Is state.gov legit?
State.gov appears to be a highly trusted domain with a strong online presence and robust infrastructure. While there were minor issues with website accessibility for automated tools and missing branding, these are overshadowed by its strong security, age, and global recognition.
Government average: 82/100 · based on 33 sites
Checked: April 27, 2026 at 11:59 AM UTC
Is state.gov a scam? Here's what we found.
A robust security posture, featuring a valid and up-to-date SSL certificate with TLS 1.3 and a clean Google Web Risk report. The connection timeout for automated checks is a minor drawback but likely due to protective measures.
Exceptional identity, with a domain nearly 29 years old, showcasing significant longevity and stability. The public WHOIS information, despite privacy redactions for individuals, indicates official .gov registration.
A stellar global reputation, evidenced by its Tranco rank in the top 1000 and a clean bill from DNS blacklists. The missing favicon is a minor aesthetic point, not impacting core trust.
While the site itself is transparent in its purpose, the lack of a robots.txt and sitemap for a site of this scale is a minor omission, though its status as a government site implies inherent transparency.
As a government entity, compliance is inherently expected and generally very high. The provided signals don't directly assess specific compliance documents but the .gov domain implies adherence to public standards.
Excellent infrastructure with multiple DNS IPs, robust email authentication through DMARC, and clear DNSSEC implementation. The use of a reputable CDN like CloudFront further enhances delivery and reliability.
Signals Detected
Website did not respond in time — likely bot protection or a CDN blocking automated requests. The site may be online for regular browser visitors.
This is one of the most visited websites globally
This business has no Trustpilot presence — not unusual for smaller or newer companies
Resolves to: 2600:1f10:4617:d340:6535:2eb1:e4db:244d, 2600:1f18:3a6e:b641:e65a:ee0e:a6dc:89f4, 2600:1f18:7400:4a95:de75:7fa3:6311:a663, 34.233.146.45, 107.22.78.153, 100.28.244.61
Mail servers: stimson.state.gov., christopher-ew.state.gov.
Domain has DMARC email authentication configured
DNS providers: a1-63.akam.net., a3-66.akam.net., a8-67.akam.net., a9-64.akam.net., a14-64.akam.net., a26-65.akam.net.
crt.sh returned status 429
Not found on any DNS blacklists
Valid certificate, expires in 168 days
Certificate issued by Amazon
Connection uses TLS 1.3
Domain created 1997-10-02T01:29:30Z (28 years, 11 months ago)
Registered through get.gov
Expires in 124 days
DNSSEC status from WHOIS
No favicon found — unusual for an established business
Web server: CloudFront
No threats detected by Google Web Risk
No sitemap found — common for smaller sites
No robots.txt file — common for small sites
Could not query Wayback Machine
Embed This Badge
Stay Safe Online
Good habits to protect yourself, no matter the scan result.
Never reuse passwords across sites.
Add a second layer of security to your accounts.
Always verify unfamiliar stores before entering payment info.