jeraonair.nl

HTML metadata

Title

Jera On Air - Punk, hardcore & metalcore festival - Jera On Air 2026 - June 25-26-27

Description

Holland's finest Punk, Hardcore & Metalcore festival in Ysselsteyn

Language

en

Canonical

https://www.jeraonair.nl/en/home/

Translations

de
en
nl

Open Graph

url: https://www.jeraonair.nl/en/home/
title: Jera On Air - Punk, hardcore & metalcore festival
locale: en_GB
site name: Jera On Air 2026 - June 25-26-27
description: Holland's finest Punk, Hardcore & Metalcore festival in Ysselsteyn
locale:alternate: de_DE

Technology

Server: nginx

Third-party hosts loaded (2)

i.ytimg.com×343
cdn.lightwidget.com×2

Social

DNS records live

NS

ns1.cybox.nl
ns2.cybox.eu

MX

1 aspmx.l.google.com
10 alt3.aspmx.l.google.com
5 alt1.aspmx.l.google.com
5 alt2.aspmx.l.google.com

Verified for

Google

Email authentication partial

SPF

v=spf1 a include:_spf.google.com include:spf.antispamcloud.com include:servers.mcsv.net ?all

neutral (?all)

DMARC

v=DMARC1; p=none;

policy: none (monitoring only)

DKIM

google: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAv0sfp3dV4sHn0tm91qvyH0WZPqxiBtnyqWy4WNI4EyisGvxK60oU+oIP0I24z5en4fpwWOX+MUOt6S…
k1: k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDbNrX2cY/GUKIFx2G/1I00ftdAj713WP9AQ1xir85i89sA2guU0ta4UX1Xzm06XIU6iBP41VwmPwBGRNofhBVR+e6WHUo…

selectors probed

Certificate (current)

R12

from 2026-05-05 to 2026-08-03

Expires in 61 days

Full certificate history on crt.sh ↗

HTTP security headers

Header hygiene 75/100 Checked live page: https://www.jeraonair.nl/

present

strict-transport-security
content-security-policy
x-content-type-options
referrer-policy

findings

CSP allows unsafe inline scripts/styles
CSP uses wildcard sources
missing frame protection
missing Permissions Policy

Header values

referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
content-security-policy: default-src 'self'; style-src 'self' 'unsafe-inline' fonts.googleapis.com; script-src 'nonce-6c9bbac3162fe82a8fe6de9dd24135f8' 'strict-dynamic' 'self' https: 'unsafe-inline'; img-src 'self' data: i.ytimg.com i.vimeocdn.com www.googletagmanager.com https://*.google-analytics.com https://*.googletagmanager.com https://*.googleapis.com https://*.gstatic.com *.google.com *.googleusercontent.com analytics.twitter.com t.co alb.reddit.com *.snapchat.com imgsct.cookiebot.com *.googlesyndication.com *.google.nl *.facebook.com; frame-src 'self' www.youtube.com player.vimeo.com www.googletagmanager.com *.google.com *.snapchat.com consentcdn.cookiebot.com *.lightwidget.com https://www.facebook.com/; connect-src 'self' www.googletagmanager.com www.google.com https://*.analytics.google.com https://*.googletagmanager.com https://*.google-analytics.com https://*.googleapis.com *.google.com https://*.gstatic.com data: blob: pixel-config.reddit.com pixels.spotify.com *.cookiebot.com *.snapchat.com *.goo
strict-transport-security: max-age=63072000; includeSubDomains