ncra.org

HTML metadata

Title: NCRA Conference & Expo | NCRA
Description: NCRA is internationally recognized as the premier educational and informational resource for its members and the public. Through its actively involved membership, the association impacts legislative issues and the global marketplace.
Language: en
Generator: Sitefinity 15.4.8630.0 DX
Canonical: https://www.ncra.org

Technology

Server: Microsoft-IIS
CMS: Gatsby 15.4.8630.0
ASP.NET: 4.0.30319

Analytics

Google Tag Manager

Ads

Google AdSense

Third-party hosts loaded (8)

g.adspeed.net×3
cdn.jotfor.ms×2
kit.fontawesome.com×1
pagead2.googlesyndication.com×1
s7.addthis.com×1
www.facebook.com×1
www.googletagmanager.com×1
www.termsfeed.com×1

Social

Contact

Phone

20191800-272-627

Registration

Registrar

Network Solutions, LLC

Created

1996-05-11

Expires

2027-05-12 342 days left

Updated

2024-03-18

Name servers

ns-1127.awsdns-12.org
ns-1542.awsdns-00.co.uk
ns-253.awsdns-31.com
ns-717.awsdns-25.net

DNS records live

NS

ns-1127.awsdns-12.org
ns-1542.awsdns-00.co.uk
ns-253.awsdns-31.com
ns-717.awsdns-25.net

MX

0 ncra-org.mail.protection.outlook.com

Email authentication partial

SPF: v=spf1 include:_spf.votervoice.net include:spf.protection.outlook.com include:_spf-us.ppe-hosted.com include:_spf.pcbscloud.com exists:%{i}.spf.hc5662-46.iphmx.com ~all
softfail (~all)
DMARC: v=DMARC1; p=none;
policy: none (monitoring only)
DKIM: no key found at common selectors

Certificate (current)

Amazon RSA 2048 M01

from 2025-11-22 to 2026-12-21

Expires in 200 days

Full certificate history on crt.sh ↗

HTTP security headers

Header hygiene 75/100 Checked live page: https://www.ncra.org/

present

strict-transport-security
content-security-policy
x-frame-options
x-content-type-options
referrer-policy

findings

CSP allows unsafe inline scripts/styles
CSP uses wildcard sources
weak frame protection
weak content type protection
missing Permissions Policy

Header values

referrer-policy: no-referrer-when-downgrade
x-frame-options: SAMEORIGIN, SAMEORIGIN
x-content-type-options: nosniff, nosniff
content-security-policy: default-src 'self'; script-src 'self' *.googleapis.com *.gstatic.com www.google.com apis.google.com *.google-analytics.com connect.facebook.net ajax.aspnetcdn.com https://www.youtube.com platform.twitter.com https://syndication.twitter.com/ https://s.ytimg.com https://publish.twitter.com *.twimg.com platform.linkedin.com http://platform.stumbleupon.com/1/widgets.js cdnjs.cloudflare.com 'unsafe-inline' 'unsafe-eval' https://cdn.insight.sitefinity.com munchkin.marketo.net *.eloqua.com js.hs-scripts.com js.hs-analytics.net *.en25.com cdn.ampproject.org www.tickcounter.com adservice.google.com *.googleadservices.com *.googletagservices.com *.googletagmanager.com *.googlesyndication.com g.adspeed.net syndication.twitter.com *.addthis.com *.addthisedge.com *.moatads.com *.jsdelivr.net https://acsbapp.com *.vimeo.com https://go.constantcontact.com https://www.ncra.org/tryconstantcontact-ncra https://ncra-shop.myspreadshop.com https://shop.spreadshirt.com https://shop.myspreadshop.com https://
strict-transport-security: max-age=31536000; includeSubDomains