Arch Coal · Domain Security

Arch Coal Domain Security

Domain security

Domain security posture for Arch Coal, probed live across 5 host(s) and 3 registrable domain(s). 4 host(s) serve HTTPS; 1 advertise HSTS. Email/DNS controls: DNSSEC absent, SPF absent, DMARC absent.

MiningCoalMetallurgical CoalThermal CoalEnergyCore Natural ResourcesInvestor RelationsFortune 500

Transport & Host Security

corenaturalresources.com
HTTPS: yes · HSTS: no · cert expires: Oct 12 05:02:30 2026 GMT
www.corenaturalresources.com
HTTPS: yes · HSTS: no
investors.corenaturalresources.com
HTTPS: yes · HSTS: yes · cert expires: Sep 27 13:42:12 2026 GMT
archresources.com
HTTPS: yes · HSTS: no
www.arch-coal.com
HTTPS: no · HSTS: no

Domain (DNS/Email) Security

corenaturalresources.com
DNSSEC: no · SPF: no · DMARC: no · CAA: none
archresources.com
DNSSEC: no · SPF: no · DMARC: yes (p=reject) · CAA: none
arch-coal.com
DNSSEC: no · SPF: no · DMARC: no · CAA: none

Source

Domain Security

arch-coal-domain-security.yml Raw ↑ 
generated: '2026-07-25'
method: probed
source: live DNS/TLS/HTTP probes of the corenaturalresources.com properties in apis.yml
notes: Arch Coal / Arch Resources is now Core Natural Resources (NYSE:CNR) following the January
  2025 merger with CONSOL Energy. The arch-coal.com domain no longer resolves. archresources.com
  still answers but the corporate presence has moved to corenaturalresources.com.
hosts:
- host: corenaturalresources.com
  https: true
  http_status: 200
  server: Apache
  cert_issuer: Let's Encrypt
  cert_expires: Oct 12 05:02:30 2026 GMT
  hsts: false
- host: www.corenaturalresources.com
  https: true
  http_status: 301
  redirects_to: https://corenaturalresources.com/
- host: investors.corenaturalresources.com
  https: true
  http_status: 200
  server: cloudflare
  cert_issuer: Google Trust Services
  cert_expires: Sep 27 13:42:12 2026 GMT
  hsts: true
  hsts_max_age: 31536000
  hsts_include_subdomains: true
  x_frame_options: SAMEORIGIN
- host: archresources.com
  https: true
  http_status: 200
  legacy: true
- host: www.arch-coal.com
  https: false
  resolves: false
  legacy: true
domains:
- domain: corenaturalresources.com
  dnssec: false
  caa: []
  spf: false
  dmarc: false
- domain: archresources.com
  dnssec: false
  caa: []
  spf: false
  dmarc: true
  dmarc_policy: reject
  legacy: true
- domain: arch-coal.com
  resolves: false
  legacy: true
findings:
- severity: medium
  finding: The primary corporate domain corenaturalresources.com publishes no SPF and no DMARC
    record, leaving the merged company's domain open to email spoofing. The legacy archresources.com
    domain still has DMARC at p=reject.
- severity: low
  finding: No CAA records and no DNSSEC on corenaturalresources.com.
- severity: low
  finding: The corporate site does not send HSTS; the investor relations portal does.