scryfall.com

.com toplist crawl

First seen 2026-04-11 · Last seen 2026-05-18 · ok HTTP/1.1 200 459 ms crawled 2026-05-18

US · 172.67.73.77 · AS13335 Cloudflare, Inc.

Reputation 100/100

Classifying

HTML metadata

Title

Scryfall Magic: The Gathering Search

Description

A fast, powerful, comprehensive Magic: The Gathering card search.

Language

Feeds

ATOM Atom

Open Graph

url: https://scryfall.com/
title: Scryfall Magic: The Gathering Search
site name: Scryfall Magic: The Gathering Search
description: A fast, powerful, comprehensive Magic: The Gathering card search.

Technology

CDN: Cloudflare

Analytics

Cloudflare Insights
Google Tag Manager

Third-party hosts loaded (3)

cards.scryfall.io×9
static.cloudflareinsights.com×1
www.googletagmanager.com×1

Social

Registration

Registrar

Cloudflare, Inc.

Created

2016-10-03

Expires

2026-10-03 136 days left

Updated

2025-09-03

Name servers

ken.ns.cloudflare.com
mira.ns.cloudflare.com

DNS records live

NS

ken.ns.cloudflare.com
mira.ns.cloudflare.com

MX

10 in1-smtp.messagingengine.com
20 in2-smtp.messagingengine.com

TXT

apple-domain-verification=-EhUP9EEavEDBJx1h3lrSVvO5bpGk5fsO66Muq-QYCU
google-site-verification=GEG4Kmzvu2RnomWRd3BHhqXxm8CnIbnmdtSUtqXCPEo

Email authentication strong

SPF: v=spf1 include:spf.mtasv.net include:spf.messagingengine.com ~all
softfail (~all)
DMARC: v=DMARC1; p=reject; pct=100; aspf=r; rua=mailto:8bd779336f8f4bddaa2e806c4b97015e@dmarc-reports.cloudflare.net,mailto:re+h2vit6voz71@dmarc.postmarkapp.com,mailto:re+e8924d57fa6e@inbound.dmarcdigests.com
policy: reject (enforced)
DKIM: no key found at common selectors

Certificate (current)

WE1

from 2026-05-06 to 2026-08-05

Expires in 77 days

Full certificate history on crt.sh ↗

HTTP security headers

Header hygiene 90/100 Checked live page: https://scryfall.com/

present

strict-transport-security
content-security-policy
x-frame-options
x-content-type-options
referrer-policy

findings

CSP uses wildcard sources
missing Permissions Policy

Header values

referrer-policy: strict-origin-when-cross-origin
x-frame-options: DENY
x-content-type-options: nosniff
content-security-policy: default-src 'none'; base-uri 'none'; frame-src checkout.stripe.com *.google.com; frame-ancestors 'none'; style-src *.scryfall.com scryfall.com; script-src *.scryfall.com scryfall.com *.analytics.google.com *.google-analytics.com *.googletagmanager.com *.google.com *.gstatic.com *.cloudflareinsights.com checkout.stripe.com 'unsafe-eval'; img-src *.scryfall.io *.scryfall.com scryfall.com *.analytics.google.com *.google-analytics.com *.googletagmanager.com *.stripe.com data:; font-src *.scryfall.com scryfall.com; media-src *.scryfall.com scryfall.com; manifest-src *.scryfall.com scryfall.com; connect-src api.scryfall.com scryfall.com *.analytics.google.com *.google-analytics.com *.googletagmanager.com cloudflareinsights.com checkout.stripe.com; block-all-mixed-content;
strict-transport-security: max-age=31536000; includeSubDomains; preload