Is fbi.gov safe to use as a vendor?

fbi.gov scored 82/100 on LynxRadar's security posture assessment. The domain meets baseline security requirements. 7 checks passed, 3 warnings, 0 critical issues across 10 passive checks including TLS, DMARC, security headers, breaches, and CVEs.

What TLS version does fbi.gov use?

fbi.gov uses TLSv1.3 with TLS_AES_256_GCM_SHA384. TLSv1.3 negotiated with TLS_AES_256_GCM_SHA384 (256-bit). Strong configuration with no deprecated protocols or weak ciphers detected.

Does fbi.gov have SPF configured?

Yes. SPF record: v=spf1 +mx ip4:153.31.0.0/16 -all

Does fbi.gov have security headers configured?

fbi.gov has 3 of 5 recommended security headers. Present: X-Content-Type-Options, X-Frame-Options, Referrer-Policy. Missing: CSP, Permissions-Policy.

Does fbi.gov use HSTS?

Yes. HSTS enabled: max-age=31536000 with includeSubDomains and preload. Meets best-practice configuration.

Has fbi.gov been involved in a data breach?

No known breaches found. No known breaches found in public disclosure databases.

Does fbi.gov have known CVE vulnerabilities?

Detected technologies: cloudflare. (cloudflare detected but excluded from CVE matching — upstream infrastructure). All detected technologies are upstream CDN/proxy infrastructure. No application-level software versions exposed.

Does fbi.gov have DNSSEC enabled?

Yes. Strengths: 4 nameservers configured (ns-cloud-e3.googledomains.com., ns-cloud-e2.googledomains.com., ns-cloud-e4.googledomains.com., ns-cloud-e1.googledomains.com.); 2 MX records present; DNSSEC enabled; Zone transfers properly restricted.

fbi.gov Security Report — Grade B- (82/100)

Q: Does fbi.gov have DMARC configured?

Yes. fbi.gov's DMARC policy is set to 'reject'. SPF record: yes. Strengths: DMARC policy set to reject (strongest); SPF record present with hard-fail (-all). Issues: No DKIM records found for common selectors (may use non-standard selectors).

Q: Is fbi.gov's SSL certificate valid?

Issues detected. Strengths: Certificate valid, 32 days remaining; Issued by Google Trust Services. Issues: Wildcard certificate in use — broader attack surface if compromised.

B-

Pass · 82/100

Shows meaningful security gaps that need attention. Positive signals: TLS Configuration, Known Breaches, and HSTS Header all passed. 3 action items identified, including 0 critical. The issues are configuration gaps, not architectural problems. A focused remediation effort of 1–2 days could address all findings.

Trust Score Trend

→ No change 1 scan · Last scanned February 15, 2026

Your rating Industry average

Score

100 75 50 25 0

B-

fbi.gov

82/100

Compliance & Certifications

Not yet verified

FedRAMP

ATO not on file

3rd party · 3PAO

Pro subscribers only

NIST 800-53

Not on file

Federal control baseline

Pro subscribers only

Incident History

None in 12 months

March 2026

ChatGPT data exposure

1 source

Resolved

Pro subscribers only

April 2023 – Feb 2026

ChatGPT data exposure

1 source

Resolved

Pro subscribers only

Security Posture

3 items need attention

7 passed

Finish setting up email authentication

DMARC / Email Security

2–4 hours

Spoofed emails can still reach your customers and partners until this is fully enforced. Email authentication for fbi.gov is partly set up, but there are gaps: DKIM isn't set up. Until it's fully in place, someone could still send a convincing fake email pretending to be you.

NIST CSFPR.AC-7

Email authentication is a required access control

How to fix this

1Turn on DKIM signing — look for "DKIM" under your email provider's admin/security settings. It will generate a record for you to paste into the same DNS settings above.

2Double-check it's live: search "dmarc record checker" and enter fbi.gov.

Email authentication guide

Report unlocked.

View all 7 passed checks

TLS Configuration

Known Breaches

HSTS Header

MX Records & Mail Provider

DNS Configuration

CVE Exposure

Subprocessors & Tech Stack

Company Signals

Claim profile →

Operational risk

Low

11 yrs operating. Well-funded

Lynxradar · Composite signal

Last funding

$40B

Series F · Mar 2025 · SoftBank-led

Crunchbase ↗

Employees

~3,000

+40% YoY growth

LinkedIn ↗

Trust Resources

Claim profile →

Trust Center

trust.fbi.gov ↗

Security page

fbi.gov/security ↗

fbi.gov/privacy ↗

DPA (Data Processing Agreement)

fbi.gov/dpa ↗

Updated recently

Subprocessors List

fbi.gov/policies/subprocessors ↗

Tech Stack Detected

Subprocessors

Cloudflare

Similar companies in Government / Public Sector

Appears in

Claim profile →

SOC 2 Type II certified vendors

847 companies · Updated weekly by LynxRadar

Track

ISO 27001 certified SaaS

312 companies · Updated weekly by LynxRadar

Track

Top AI vendors by trust score

94 companies · LynxRadar ranking

Track

Enterprise-ready SaaS · Trust score A or above

203 companies · LynxRadar ranking

Track

Medium Priority

p=reject

Strengths: DMARC policy set to reject (strongest); SPF record present with hard-fail (-all). Issues: No DKIM records found for common selectors (may use non-standard selectors).

Likelihood: ★★★☆☆

Impact: ★★★☆☆

Best Practice

3/5 present

Missing: CSP, Permissions-Policy

Likelihood: ★★☆☆☆

Impact: ★☆☆☆☆

Issues

Strengths: Certificate valid, 32 days remaining; Issued by Google Trust Services. Issues: Wildcard certificate in use — broader attack surface if compromised.

Likelihood: ★★☆☆☆

Impact: ★★☆☆☆