rcu.org

HTML metadata

Title: Royal Credit Union | Wisconsin & Minnesota
Description: Minnesota and Wisconsin Credit Union | Financial Services Provider
Language: en
Canonical: https://www.rcu.org

Open Graph

url: https://www.rcu.org
title: Royal Credit Union | Wisconsin & Minnesota
site name: Royal Credit Union
description: Minnesota and Wisconsin Credit Union | Financial Services Provider

Technology

Server: Microsoft-IIS

Analytics

Google Tag Manager

Social widgets

YouTube Embed

Third-party hosts loaded (5)

rcu-search.funnelback.squiz.cloud×3
cdn.timetrade.com×1
maps.googleapis.com×1
www.googletagmanager.com×1
www.youtube.com×1

Social

Contact

Phone

18003419911

Registration

Registrar

Network Solutions, LLC

Created

1996-04-24

Expires

2031-04-25 1802 days left

Updated

2026-03-01

Name servers

ns3-35.azure-dns.org
ns1-35.azure-dns.com
ns2-35.azure-dns.net
ns4-35.azure-dns.info

DNS records live

NS

ns1-35.azure-dns.com
ns2-35.azure-dns.net
ns3-35.azure-dns.org
ns4-35.azure-dns.info

MX

10 mxa-0020e901.gslb.pphosted.com
10 mxb-0020e901.gslb.pphosted.com

TXT

Show 7 TXT records

finicity_partner_id:2445583346668
apple-domain-verification=jC0mo5kBeWGdidHK
_172xyi2605f18kvwcy9np95vm8ynq6m
_4jo6yg3jesxw1uxhwe9ktrr9dwl619s
have-i-been-pwned-verification=3659e8af7a0bb46950bfb25f9bbb3f88
MS=05F81D08BD89A4AB128D5A8179A17E3A70C22B98
tPWpIKwAsBSDbPggoQVBE+Kck9AOQT5Hn9ZC8U83YkVSFtKX8JOKl9lHhvYxpRsGAe16eNuSD8oanEd5noxQEg==

Email authentication strong

SPF

v=spf1 include:%{ir}.%{v}.%{d}.spf.has.pphosted.com ~all

softfail (~all)

DMARC

v=DMARC1; p=reject; fo=1; rua=mailto:dmarc_rua@emaildefense.proofpoint.com; ruf=mailto:dmarc_ruf@emaildefense.proofpoint.com,mailto:royalcu-dmarc@datafeeds.phishlabs.com

policy: reject (enforced)

DKIM

selector1: v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDKo3G81nuakiobPx9E4eIXOPxBtxHkCySCVblvj1y/AiVpquJ3UFDKAHNrOkbe33IV2wgjEeUlxF1p5yQ1Bi…
s1: k=rsa; t=s; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAotAe4x4qWq4LhHlW0bCEhg0VPaGFjShsDCA6t/18aS8jv8ihihpK9iyTQqKv6ICj1Pdt8zB+xZeKIo46yW…
s2: k=rsa; t=s; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDNjTys7kMt2oDTjdCX+tHb4KdZ+pAANQt+vxEpEDFCPcrix7CTzGfLx/PlN8DJdgMG4RbGdFN5eQgaaEZsfDEQwp…

selectors probed

Certificate (current)

Thawte EV RSA CA G2

from 2026-03-30 to 2026-10-15

Expires in 149 days

Full certificate history on crt.sh ↗

HTTP security headers

Header hygiene 90/100 Checked live page: https://www.rcu.org/

present

strict-transport-security
content-security-policy
x-frame-options
x-content-type-options
referrer-policy
permissions-policy
cross-origin-opener-policy
cross-origin-embedder-policy
cross-origin-resource-policy

findings

CSP allows unsafe inline scripts/styles
CSP uses wildcard sources

Header values

referrer-policy: no-referrer-when-downgrade
x-frame-options: SAMEORIGIN
permissions-policy: camera=(), microphone=(), payment=()
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests; default-src 'self'; script-src 'self' 'unsafe-inline' https://webp.royalcu.workers.dev https://webpush.royalcu.workers.dev https://rcu.groovecar.com/ https://www.googleoptimize.com/ https://www.timevaluecalculators.com https://www.youtube.com/ https://www.gstatic.com/ https://www.google.com/ https://rculocator.wave2.io/ https://*.adroll.com/ https://js.adsrvr.org/ https://*.simpli.fi/ https://connect.facebook.net/ https://googleads.g.doubleclick.net/ https://detectca.easysol.net/ https://ai.rcu.org/ https://www.google-analytics.com/ https://www.googletagmanager.com/ https://514001781.collect.igodigital.com/ https://cdn.timetrade.com/ https://connect.facebook.com/ https://maps.googleapis.com/ https://script.hotjar.com/ https://static.hotjar.com/ https://snap.licdn.com/ https://highmonkey-search.clients.us.funnelback.com/ https://rcu-search.funnelback.squiz.cloud https://bat.bing.com https://www.google.com/ccm/collect https://rcu.enrich.org/ 'unsafe-eval' ; st
strict-transport-security: max-age=63072000; includeSubDomains; preload
cross-origin-opener-policy: unsafe-none
cross-origin-embedder-policy: unsafe-none
cross-origin-resource-policy: cross-origin