocked between our scanner and the host

993 IMAPSno response - the port is filtered, or blocked between our scanner and the host

110 POP3no response - the port is filtered, or blocked between our scanner and the host

995 POP3Sno response - the port is filtered, or blocked between our scanner and the host

Certificate on port 25

Subjectportali.visa.com

IssuerSSL.com RSA SSL subCA

ValidFeb 10, 2026, 9:13 PM – Feb 10, 2027, 9:13 PM (expires in 120 days)

KeyRSA 2048 bit

Signature algorithmunknown

SHA-256 fingerprint2E:BF:7A:BA:BE:0B:EC:87:8F:C3:AA:85:A7:70:3E:82:37:24:CF:AE:DF:89:BB:AA:F7:DC:37:AE:EE:07:6C:24

Certificate chain3 certificate(s)

Trusted by common trust storesYes

Matches the scanned hostnameYes

Self-signedNo

portal2i.visa.comMX preference 10

25 SMTPTLSv1.2, ECDHE-RSA-AES256-GCM-SHA384

587 Submissionconnection refused - nothing is listening on this port

465 SMTPSconnection refused - nothing is listening on this port

143 IMAPno response - the port is filtered, or blocked between our scanner and the host

993 IMAPSno response - the port is filtered, or blocked between our scanner and the host

110 POP3no response - the port is filtered, or blocked between our scanner and the host

995 POP3Sno response - the port is filtered, or blocked between our scanner and the host

Certificate on port 25

Subjectportali.visa.com

IssuerSSL.com RSA SSL subCA

ValidFeb 10, 2026, 9:13 PM – Feb 10, 2027, 9:13 PM (expires in 120 days)

KeyRSA 2048 bit

Signature algorithmunknown

SHA-256 fingerprint2E:BF:7A:BA:BE:0B:EC:87:8F:C3:AA:85:A7:70:3E:82:37:24:CF:AE:DF:89:BB:AA:F7:DC:37:AE:EE:07:6C:24

Certificate chain3 certificate(s)

Trusted by common trust storesYes

Matches the scanned hostnameYes

Self-signedNo

Also published as MX, not probed: portal4i.visa.com