xtra.it

.it crawl

First seen 2026-05-20 · Last seen 2026-05-31 · ok HTTP/1.1 200 2916 ms crawled 2026-05-27

NL · 80.69.89.160 · AS20857 Signet B.V.

Reputation 92/100 no dmarc policy

Classifying

HTML metadata

Title: XTRA: Digital Communications Agency
Description: We're not your average "young and dynamic" agency. What do we do really well? Let us show you!
Language: en

Open Graph

url: https://www.xtra.it/en
title: XTRA: Digital Communications Agency

Technology

Analytics

Google Tag Manager

Third-party hosts loaded (2)

www.googletagmanager.com×1
www.recaptcha.net×1

Social

Contact

Phone

+39035223098

DNS records live

NS

ns1.register.it
ns2.register.it

MX

10 esva.sfera.net
10 esva2.sfera.net

Verified for

Microsoft 365

Email authentication weak

SPF

v=spf1 ip4:94.237.90.134 ip4:80.91.53.25/32 ip4:80.91.49.234 include:smtp.sfera.net include:spf.protection.outlook.com -all

strict (-all)

DMARC

not published

DKIM

default: v=DKIM1; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCzysGT9sIUnzZGYkqYtvJJFk+B5Kz2JTluzJ5zG2THghOzubqthSJLtN8nVgk3mD3T7JEO/fSJ3ZZsv8S9J1AjdG8Of…

selectors probed

Certificate (current)

Sectigo Public Server Authentication CA DV R36

from 2025-10-27 to 2026-11-25

Expires in 177 days

Full certificate history on crt.sh ↗

HTTP security headers

Header hygiene 90/100 Checked live page: https://www.xtra.it/en

present

strict-transport-security
content-security-policy
x-frame-options
x-content-type-options
referrer-policy
permissions-policy

findings

CSP allows unsafe inline scripts/styles
CSP uses wildcard sources

Header values

referrer-policy: no-referrer-when-downgrade
x-frame-options: SAMEORIGIN
permissions-policy: microphone=(), camera=(), payment=()
x-content-type-options: nosniff
content-security-policy: default-src 'self';script-src 'self' 'nonce-US25jgZoNO6tgqjmvh7igUi3' 'unsafe-eval' www.googletagmanager.com www.google.com www.gstatic.com www.recaptcha.net;style-src 'self' 'unsafe-inline';img-src 'self' data: www.googletagmanager.com img.youtube.com;media-src 'self' data: space-trial.video-dns.com space-5d5i7.video-dns.com;font-src 'self' data:;connect-src 'self' *;child-src 'self' www.youtube.com www.youtube-nocookie.com www.google.com recaptcha.google.com www.recaptcha.net space-trial.video-dns.com player.vimeo.com;frame-ancestors 'self';upgrade-insecure-requests
strict-transport-security: max-age=31536000; includeSubDomains