Security

How we scan

Every check is passive and read-only. We use only information that is already public, the same things a mail server or web browser looks at.

Public information only

No passwords or logins

No port or vulnerability scans

MX, NS, TXT records

Standard DNS lookups, exactly what any mail server does before delivering email.

SPF

We read your SPF record and follow its include: entries to count DNS lookups.

DMARC

We read the TXT record at _dmarc.yourdomain.

DKIM

We look up public keys at about 40 common selector names. Selectors can't be listed from outside, so if we don't find one we say so and never claim DKIM is missing.

MTA-STS / TLS-RPT

We read the _mta-sts and _smtp._tls records and, if present, download the public policy file.

Blocklists

We ask public spam blocklists (via DNS) whether your domain or your own mail servers are listed.

Certificate & TLS

One normal HTTPS connection to read the certificate, and up to two more to see whether old TLS 1.0/1.1 is still accepted.

Homepage

One request over http:// following redirects (at most 5), then we read the security headers it returns.

Domain expiry

We ask your domain's registry for its expiry date through the public RDAP service.

What we never do

· No port scanning, directory probing or vulnerability testing.
· No password or data-breach lookups.
· We never connect to private or internal IP addresses, even if a domain points at one.
· Our requests identify themselves as DomainHealthBot with a link to this page.

When we can't check something

If a lookup times out or a service is down, we mark that check "Not checked". It never counts against your score, and we try again on the next scan.