Menu
Language: EN
Check my connection

Domain report

Everything about a domain on one page: where it is registered and hosted, whether its email is protected against spoofing, its DNS, and how secure its website is. Every problem comes with why it matters and how to fix it.

Report for example.com

Problem: example.com: 2 things to fix

Signals

Scores from other services (we don't copy them)

We check registration, DNS, email authentication, the website, its certificate and our own lists. We don't scan for malware or query mail blocklists (DNSBLs), and we can't test the mail servers themselves (port 25): use the links for those.

Passed 11 · Warnings 1 · Problems 1 · Notes 6

Grade C · 72 out of 100

Every check that finished counts: 100 points, minus 20 for each problem and 8 for each warning. A from 90 points, B from 80, C from 65, D from 50, otherwise F.

  • −8 HTTPS redirect: http:// does not redirect to https://.
  • −20 Security headers: Security headers: grade F (0/100).
Download JSON

Key facts

Key facts
Domain
example.com · Grade C · 72 out of 100
Registrar and expiry
OK: RESERVED-Internet Assigned Numbers Authority · Expires on 2027-08-13, in 272 days.
Hosting
OK: Cloudflare, Inc. AS13335
172.66.147.243 · Cloud or hosting provider
104.20.23.154 · Cloud or hosting provider
2606:4700:10::ac42:93f3 · Cloud or hosting provider
2606:4700:10::6814:179a · Cloud or hosting provider
Mail servers
Note: Declares that it does not receive email (null MX).
SPF
OK: SPF ends in -all: email from other servers should be rejected (0 of 10 lookups).
DKIM
Note: No DKIM key found among the common selectors (google, selector1, selector2, default, k1, s1, mail). The domain may still use DKIM with a different selector.
DMARC
OK: DMARC is p=reject: failing email is rejected.
TLS certificate
OK: The HTTPS connection worked, so the certificate was valid when we checked. Its issuer and expiry date come from crt.sh, which did not answer in time.
Website
OK: The website answers with HTTP 200 at https://example.com/. HTTP 200
Security headers
Problem: Security headers: grade F (0/100).
What this means
Name servers / DNS provider
OK: hera.ns.cloudflare.com, elliott.ns.cloudflare.com · Cloudflare

Domain

OK
Domain
Registration
OK: Registered with RESERVED-Internet Assigned Numbers Authority.
Expiry
OK: Expires on 2027-08-13, in 272 days.
Status
OK: No hold or deletion status.
Registrar
RESERVED-Internet Assigned Numbers Authority
Registered
1995-08-14
Expires
2027-08-13
Age
31 years
Status
client delete prohibited
client transfer prohibited
client update prohibited

Website

Warning
Website
Website
OK: The website answers with HTTP 200 at https://example.com/.
HTTPS redirect
Warning: http:// does not redirect to https://.
What this means
Final address
https://example.com/
HTTP status
200

Certificate

OK
Certificate
Certificate
OK: The HTTPS connection worked, so the certificate was valid when we checked. Its issuer and expiry date come from crt.sh, which did not answer in time.

Security headers

Problem
Security headers
Security headers
Problem: Security headers: grade F (0/100).
strict-transport-security
Warning: Missing · Forces browsers to use HTTPS on later visits.
content-security-policy
Warning: Missing · Limits where scripts and other content may load from, which blocks most injection attacks.
x-content-type-options
Warning: Missing · Stops browsers from guessing file types (MIME sniffing).
x-frame-options
Warning: Missing · Stops other sites from embedding this one in a frame (clickjacking).
referrer-policy
Warning: Missing · Controls how much of the page address is sent to other sites.
permissions-policy
Warning: Missing · Turns off browser features the site does not need, such as the camera.

Email security

OK
Email security
Mail servers
Note: Declares that it does not receive email (null MX).
SPF
OK: SPF ends in -all: email from other servers should be rejected (0 of 10 lookups).
DMARC
OK: DMARC is p=reject: failing email is rejected.
DKIM
Note: No DKIM key found among the common selectors (google, selector1, selector2, default, k1, s1, mail). The domain may still use DKIM with a different selector.
MTA-STS
Note: No MTA-STS policy.
BIMI
Note: No BIMI record.
TLS-RPT
Note: No TLS-RPT record: you won't hear about failed encrypted deliveries. Optional.
Mail servers (MX)
0 .
SPF record
?SPF is a DNS TXT record that lists which servers may send email for a domain. Receiving servers use it to spot forged senders.
v=spf1 -all
SPF DNS lookups
0 / 10
DMARC record
?DMARC is a DNS TXT record at _dmarc.<domain>. It tells receivers what to do with email that fails SPF and DKIM: nothing, spam folder, or reject.
v=DMARC1;p=reject;sp=reject;adkim=s;aspf=s
DKIM selectors checked
google, selector1, selector2, default, k1, s1, mail

DNS

OK
DNS
Name servers
OK: 2 name servers.
CAA
Note: No CAA record: any certificate authority may issue certificates.
DNSSEC
OK: DNSSEC is on: DNS answers are signed and validated.
Name servers
hera.ns.cloudflare.com
elliott.ns.cloudflare.com
SOA
elliott.ns.cloudflare.com. dns.cloudflare.com. 2420077714 10000 2400 604800 1800
DNSSEC
?DNSSEC signs DNS answers so resolvers can check they were not tampered with. Validating resolvers mark checked answers with the AD (authenticated data) flag.
AD

Hosting

OK
Hosting
Address
OK: Points to 172.66.147.243, run by Cloudflare, Inc.
IPv6
OK: Reachable over IPv6 as well.
IPv4 addresses
172.66.147.243
104.20.23.154
IPv6 addresses
2606:4700:10::ac42:93f3
2606:4700:10::6814:179a
Owner of the first address
Cloudflare, Inc.
Network (ASN)
?An ASN (Autonomous System Number) identifies one network on the internet, usually an internet provider, a hosting company or a large organization. All of its IP addresses are announced under this number.
AS13335 Cloudflare, Inc.
172.66.147.243
Cloud or hosting provider · This address belongs to Cloudflare.
104.20.23.154
Cloud or hosting provider · This address belongs to Cloudflare.
2606:4700:10::ac42:93f3
Cloud or hosting provider · This address belongs to Cloudflare.
2606:4700:10::6814:179a
Cloud or hosting provider · This address belongs to Cloudflare.

DNS records
DNS records
A
The IPv4 address a name points to.
172.66.147.243
104.20.23.154
AAAA
The IPv6 address a name points to.
2606:4700:10::ac42:93f3
2606:4700:10::6814:179a
MX
The mail servers that receive email for the domain, with a priority number (lower is tried first).
0 .
NS
The name servers that are authoritative for the domain, which usually tells you the DNS provider.
hera.ns.cloudflare.com
elliott.ns.cloudflare.com
TXT
Free-form text. Used for email security (SPF, DMARC, DKIM) and to prove domain ownership to services.
v=spf1 -all
_k2n1y4vw3qtb4skdx9e7dxt97qrmmq9
TXT _dmarc.example.com
Free-form text. Used for email security (SPF, DMARC, DKIM) and to prove domain ownership to services.
v=DMARC1;p=reject;sp=reject;adkim=s;aspf=s
SOA
Zone metadata: the primary name server, an admin contact and a serial number.
elliott.ns.cloudflare.com. dns.cloudflare.com. 2420077714 10000 2400 604800 1800
CAA
Which certificate authorities may issue TLS certificates for the domain.
None

Fix it: suggested records

These records are suggestions built from what this report found. Review each one before you publish it: a wrong record can stop email or certificates from working.

DKIM record Template

Name
selector._domainkey.example.com
Type
TXT
Value
v=DKIM1; k=rsa; p=<public key from your mail provider>

We can't generate this one: the key comes from your mail provider. Turn on DKIM signing in its settings; it gives you the selector name and the full record to publish.

selector._domainkey.example.com. 3600 IN TXT "v=DKIM1; k=rsa; p=<public key from your mail provider>"

Check it elsewhere

These services have their own data and terms. We only link to them: the address is sent to them only if you click.

What this means and where the data comes from

What the findings mean

Problem: Security headers

Why this matters. Security headers tell browsers to block common attacks such as clickjacking and content injection.

How to fix. Add the missing headers listed above in your web server or CDN configuration.

Warning: HTTPS redirect

Why this matters. Visitors who type the address without https:// stay on an unencrypted connection that can be read and changed.

How to fix. Redirect every http:// request to https:// with a 301, for example with your host's or CDN's “Always use HTTPS” setting.

DKIM

Where the data comes from

  • Source: RDAP (rdap.org)
  • Source: a request from iplover to https://example.com/ (at most 5 redirects, 8 seconds)
  • Source: crt.sh Certificate Transparency logs. This is the newest certificate logged for the domain, not necessarily the one the server shows right now.
  • Source: DNS over HTTPS (Cloudflare, with Google Public DNS as fallback)
  • Reputation: iplover's own copies of public blocklists and network lists, refreshed every hour. See every list and its date.

Checked 2026-11-14 01:01 UTC. Reports are cached for up to 1 hour.

Notes and limitations

We check registration, DNS, email authentication, the website, its certificate and our own lists. We don't scan for malware or query mail blocklists (DNSBLs), and we can't test the mail servers themselves (port 25): use the links for those.