Is mom.gov.sg safe to use as a vendor?

mom.gov.sg scored 95/100 on LynxRadar's security posture assessment. The domain meets baseline security requirements. 9 checks passed, 1 warnings, 0 critical issues across 10 passive checks including TLS, DMARC, security headers, breaches, and CVEs.

What TLS version does mom.gov.sg use?

mom.gov.sg uses TLSv1.3 with TLS_AES_128_GCM_SHA256. TLSv1.3 negotiated with TLS_AES_128_GCM_SHA256 (128-bit). Strong configuration with no deprecated protocols or weak ciphers detected.

Does mom.gov.sg have DMARC configured?

Yes. mom.gov.sg's DMARC policy is set to 'reject'. SPF record: yes. Strengths: DMARC policy set to reject (strongest); DMARC pct=100 — policy applies to all mail; Aggregate reports (rua) configured; Forensic reports (ruf) configured; SPF hard-fail (-all) configured; SPF DNS lookup count: 5/10 (within limit); DKIM configured (selectors: mailo, mandrill).

Does mom.gov.sg have SPF configured?

Yes. SPF record found: v=spf1 ip4:23.251.229.168 ip4:69.169.234.79 ip4:129.33.138.198 include:support.g...

Does mom.gov.sg have security headers configured?

mom.gov.sg has 3 of 5 recommended security headers. Present: CSP, X-Content-Type-Options, X-Frame-Options. Missing: Referrer-Policy, Permissions-Policy.

Does mom.gov.sg use HSTS?

Yes. HSTS enabled: max-age=31536000. includeSubDomains present. Missing preload directive.

Has mom.gov.sg been involved in a data breach?

No known breaches found. No known breaches found in public disclosure databases.

Does mom.gov.sg have known CVE vulnerabilities?

Detected technologies: Proxy/CDN. (Proxy/CDN detected but excluded from CVE matching — upstream infrastructure). All detected technologies are upstream CDN/proxy infrastructure. No application-level software versions exposed.

Is mom.gov.sg's SSL certificate valid?

Yes. Strengths: Certificate valid, 38 days remaining; Issued by SSL Corporation.

Does mom.gov.sg have DNSSEC enabled?

Yes. Strengths: 12 nameservers configured (ns9.gdnsec.com., ns12.gdnsdef.com., a2-65.akam.net., a1-6.akam.net.); 4 MX records present; DNSSEC enabled; Zone transfers properly restricted.

Missing: Referrer-Policy, Permissions-Policy

mom.gov.sg Security Report — Grade A (95/100)

Trust rating

Excellent · 95/100

Procurement snapshot

No critical findings. The 1 remaining item is a configuration gap, not an architectural problem.

Strengths

DNS Configuration

DMARC / Email Security

MX Records & Mail Provider

Known Breaches

Estimated remediation effort: under an hour

Based on a passive external scan — supplement with vendor-provided attestations, not a replacement.

Trust Score Trend

→ No change 1 scan · Last scanned February 15, 2026

Your rating Industry average

Score

100 75 50 25 0

mom.gov.sg

95/100

Compliance & Certifications

Not yet verified

FedRAMP

ATO not on file

3rd party · 3PAO

NIST 800-53

Not on file

Federal control baseline

Incident History

No public breaches on record

Security Posture

1 item needs attention

9 passed

Add 2 optional security headers

Security Headers

< 1 hour Low

This is a minor hardening gap, not a significant risk on its own. mom.gov.sg already has most of the recommended security headers — nice work. The remaining 2 are a smaller, best-practice improvement rather than an urgent gap.

How to fix this

1Add these headers exactly as shown. You're using Amazon CloudFront in front of this site — add it there, see https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/creating-response-headers-policies.html.

Referrer-Policy: strict-origin-when-cross-origin

Permissions-Policy: camera=(), microphone=(), geolocation=()

2Confirm it worked: search "http header checker" and enter mom.gov.sg — the headers above should appear in the response.

Security headers guide

View all 9 passed checks

DNS Configuration

DMARC / Email Security

MX Records & Mail Provider

Known Breaches

TLS Configuration

HSTS Header

CVE Exposure

Certificate Hygiene

Subprocessors & Tech Stack

Company Signals

Operational risk

Last funding

Employees

Trust Resources

Claim profile →

Trust Center

Not detected

DPA (Data Processing Agreement)

Subprocessors List

Tech Stack Detected

Subprocessors

Amazon CloudFront

Bot & abuse protection

Imperva / Incapsula

Similar companies in Government / Public Sector

Appears in

Government / Public Sector vendors

60 companies scanned by LynxRadar

Vendors graded A

377 companies · LynxRadar ranking

Top 10% by security score

287 companies · LynxRadar ranking