ZeroBounce presents a solid security posture for a SaaS company handling sensitive email data. The organization benefits from Cloudflare's CDN and WAF, which obscures origin infrastructure and provides DDoS mitigation. Email security is exemplary — SPF uses a hard fail (-all), DMARC is set to p=reject at 100% enforcement, and the certificate uses an Extended Validation (EV) cert via GlobalSign for the main .net domain.
Key strengths: HSTS preload, TLS 1.3 support, TLS 1.1 disabled, strong DMARC/SPF, EV certificate, Okta SSO authentication, hCaptcha bot protection, and a Report-URI integration for CSP violation monitoring.
Areas for improvement: The CSP contains 'unsafe-inline' and 'unsafe-eval' which reduce XSS protections significantly. No security.txt is published. TLS 1.2 is still supported (acceptable but not ideal). The X-Frame-Options header is absent (though frame-ancestors in CSP covers this). The site version meta tag exposes a v0.0.1 version indicator in production HTML.
No critical vulnerabilities were identified through passive analysis. The company demonstrates awareness of modern security practices with CSP enforcement reporting to report-uri.com, cookie SameSite controls, and network segmentation through custom Okta and API domains.
| Record | Value | Status |
|---|---|---|
| A (zerobounce.com) | 104.18.3.114, 104.18.2.114 | Cloudflare Anycast |
| AAAA | 2606:4700::6812:372, 2606:4700::6812:272 | IPv6 Enabled |
| NS | todd.ns.cloudflare.com, dora.ns.cloudflare.com | Cloudflare |
| MX | aspmx.l.google.com (pri 1), alt1–alt4 | Google Workspace |
| Hosting/CDN | Cloudflare (IPs in AS13335) | Origin Hidden |
| Registrar | Cloudflare, Inc. | ICANN Lock |
| Redirect | zerobounce.com → https://www.zerobounce.net | 301 HTTPS Redirect |
clientTransferProhibited lock prevents unauthorized domain transfer.TXT Records of Interest:
| Property | Value | Assessment |
|---|---|---|
| Certificate Type | Extended Validation (EV) | ✓ Highest Trust Level |
| Issuer (zerobounce.net) | GlobalSign Extended Validation CA — SHA256 G3 | ✓ Trusted CA |
| Issuer (zerobounce.com) | Google Trust Services — WE1 | ✓ Cloudflare-managed |
| Subject (EV cert) | ZEROBOUNCE (HERTZA L.L.C.) — Santa Barbara, CA, US/NV | Organization Verified |
| Valid From | 2025-06-13 | |
| Valid Until | 2026-06-13 (~2.5 months remaining as of report date) | ⚠ Monitor Renewal |
| TLS 1.3 | ✓ Supported — CHACHA20-POLY1305-SHA256 | ✓ Modern |
| TLS 1.2 | ✓ Supported — ECDHE-RSA-AES128-GCM-SHA256 | Acceptable |
| TLS 1.1 | ✗ Rejected — alert: protocol version | ✓ Disabled |
| TLS 1.0 | ✗ Rejected (Cloudflare default) | ✓ Disabled |
| SANs (.net cert) | zerobounce.net, api.zerobounce.net, api-us.zerobounce.net, api-eu.zerobounce.net, www.zerobounce.net, relay.zerobounce.net | Multi-region API |
api-us.zerobounce.net and api-eu.zerobounce.net confirm multi-region API endpoints — suggesting GDPR-compliant EU data residency option.| Header | Value / Status | Assessment |
|---|---|---|
| Strict-Transport-Security | max-age=31536000; includeSubDomains; preload | ✓ Excellent |
| Content-Security-Policy | Present — complex multi-directive policy | ⚠ Has unsafe-inline/eval |
| X-Content-Type-Options | nosniff | ✓ Present |
| X-XSS-Protection | 1; mode=block; report=https://zero.report-uri.com/... | ✓ Present + Reported |
| Referrer-Policy | strict-origin-when-cross-origin | ✓ Appropriate |
| Permissions-Policy | sync-xhr=(self), identity-credentials-get=(self, accounts.google.com) | Limited scope |
| X-Frame-Options | Not present (frame-ancestors in CSP covers this) | Advisory |
| Report-To | https://zero.report-uri.com/a/t/g | ✓ CSP Monitoring Active |
| NEL (Network Error Logging) | max_age=31536000, includeSubdomains | Network monitoring |
| Server | cloudflare | ✓ Origin Hidden |
| Alt-Svc | h3=":443" | HTTP/3 Supported |
| Speculation-Rules | /cdn-cgi/speculation | Cloudflare prefetch |
| security.txt | Not found | Missing |
'unsafe-inline' and 'unsafe-eval' in both script-src and script-src-elem. While this is common in Next.js applications using GTM/HubSpot/AB Tasty, it materially reduces XSS protection. An attacker who can inject content into any of the whitelisted domains could potentially execute arbitrary JavaScript.security.txt published at /.well-known/security.txt. This makes it harder for security researchers to responsibly disclose vulnerabilities. Recommended: publish a security.txt per RFC 9116 with contact info and PGP key.includeSubDomains and max-age=31536000 (1 year) means browsers will refuse HTTP connections entirely once the policy is cached. Combined with Cloudflare's always-HTTPS, this is excellent protection against protocol downgrade attacks.Cookie Analysis (NEXT_LOCALE observed):
| Cookie | Secure | HttpOnly | SameSite | Assessment |
|---|---|---|---|---|
| NEXT_LOCALE | Not explicit (served over HTTPS) | No | Lax | Low-risk locale cookie, no sensitive data |
| Mechanism | Record | Assessment |
|---|---|---|
| SPF | v=spf1 ip4:185.25.156.0/24 include:spf.mandrillapp.com include:mail.zendesk.com include:mailoktalive.zerobounce.com include:mailokta.zerobounce.com include:_spf.google.com -all |
✓ Hard Fail (-all) |
| DMARC | v=DMARC1; p=reject; sp=reject; pct=100; ri=86400; fo=d; rua=mailto:dmarc_aggregate_analyser+...@zerobounce.net!5k; ruf=mailto:dmarc_forensics_analyser+...@zerobounce.net!5k |
✓ Reject Policy, 100% |
| MX | Google Workspace (aspmx.l.google.com, alt1–alt4) | Google Workspace |
| Mail Providers (SPF) | Mandrill (transactional), Zendesk (support), Okta (auth), Google (workspace) | 4 authorized senders |
p=reject with sp=reject (subdomains also protected), pct=100 (full enforcement), forensic reporting enabled, and aggregate reports active. SPF uses a hard fail (-all) which will reject unauthorized senders outright. This is best-in-class configuration — directly relevant given ZeroBounce is an email intelligence company.mailoktalive.zerobounce.com and mailokta.zerobounce.com — custom Okta mail domains. This suggests Okta is used for employee SSO/authentication and customer identity, with branded email flows.| Path | Status | Assessment |
|---|---|---|
| /.well-known/security.txt | 404 Not Found | Missing |
| /.env | 403 Forbidden | ✓ Blocked |
| /.git/HEAD | 403 Forbidden | ✓ Blocked |
| /wp-admin | 404 Not Found | ✓ Not WordPress |
| /api/docs | 404 Not Found | ✓ Not Exposed |
| /swagger | 404 Not Found | ✓ Not Exposed |
| /robots.txt | 200 OK | Present |
| /sitemap.xml | 200 OK | Present |
robots.txt contents:
/blog/wp-json/ in robots.txt disallow confirms the blog section runs WordPress (a separate CMS from the main Next.js app). While this path is blocked from crawlers, the blog's WordPress REST API may still be accessible. WordPress has a historically large vulnerability surface. Recommend confirming the blog is on an isolated subdomain/subdirectory and kept patched.Subdomains from Certificate Transparency (crt.sh — zerobounce.com):
teleport.zerobounce.com — suggests use of Teleport, an open-source privileged access management (PAM) tool for infrastructure access. This is a positive security indicator (zero-trust access to servers), but exposing the Teleport proxy publicly should be secured with MFA and kept up to date, as Teleport has had critical CVEs (e.g., CVE-2024-4072). Passive observation only — this subdomain's security cannot be assessed further without active testing.email-test.zerobounce.com and email-tester.zerobounce.com are likely development or staging environments for their core email validation product. These may be more permissive than production.| Layer | Technology | Evidence |
|---|---|---|
| Frontend Framework | Next.js (React SSR/App Router) | /_next/static/chunks/ path pattern, webpackChunk_N_E, app router chunk naming |
| CDN / Edge | Cloudflare | server: cloudflare header, CF-Ray header, AS13335 IPs, Cloudflare NS |
| Edge Workers | Cloudflare Workers | CSP references *.workers.dev (leaderint.workers.dev, web-vitals) |
| Authentication (Customer) | Okta | global.oktacdn.com in CSP, okta.zerobounce.net, SPF mailokta.zerobounce.com |
| CMS (Blog) | WordPress | /blog/wp-json/ in robots.txt |
| CRM / Marketing | HubSpot | js.hs-scripts.com, forms.hsforms.com in CSP and page source |
| Customer Support | Zendesk | static.zdassets.com, zerobounce.zendesk.com in CSP, SPF includes zendesk |
| A/B Testing | AB Tasty | try.abtasty.com, *.abtasty.com in CSP and dns-prefetch |
| Payment | Stripe | TXT record stripe-verification=... |
| Tag Manager | Custom GTM (self-hosted) | gtm.zerobounce.net — they run their own GTM endpoint |
| Analytics | Google Analytics / GA4 | www.google-analytics.com in CSP |
| Analytics | Microsoft Clarity + Bing UET | *.clarity.ms, bat.bing.com, UET tag ID 247003205 in JS chunk |
| Analytics | LinkedIn Insight | px.ads.linkedin.com, snap.licdn.com in CSP |
| Analytics | Mixpanel | api.mixpanel.com, *.mixpanel.com in CSP |
| Analytics | PromptWatch (AI monitoring) | ingest.promptwatch.com in CSP — suggests LLM/AI feature tracking |
| Bot Protection | hCaptcha | hcaptcha.com in CSP |
| Performance | Leaderint RUM | rum-collector.leaderint.workers.dev in CSP |
| Affiliate / Partnerships | Impact.com | frame-ancestors https://impact.com in CSP |
| Infrastructure Access | Teleport (PAM) | teleport.zerobounce.com subdomain in CT logs |
| Error Monitoring | Report-URI | zero.report-uri.com — dedicated CSP/XSS violation reporting endpoint |
| Project Management | Atlassian (Jira/Confluence) | TXT record atlassian-domain-verification |
| Java Publishing | Sonatype OSSRH | TXT record OSSRH-89917 — suggests public Java SDK on Maven Central |
| Meta tag | Site-Version: v0.0.1 | <meta name="Site-Version" content="v0.0.1"> |
<meta name="Site-Version" content="v0.0.1"> in production HTML is likely a placeholder or internal versioning artifact. While low-risk on its own, it's unnecessary information disclosure. Consider removing from production builds.gtm.zerobounce.net is a privacy-forward practice (server-side tagging) that gives them control over what data leaves to third parties. This is a positive security indicator.| Field | zerobounce.com | zerobounce.net |
|---|---|---|
| Registrar | Cloudflare, Inc. | Cloudflare, Inc. |
| Registrant | DATA REDACTED (privacy) | DATA REDACTED (privacy) |
| State/Country | FL, US (redacted) | FL, US (redacted) |
| Domain Status | clientTransferProhibited | clientTransferProhibited |
| Updated | 2024-12-05 / 2024-08-03 | 2024-04-22 |
| Expiry | 2028-11-03 | 2032-09-19 |
| NS (.net) | NS1–NS5.ZEROBOUNCE.NET (self-managed nameservers) | |
| Legal Entity (EV cert) | HERTZA L.L.C., Santa Barbara, CA (incorporated Nevada) | |
clientTransferProhibited lock prevents unauthorized transfers. Registrant details are privacy-protected.| Library | Evidence | Notes |
|---|---|---|
| Next.js (App Router) | webpackChunk_N_E, /_next/ paths, [locale] routing chunks, streaming SSR hydration ($RB, $RS functions) | Modern framework |
| React | Inline hydration scripts, useState/useEffect imports visible in chunk code | via Next.js |
| Webpack 5 | webpack-37800c0648a9d33b.js runtime | Bundler |
| Framer Motion | Chunk name: motion in webpack runtime map | Animation lib |
| Cookie Consent | Chunk name: cookie-consent | GDPR compliance |
| Carousel | Chunk name: carousel | UI component |
[locale] routing and streaming hydration) suggests a recent Next.js 13+ build.Domains loaded or referenced in CSP (analytics, tracking, infrastructure):
ingest.promptwatch.com suggests AI/LLM telemetry is being collected from user interactions.Several inline scripts are present in the HTML for React hydration (standard Next.js pattern):
Microsoft UET Tag ID exposed in JS bundle:
247003205) is visible in the JS bundle. This is a public advertising identifier (not a secret) but confirms ZeroBounce runs Bing Ads campaigns. It is loaded lazily after user interaction to optimize performance.<form> elements were found in the server-rendered homepage HTML. The email validation form is rendered client-side via React after hydration. The CSP form-action directive restricts form submissions to 'self' and https://forms.hsforms.com (HubSpot). This limits potential form hijacking.| Tag | Value |
|---|---|
| og:title | Email Validation Tools & Email List Cleaning | ZeroBounce |
| og:url | https://www.zerobounce.net/ |
| og:image | /zerobounce-generic-thumbnail.jpg |
| twitter:card | summary |
| twitter:creator | @zerobounce1 |
| robots | index, follow |
| application-name | ZeroBounce |
| Site-Version | v0.0.1 ← advisory |
| msvalidate.01 | 3744203857E165A089608FE1AE933DFC (Bing Webmaster) |
| mobile-web-app-capable | yes |
| x-dns-prefetch-control | on |
<meta name="Site-Version" content="v0.0.1"> — This version indicator in production HTML is minor but unnecessary. If the value ever reflects a meaningful internal version, it could aid targeted reconnaissance. Recommend removing or replacing with a build hash.| File Checked | HTTP Status | Assessment |
|---|---|---|
/webpack-37800c0648a9d33b.js.map | 404 Not Found | ✓ Not Exposed |
/main-app-cdf62968b3429fbd.js.map | 404 Not Found | ✓ Not Exposed |
connect-src directive reveals the full internal API architecture: test-members-api.zerobounce.net is a staging/test endpoint accessible from production (it's in the production CSP). While this doesn't mean it's exploitable, staging environments often have looser security. Additionally, apiassistant.zerobounce.net suggests an AI assistant feature in development or production..xyz TLD alternatives (zerobounce.xyz, next-worker.zerobounce.xyz) appear to be development/testing domains used alongside production. The use of raw.githubusercontent.com/zerobounce/ in connect-src suggests they pull configuration or assets directly from their GitHub organization.<!--$-->, <!--/$-->) are React internals, not developer comments.Referenced in page source via JSON-LD (standard SEO markup):
/company/zerobounce-net.teleport.zerobounce.com was observed in certificate transparency logs. Teleport (used for privileged infrastructure access) has had critical vulnerabilities including CVE-2024-4072 (authentication bypass). Passive analysis cannot confirm the Teleport version in use — but this subdomain warrants monitoring and keeping Teleport up-to-date is critical./blog/wp-json/) is recommended.| Finding | Category | Severity |
|---|---|---|
| DMARC p=reject + SPF hard fail | Email Security | ✓ Excellent |
| HSTS preload + includeSubDomains | Transport Security | ✓ Excellent |
| TLS 1.1/1.0 disabled, TLS 1.3 primary | TLS | ✓ Strong |
| EV Certificate (GlobalSign) on main domain | PKI | ✓ Highest Trust |
| Origin IP hidden behind Cloudflare | Infrastructure | ✓ Good |
| Source maps not publicly accessible | Frontend | ✓ Good |
| No developer comments in production | Frontend | ✓ Good |
| Teleport PAM for infrastructure access | Access Control | ✓ Good Practice |
| CSP: unsafe-inline + unsafe-eval present | XSS Protection | ⚠ Advisory |
| No security.txt published | Disclosure | ⚠ Advisory |
| Site-Version: v0.0.1 in HTML meta | Info Disclosure | ⚠ Minor |
| WordPress blog component (wp-json exposed) | Attack Surface | ⚠ Monitor |
| Staging API in production CSP (test-members-api) | Architecture | ⚠ Advisory |
| 16 third-party script domains (supply chain) | Supply Chain | ⚠ Advisory |
| EV cert expires 2026-06-13 (~75 days) | Certificate | ⚠ Monitor |
| Teleport CVE exposure (version unknown) | Infrastructure | ⚠ Advisory |
| TXT records disclose full SaaS stack (Stripe, Atlassian...) | OSINT | ⚠ Informational |
| Historical S3 misconfiguration (2023 breach) | Historical | ⚠ Historical |
/.well-known/security.txt per RFC 9116 with a responsible disclosure contact address, PGP key, and scope statement. This is table stakes for a security company.'unsafe-inline'. This is the single biggest XSS surface reduction available. Consider migrating GTM to server-side-only to remove the inline script requirement.<meta name="Site-Version" content="v0.0.1"> provides no user value and should be removed from production HTML or replaced with a non-meaningful build identifier./blog/wp-json/ at the CDN layer if not required publicly.test-members-api.zerobounce.net appears in the production CSP connect-src. Staging endpoints should not be authorized from production. Verify if this is intentional (feature-flagged) and remove if not needed.teleport.zerobounce.com is running a patched version, is behind MFA, and that access logs are monitored. Consider restricting access via Cloudflare Access or IP allowlist.