fail
TLS·25
Legacy protocol versions
in all 23 runs172.66.147.243: accepts TLS 1.0, TLS 1.1
Fix: Disable SSLv3, TLS 1.0 and TLS 1.1 and allow only TLS 1.2 and TLS 1.3.
B
score 79 / 100ok, weaknesses worth fixing
Run 23 2026-11-06 19:55 UTC 57 checks profile 5 0.4 s
example.com
CAA
Legacy
Suites
ECH
Redirect
HSTS
CSP
XFO
XCTO
Referrer
Perms
COOP
Leakage
Caching
DMARC
CAA
Legacy
Suites
ECH
Redirect
HSTS
CSP
XFO
XCTO
Referrer
Perms
COOP
Leakage
Caching
DMARC
CAA
Legacy
Suites
ECH
Redirect
HSTS
CSP
XFO
XCTO
Referrer
Perms
COOP
Leakage
Caching
DMARC
CAA
Legacy
Suites
ECH
Redirect
HSTS
CSP
XFO
XCTO
Referrer
Perms
COOP
Leakage
Caching
DMARC
CAA
Legacy
Suites
ECH
Redirect
HSTS
CSP
XFO
XCTO
Referrer
Perms
COOP
Leakage
Caching
DMARC
CAA
Legacy
Suites
ECH
Redirect
HSTS
CSP
XFO
XCTO
Referrer
Perms
COOP
Leakage
Caching
DMARC
CAA
Legacy
Suites
ECH
Redirect
HSTS
CSP
XFO
XCTO
Referrer
Perms
COOP
Leakage
Caching
DMARC
CAA
Legacy
Suites
ECH
Redirect
HSTS
CSP
XFO
XCTO
Referrer
Perms
COOP
Leakage
Caching
DMARC
CAA
Legacy
Suites
ECH
Redirect
HSTS
CSP
XFO
XCTO
Referrer
Perms
COOP
Leakage
Caching
DMARC
CAA
Legacy
Suites
ECH
Redirect
HSTS
CSP
XFO
XCTO
Referrer
Perms
COOP
Leakage
Caching
DMARC
CAA
Legacy
Suites
ECH
Redirect
HSTS
CSP
XFO
XCTO
Referrer
Perms
COOP
Leakage
Caching
DMARC
CAA
Legacy
Suites
ECH
Redirect
HSTS
CSP
XFO
XCTO
Referrer
Perms
COOP
Leakage
Caching
DMARC
CAA
Legacy
Suites
ECH
Redirect
HSTS
CSP
XFO
XCTO
Referrer
Perms
COOP
Leakage
Caching
DMARC
CAA
Legacy
Suites
ECH
Redirect
HSTS
CSP
XFO
XCTO
Referrer
Perms
COOP
Leakage
Caching
DMARC
CAA
Legacy
Suites
ECH
Redirect
HSTS
CSP
XFO
XCTO
Referrer
Perms
COOP
Leakage
Caching
DMARC
CAA
Legacy
Suites
ECH
Redirect
HSTS
CSP
XFO
XCTO
Referrer
Perms
COOP
Leakage
Caching
DMARC
CAA
Legacy
Suites
ECH
Redirect
HSTS
CSP
XFO
XCTO
Referrer
Perms
COOP
Leakage
Caching
DMARC
CAA
Legacy
Suites
ECH
Redirect
HSTS
CSP
XFO
XCTO
Referrer
Perms
COOP
Leakage
Caching
DMARC
CAA
Legacy
Suites
ECH
Redirect
HSTS
CSP
XFO
XCTO
Referrer
Perms
COOP
Leakage
Caching
DMARC
CAA
Legacy
Suites
ECH
Redirect
HSTS
CSP
XFO
XCTO
Referrer
Perms
COOP
Leakage
Caching
DMARC
CAA
Legacy
Suites
ECH
Redirect
HSTS
CSP
XFO
XCTO
Referrer
Perms
COOP
Leakage
Caching
DMARC
CAA
Legacy
Suites
ECH
Redirect
HSTS
CSP
XFO
XCTO
Referrer
Perms
COOP
Leakage
Caching
DMARC
CAA
Legacy
Suites
ECH
Redirect
HSTS
CSP
XFO
XCTO
Referrer
Perms
COOP
Leakage
Caching
DMARC
DNS A
TLS A
HTTP F
EMAIL C
IP A+
ACFA+A
ACFA+A
ACFA+A
ACFA+A
ACFA+A
ACFA+A
ACFA+A
ACFA+A
ACFA+A
ACFA+A
ACFA+A
ACFA+A
ACFA+A
ACFA+A
ACFA+A
ACFA+A
ACFA+A
ACFA+A
ACFA+A
ACFA+A
ACFA+A
ACFA+A
ACFA+A
Run 232026-11-06grade B
Run 23 · 2026-11-06 · grade B
latest run
Tap a line for its history. Step back with ‹ to replay a run.
11-0610-28
Each line carries its trace: 23 runs, newest on top.
hover a run to replay the spectrum · tap to pin
- pass
- warn
- fail
- fixed since run 22
- fixed since run 21
- fixed since run 20
- fixed since run 19
- fixed since run 18
- fixed since run 17
- fixed since run 16
- fixed since run 15
- fixed since run 14
- fixed since run 13
- fixed since run 12
- fixed since run 11
- fixed since run 10
- fixed since run 9
- fixed since run 8
- fixed since run 7
- fixed since run 6
- fixed since run 5
- fixed since run 4
- fixed since run 3
- fixed since run 2
- fixed since run 1
Since run 22
- removed tls.probes@104.20.23.154:443 tls
- added tls.probes@172.66.147.243:443 tls
15 lines need attention
Your web server configuration
12 lines
fail
HTTP·34
HTTPS redirect
in all 23 runsHTTP port 80 does not redirect to HTTPS
Fix: Serve HTTP on port 80 and redirect every request to HTTPS with a 301 before serving content.
fail
HTTP·35
HSTS
in all 23 runsNo HSTS header found
Fix: Send Strict-Transport-Security with max-age=31536000 on all HTTPS responses.
warn
TLS·26
Weak cipher suites
in all 23 runs172.66.147.243: accepts CBC suite TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA; 172.66.147.243: accepts static RSA suite TLS_RSA_WITH_AES_128_GCM_SHA256
Fix: Allow only ECDHE suites with AES-GCM or ChaCha20-Poly1305 for TLS 1.2, and remove RC4, 3DES, DES, export, NULL, anonymous, CBC and static RSA suites.
warn
HTTP·38
Content Security Policy
in all 23 runsNo Content-Security-Policy header
Fix: Send an enforced Content-Security-Policy with default-src, object-src 'none' and base-uri that restricts scripts to trusted origins.
warn
HTTP·39
X-Frame-Options
in all 23 runsMissing x-frame-options header
Fix: Send X-Frame-Options: DENY, or SAMEORIGIN where the site frames its own pages.
warn
HTTP·40
X-Content-Type-Options
in all 23 runsMissing x-content-type-options header
Fix: Send X-Content-Type-Options: nosniff on all responses.
warn
HTTP·41
Referrer-Policy
in all 23 runsMissing referrer-policy header
Fix: Send Referrer-Policy: strict-origin-when-cross-origin or stricter.
warn
HTTP·42
Permissions-Policy
in all 23 runsMissing permissions-policy header
Fix: Send a Permissions-Policy that disables the browser features the site does not use.
warn
HTTP·43
Cross-Origin-Opener-Policy
in all 23 runsMissing cross-origin-opener-policy header
Fix: Send Cross-Origin-Opener-Policy: same-origin, or same-origin-allow-popups when the site relies on popups such as payment or login windows.
warn
HTTP·45
Information leakage
in all 23 runsInfo leakage headers: Server
Fix: Remove the Server, X-Powered-By and similar technology headers from the server's responses.
warn
HTTP·46
Cache control
in all 23 runsNo Cache-Control header
Fix: Send an explicit Cache-Control header on each response and pair max-age=0 with no-cache or must-revalidate.
Your DNS provider
3 lines
warn
DNS·04
CAA records
in all 23 runsNo CAA records found: any Certificate Authority can issue certificates for this domain; cf. RFC 8659
Fix: Publish issue and issuewild CAA records naming the allowed certificate authorities, using only known tags.
warn
MAIL·50
DMARC
in all 23 runsno aggregate reports
Fix: Publish one DMARC record with p=reject, without sp=none or pct=0, and with an rua address authorised to receive reports.
warn
TLS·33
ECH advertised
in all 23 runs172.66.147.243: ECH not advertised in HTTPS DNS record; 104.20.23.154: ECH not advertised in HTTPS DNS record
Fix: Publish the server's ECH configuration in the ech= parameter of the HTTPS record, once Encrypted Client Hello is enabled on the server.
Evidence
# example.com
Grade B · score 79 / 100
## Open issues
- WARN `dns.caa` CAA records: No CAA records found: any Certificate Authority can issue certificates for this domain; cf. RFC 8659
- FAIL `tls.legacy_versions` Legacy protocol versions: 172.66.147.243: accepts TLS 1.0, TLS 1.1
- WARN `tls.weak_suites` Weak cipher suites: 172.66.147.243: accepts CBC suite TLS\_ECDHE\_ECDSA\_WITH\_AES\_128\_CBC\_SHA; 172.66.147.243: accepts static RSA suite TLS\_RSA\_WITH\_AES\_128\_GCM\_SHA256
- WARN `tls.ech_advertised` ECH advertised: 172.66.147.243: ECH not advertised in HTTPS DNS record; 104.20.23.154: ECH not advertised in HTTPS DNS record
- FAIL `http.https_redirect` HTTPS redirect: HTTP port 80 does not redirect to HTTPS
- FAIL `http.hsts` HSTS: No HSTS header found
- WARN `http.csp` Content Security Policy: No Content-Security-Policy header
- WARN `http.x_frame_options` X-Frame-Options: Missing x-frame-options header
- WARN `http.x_content_type_options` X-Content-Type-Options: Missing x-content-type-options header
- WARN `http.referrer_policy` Referrer-Policy: Missing referrer-policy header
- WARN `http.permissions_policy` Permissions-Policy: Missing permissions-policy header
- WARN `http.coop` Cross-Origin-Opener-Policy: Missing cross-origin-opener-policy header
- WARN `http.info_leakage` Information leakage: Info leakage headers: Server
- WARN `http.caching` Cache control: No Cache-Control header
- WARN `email.dmarc` DMARC: no aggregate reports
## Checks
| Code | Check | Status | Finding | Fix |
|---|---|---|---|---|
| `dns.dnssec` | DNSSEC signed | pass | | |
| `dns.dnskey_algorithm` | DNSKEY algorithm | pass | | |
| `dns.dnssec_rollover` | DNSSEC key rollover | pass | | |
| `dns.caa` | CAA records | warn | No CAA records found: any Certificate Authority can issue certificates for this domain; cf. RFC 8659 | Publish issue and issuewild CAA records naming the allowed certificate authorities, using only known tags. |
| `dns.ns` | Nameserver redundancy | pass | | |
| `dns.ns_lame` | Lame delegation | pass | | |
| `dns.ns_delegation` | Delegation consistency | pass | | |
| `dns.cname_apex` | No CNAME at apex | pass | | |
| `dns.https_svcb` | HTTPS record | pass | | |
| `dns.ttl` | TTL range | pass | | |
| `tls.tls_reachable` | TLS reachable | pass | | |
| `tls.chain_trusted` | Chain trusted | pass | | |
| `tls.not_expired` | Certificate valid | pass | | |
| `tls.hostname_match` | Hostname match | pass | | |
| `tls.chain_complete` | Chain complete | pass | | |
| `tls.strong_signature` | Strong signature | pass | | |
| `tls.key_strength` | Key strength | pass | | |
| `tls.expiry_window` | Expiry window | pass | | |
| `tls.cert_lifetime` | Certificate lifetime | pass | | |
| `tls.san_quality` | SAN quality | pass | | |
| `tls.aia_reachability` | AIA reachable | not\_applicable | Chain is complete; AIA URLs not required for verification | |
| `tls.tls_version` | TLS version | pass | | |
| `tls.forward_secrecy` | Forward secrecy | pass | | |
| `tls.aead_cipher` | AEAD cipher | pass | | |
| `tls.legacy_versions` | Legacy protocol versions | fail | 172.66.147.243: accepts TLS 1.0, TLS 1.1 | Disable SSLv3, TLS 1.0 and TLS 1.1 and allow only TLS 1.2 and TLS 1.3. |
| `tls.weak_suites` | Weak cipher suites | warn | 172.66.147.243: accepts CBC suite TLS\_ECDHE\_ECDSA\_WITH\_AES\_128\_CBC\_SHA; 172.66.147.243: accepts static RSA suite TLS\_RSA\_WITH\_AES\_128\_GCM\_SHA256 | Allow only ECDHE suites with AES-GCM or ChaCha20-Poly1305 for TLS 1.2, and remove RC4, 3DES, DES, export, NULL, anonymous, CBC and static RSA suites. |
| `tls.ocsp_stapled` | OCSP stapling | pass | | |
| `tls.ct_logged` | CT logged | pass | | |
| `tls.caa_compliant` | CAA compliant | pass | | |
| `tls.dane_valid` | DANE valid | not\_applicable | DANE check skipped (requires DNSSEC) | |
| `tls.consistency` | Multi-IP consistency | pass | | |
| `tls.alpn_consistency` | ALPN consistency | pass | | |
| `tls.ech_advertised` | ECH advertised | warn | 172.66.147.243: ECH not advertised in HTTPS DNS record; 104.20.23.154: ECH not advertised in HTTPS DNS record | Publish the server's ECH configuration in the ech= parameter of the HTTPS record, once Encrypted Client Hello is enabled on the server. |
| `http.https_redirect` | HTTPS redirect | fail | HTTP port 80 does not redirect to HTTPS | Serve HTTP on port 80 and redirect every request to HTTPS with a 301 before serving content. |
| `http.hsts` | HSTS | fail | No HSTS header found | Send Strict-Transport-Security with max-age=31536000 on all HTTPS responses. |
| `http.cors` | CORS policy | pass | | |
| `http.cookie_secure` | Secure cookies | not\_applicable | not applicable | |
| `http.csp` | Content Security Policy | warn | No Content-Security-Policy header | Send an enforced Content-Security-Policy with default-src, object-src 'none' and base-uri that restricts scripts to trusted origins. |
| `http.x_frame_options` | X-Frame-Options | warn | Missing x-frame-options header | Send X-Frame-Options: DENY, or SAMEORIGIN where the site frames its own pages. |
| `http.x_content_type_options` | X-Content-Type-Options | warn | Missing x-content-type-options header | Send X-Content-Type-Options: nosniff on all responses. |
| `http.referrer_policy` | Referrer-Policy | warn | Missing referrer-policy header | Send Referrer-Policy: strict-origin-when-cross-origin or stricter. |
| `http.permissions_policy` | Permissions-Policy | warn | Missing permissions-policy header | Send a Permissions-Policy that disables the browser features the site does not use. |
| `http.coop` | Cross-Origin-Opener-Policy | warn | Missing cross-origin-opener-policy header | Send Cross-Origin-Opener-Policy: same-origin, or same-origin-allow-popups when the site relies on popups such as payment or login windows. |
| `http.deprecated_headers` | Deprecated headers | pass | | |
| `http.info_leakage` | Information leakage | warn | Info leakage headers: Server | Remove the Server, X-Powered-By and similar technology headers from the server's responses. |
| `http.caching` | Cache control | warn | No Cache-Control header | Send an explicit Cache-Control header on each response and pair max-age=0 with no-cache or must-revalidate. |
| `email.mx` | MX records | not\_applicable | Null MX | |
| `email.spf` | SPF | pass | domain declares it sends no mail (Null MX or SPF -all only) | |
| `email.dkim` | DKIM | not\_applicable | only revoked DKIM keys | |
| `email.dmarc` | DMARC | warn | no aggregate reports | Publish one DMARC record with p=reject, without sp=none or pct=0, and with an rua address authorised to receive reports. |
| `email.mta_sts` | MTA-STS | not\_applicable | Null MX | |
| `email.tls_rpt` | TLS-RPT | not\_applicable | Null MX | |
| `email.bimi` | BIMI | not\_applicable | Null MX | |
| `email.dane` | SMTP DANE | not\_applicable | Null MX | |
| `email.dnsbl` | DNS blocklists | not\_applicable | Null MX | |
| `email.fcrdns` | Forward-confirmed rDNS | not\_applicable | Null MX | |
| `ip.reputation` | IP reputation | pass | | |
section,item,field,value
checks,dns.dnssec,status,pass
checks,dns.dnssec,finding,
checks,dns.dnssec,fix,
checks,dns.dnskey_algorithm,status,pass
checks,dns.dnskey_algorithm,finding,
checks,dns.dnskey_algorithm,fix,
checks,dns.dnssec_rollover,status,pass
checks,dns.dnssec_rollover,finding,
checks,dns.dnssec_rollover,fix,
checks,dns.caa,status,warn
checks,dns.caa,finding,No CAA records found: any Certificate Authority can issue certificates for this domain; cf. RFC 8659
checks,dns.caa,fix,"Publish issue and issuewild CAA records naming the allowed certificate authorities, using only known tags."
checks,dns.ns,status,pass
checks,dns.ns,finding,
checks,dns.ns,fix,
checks,dns.ns_lame,status,pass
checks,dns.ns_lame,finding,
checks,dns.ns_lame,fix,
checks,dns.ns_delegation,status,pass
checks,dns.ns_delegation,finding,
checks,dns.ns_delegation,fix,
checks,dns.cname_apex,status,pass
checks,dns.cname_apex,finding,
checks,dns.cname_apex,fix,
checks,dns.https_svcb,status,pass
checks,dns.https_svcb,finding,
checks,dns.https_svcb,fix,
checks,dns.ttl,status,pass
checks,dns.ttl,finding,
checks,dns.ttl,fix,
checks,tls.tls_reachable,status,pass
checks,tls.tls_reachable,finding,
checks,tls.tls_reachable,fix,
checks,tls.chain_trusted,status,pass
checks,tls.chain_trusted,finding,
checks,tls.chain_trusted,fix,
checks,tls.not_expired,status,pass
checks,tls.not_expired,finding,
checks,tls.not_expired,fix,
checks,tls.hostname_match,status,pass
checks,tls.hostname_match,finding,
checks,tls.hostname_match,fix,
checks,tls.chain_complete,status,pass
checks,tls.chain_complete,finding,
checks,tls.chain_complete,fix,
checks,tls.strong_signature,status,pass
checks,tls.strong_signature,finding,
checks,tls.strong_signature,fix,
checks,tls.key_strength,status,pass
checks,tls.key_strength,finding,
checks,tls.key_strength,fix,
checks,tls.expiry_window,status,pass
checks,tls.expiry_window,finding,
checks,tls.expiry_window,fix,
checks,tls.cert_lifetime,status,pass
checks,tls.cert_lifetime,finding,
checks,tls.cert_lifetime,fix,
checks,tls.san_quality,status,pass
checks,tls.san_quality,finding,
checks,tls.san_quality,fix,
checks,tls.aia_reachability,status,not_applicable
checks,tls.aia_reachability,finding,Chain is complete; AIA URLs not required for verification
checks,tls.aia_reachability,fix,
checks,tls.tls_version,status,pass
checks,tls.tls_version,finding,
checks,tls.tls_version,fix,
checks,tls.forward_secrecy,status,pass
checks,tls.forward_secrecy,finding,
checks,tls.forward_secrecy,fix,
checks,tls.aead_cipher,status,pass
checks,tls.aead_cipher,finding,
checks,tls.aead_cipher,fix,
checks,tls.legacy_versions,status,fail
checks,tls.legacy_versions,finding,"172.66.147.243: accepts TLS 1.0, TLS 1.1"
checks,tls.legacy_versions,fix,"Disable SSLv3, TLS 1.0 and TLS 1.1 and allow only TLS 1.2 and TLS 1.3."
checks,tls.weak_suites,status,warn
checks,tls.weak_suites,finding,172.66.147.243: accepts CBC suite TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA; 172.66.147.243: accepts static RSA suite TLS_RSA_WITH_AES_128_GCM_SHA256
checks,tls.weak_suites,fix,"Allow only ECDHE suites with AES-GCM or ChaCha20-Poly1305 for TLS 1.2, and remove RC4, 3DES, DES, export, NULL, anonymous, CBC and static RSA suites."
checks,tls.ocsp_stapled,status,pass
checks,tls.ocsp_stapled,finding,
checks,tls.ocsp_stapled,fix,
checks,tls.ct_logged,status,pass
checks,tls.ct_logged,finding,
checks,tls.ct_logged,fix,
checks,tls.caa_compliant,status,pass
checks,tls.caa_compliant,finding,
checks,tls.caa_compliant,fix,
checks,tls.dane_valid,status,not_applicable
checks,tls.dane_valid,finding,DANE check skipped (requires DNSSEC)
checks,tls.dane_valid,fix,
checks,tls.consistency,status,pass
checks,tls.consistency,finding,
checks,tls.consistency,fix,
checks,tls.alpn_consistency,status,pass
checks,tls.alpn_consistency,finding,
checks,tls.alpn_consistency,fix,
checks,tls.ech_advertised,status,warn
checks,tls.ech_advertised,finding,172.66.147.243: ECH not advertised in HTTPS DNS record; 104.20.23.154: ECH not advertised in HTTPS DNS record
checks,tls.ech_advertised,fix,"Publish the server's ECH configuration in the ech= parameter of the HTTPS record, once Encrypted Client Hello is enabled on the server."
checks,http.https_redirect,status,fail
checks,http.https_redirect,finding,HTTP port 80 does not redirect to HTTPS
checks,http.https_redirect,fix,Serve HTTP on port 80 and redirect every request to HTTPS with a 301 before serving content.
checks,http.hsts,status,fail
checks,http.hsts,finding,No HSTS header found
checks,http.hsts,fix,Send Strict-Transport-Security with max-age=31536000 on all HTTPS responses.
checks,http.cors,status,pass
checks,http.cors,finding,
checks,http.cors,fix,
checks,http.cookie_secure,status,not_applicable
checks,http.cookie_secure,finding,not applicable
checks,http.cookie_secure,fix,
checks,http.csp,status,warn
checks,http.csp,finding,No Content-Security-Policy header
checks,http.csp,fix,"Send an enforced Content-Security-Policy with default-src, object-src 'none' and base-uri that restricts scripts to trusted origins."
checks,http.x_frame_options,status,warn
checks,http.x_frame_options,finding,Missing x-frame-options header
checks,http.x_frame_options,fix,"Send X-Frame-Options: DENY, or SAMEORIGIN where the site frames its own pages."
checks,http.x_content_type_options,status,warn
checks,http.x_content_type_options,finding,Missing x-content-type-options header
checks,http.x_content_type_options,fix,Send X-Content-Type-Options: nosniff on all responses.
checks,http.referrer_policy,status,warn
checks,http.referrer_policy,finding,Missing referrer-policy header
checks,http.referrer_policy,fix,Send Referrer-Policy: strict-origin-when-cross-origin or stricter.
checks,http.permissions_policy,status,warn
checks,http.permissions_policy,finding,Missing permissions-policy header
checks,http.permissions_policy,fix,Send a Permissions-Policy that disables the browser features the site does not use.
checks,http.coop,status,warn
checks,http.coop,finding,Missing cross-origin-opener-policy header
checks,http.coop,fix,"Send Cross-Origin-Opener-Policy: same-origin, or same-origin-allow-popups when the site relies on popups such as payment or login windows."
checks,http.deprecated_headers,status,pass
checks,http.deprecated_headers,finding,
checks,http.deprecated_headers,fix,
checks,http.info_leakage,status,warn
checks,http.info_leakage,finding,Info leakage headers: Server
checks,http.info_leakage,fix,"Remove the Server, X-Powered-By and similar technology headers from the server's responses."
checks,http.caching,status,warn
checks,http.caching,finding,No Cache-Control header
checks,http.caching,fix,Send an explicit Cache-Control header on each response and pair max-age=0 with no-cache or must-revalidate.
checks,email.mx,status,not_applicable
checks,email.mx,finding,Null MX
checks,email.mx,fix,
checks,email.spf,status,pass
checks,email.spf,finding,domain declares it sends no mail (Null MX or SPF -all only)
checks,email.spf,fix,
checks,email.dkim,status,not_applicable
checks,email.dkim,finding,only revoked DKIM keys
checks,email.dkim,fix,
checks,email.dmarc,status,warn
checks,email.dmarc,finding,no aggregate reports
checks,email.dmarc,fix,"Publish one DMARC record with p=reject, without sp=none or pct=0, and with an rua address authorised to receive reports."
checks,email.mta_sts,status,not_applicable
checks,email.mta_sts,finding,Null MX
checks,email.mta_sts,fix,
checks,email.tls_rpt,status,not_applicable
checks,email.tls_rpt,finding,Null MX
checks,email.tls_rpt,fix,
checks,email.bimi,status,not_applicable
checks,email.bimi,finding,Null MX
checks,email.bimi,fix,
checks,email.dane,status,not_applicable
checks,email.dane,finding,Null MX
checks,email.dane,fix,
checks,email.dnsbl,status,not_applicable
checks,email.dnsbl,finding,Null MX
checks,email.dnsbl,fix,
checks,email.fcrdns,status,not_applicable
checks,email.fcrdns,finding,Null MX
checks,email.fcrdns,fix,
checks,ip.reputation,status,pass
checks,ip.reputation,finding,
checks,ip.reputation,fix,
dns.a,0,owner,example.com.
dns.a,0,type,A
dns.a,0,ttl,300
dns.a,0,data,104.20.23.154
dns.a,1,owner,example.com.
dns.a,1,type,A
dns.a,1,ttl,300
dns.a,1,data,172.66.147.243
dns.aaaa,0,owner,example.com.
dns.aaaa,0,type,AAAA
dns.aaaa,0,ttl,300
dns.aaaa,0,data,2606:4700:10::6814:179a
dns.aaaa,1,owner,example.com.
dns.aaaa,1,type,AAAA
dns.aaaa,1,ttl,300
dns.aaaa,1,data,2606:4700:10::ac42:93f3
dns.mx,0,owner,example.com.
dns.mx,0,type,MX
dns.mx,0,ttl,196
dns.mx,0,data,0 .
dns.ns,0,owner,example.com.
dns.ns,0,type,NS
dns.ns,0,ttl,21600
dns.ns,0,data,elliott.ns.cloudflare.com.
dns.ns,1,owner,example.com.
dns.ns,1,type,NS
dns.ns,1,ttl,21600
dns.ns,1,data,hera.ns.cloudflare.com.
dns.https,0,owner,example.com.
dns.https,0,type,HTTPS
dns.https,0,ttl,300
dns.https,0,data,"1 . alpn=h3,h2 ipv4hint=104.20.23.154,172.66.147.243 ipv6hint=2606:4700:10::6814:179a,2606:4700:10::ac42:93f3"
dns.dnskey,0,owner,example.com.
dns.dnskey,0,type,DNSKEY
dns.dnskey,0,ttl,3505
dns.dnskey,0,data,256 3 13 MjyZielP0GqniI1+j+wAG/3t0ImDDIlj1CxR0oobkZQHSKH2Fqx6tm2NcYu57POJ83SzCWLkqIjZHS1mh5wbaw==
dns.dnskey,1,owner,example.com.
dns.dnskey,1,type,DNSKEY
dns.dnskey,1,ttl,3505
dns.dnskey,1,data,256 3 13 kxipjoIbNZDsWqEKaYaGq6fM/XThrRp1ue6AV9R/n3eWxpGCeCWJb47PEEEj/Q6VAYFW/7UFo5mXoZfxKYZa3A==
dns.dnskey,2,owner,example.com.
dns.dnskey,2,type,DNSKEY
dns.dnskey,2,ttl,3505
dns.dnskey,2,data,256 3 13 oJMRESz5E4gYzS/q6XDrvU1qMPYIjCWzJaOau8XNEZeqCYKD5ar0IRd8KqXXFJkqmVfRvMGPmM1x8fGAa2XhSA==
dns.dnskey,3,owner,example.com.
dns.dnskey,3,type,DNSKEY
dns.dnskey,3,ttl,3505
dns.dnskey,3,data,257 3 13 mdsswUyr3DPW132mOi8V9xESWE8jTo0dxCjjnopKl+GqJxpVXckHAeF+KkxLbxILfDLUT0rAK9iUzy1L53eKGQ==
dns.ds,0,owner,example.com.
dns.ds,0,type,DS
dns.ds,0,ttl,15912
dns.ds,0,data,2371 13 2 C988EC423E3880EB8DD8A46FE06CA230EE23F35B578D64E78B29C3E1C83D245A
dns.nsec,0,owner,example.com.
dns.nsec,0,type,NSEC
dns.nsec,0,ttl,1800
dns.nsec,0,data,\000.example.com. A NS SOA PTR HINFO MX TXT AAAA Unknown SRV NAPTR CERT SSHFP RRSIG NSEC DNSKEY TLSA SMIMEA Unknown CDS CDNSKEY OPENPGPKEY SVCB HTTPS Unknown CAA
dns.soa,0,owner,example.com.
dns.soa,0,type,SOA
dns.soa,0,ttl,581
dns.soa,0,data,elliott.ns.cloudflare.com. dns.cloudflare.com. 2418004112 10000 2400 604800 1800
dns.txt,0,owner,example.com.
dns.txt,0,type,TXT
dns.txt,0,ttl,300
dns.txt,0,data,"""_k2n1y4vw3qtb4skdx9e7dxt97qrmmq9"""
dns.txt,1,owner,example.com.
dns.txt,1,type,TXT
dns.txt,1,ttl,300
dns.txt,1,data,"""v=spf1 -all"""
email.mx,.,host,.
email.mx,.,preference,0
email.spf,,record,v=spf1 -all
email.spf,,lookup_count,0
email.spf,,void_lookups,0
email.dmarc,,record,v=DMARC1;p=reject;sp=reject;adkim=s;aspf=s
email.dmarc,,p,reject
email.dmarc,,sp,reject
email.dmarc,,adkim,s
email.dmarc,,aspf,s
email.dnssec,,dnskey_present,true
email.dkim,default#1,key,default#1
email.dkim,default#1,selector,default
email.dkim,default#1,state,revoked
email.dkim,default#1,key_type,
email.dkim,default#1,bits,
email.summary,,grade,B
http.port80_probe,,url,http://example.com/
http.port80_probe,,status_code,200
http.port80_probe,,redirects_to_https,false
http.headers,date,name,date
http.headers,date,value,"Fri, 06 Nov 2026 19:55:40 GMT"
http.headers,content-type,name,content-type
http.headers,content-type,value,text/html; charset=utf-8
http.headers,server,name,server
http.headers,server,value,cloudflare
http.headers,last-modified,name,last-modified
http.headers,last-modified,value,"Thu, 05 Nov 2026 21:17:41 GMT"
http.headers,allow,name,allow
http.headers,allow,value,"GET, HEAD"
http.headers,age,name,age
http.headers,age,value,5
http.headers,cf-cache-status,name,cf-cache-status
http.headers,cf-cache-status,value,HIT
http.headers,content-encoding,name,content-encoding
http.headers,content-encoding,value,br
http.headers,cf-ray,name,cf-ray
http.headers,cf-ray,value,a566a838cea43727-FRA
http.headers,alt-svc,name,alt-svc
http.headers,alt-svc,value,"h3="":443""; ma=86400"
http.caching,,last_modified,2026-11-05T21:17:41Z
http.caching,,age,5
http.cdn,,provider,Cloudflare
http.cdn,,cache_status,HIT
http.cdn,,indicator,cf-ray
http.cdn,,indicator,cf-cache-status
http.isolation,,missing,cross-origin-opener-policy
http.isolation,,missing,cross-origin-embedder-policy
http.isolation,,missing,cross-origin-resource-policy
http.server,,final_url,https://example.com/
http.server,,status_code,200
http.server,,http_version,h2
http.server,,inspection_ms,403 ms
http.server,,address,172.66.147.243
http.server,,org,"Cloudflare, Inc."
http.server,,network_type,cloud
http.cors,,allows_any_origin,false
http.cors,,reflects_origin,false
http.cors,,allows_credentials,false
ip.addresses,104.20.23.154,address,104.20.23.154
ip.addresses,104.20.23.154,asn,AS13335
ip.addresses,104.20.23.154,org,"Cloudflare, Inc."
ip.addresses,104.20.23.154,prefix,104.20.0.0/18
ip.addresses,104.20.23.154,network_type,cloud
ip.addresses,104.20.23.154,country,
ip.addresses,104.20.23.154,city,
ip.addresses,104.20.23.154,spamhaus,false
ip.addresses,104.20.23.154,c2,false
ip.addresses,104.20.23.154,tor,false
ip.addresses,104.20.23.154,vpn,false
ip.addresses,172.66.147.243,address,172.66.147.243
ip.addresses,172.66.147.243,asn,AS13335
ip.addresses,172.66.147.243,org,"Cloudflare, Inc."
ip.addresses,172.66.147.243,prefix,172.66.128.0/19
ip.addresses,172.66.147.243,network_type,cloud
ip.addresses,172.66.147.243,country,
ip.addresses,172.66.147.243,city,
ip.addresses,172.66.147.243,spamhaus,false
ip.addresses,172.66.147.243,c2,false
ip.addresses,172.66.147.243,tor,false
ip.addresses,172.66.147.243,vpn,false
ip.addresses,2606:4700:10::6814:179a,address,2606:4700:10::6814:179a
ip.addresses,2606:4700:10::6814:179a,asn,AS13335
ip.addresses,2606:4700:10::6814:179a,org,"Cloudflare, Inc."
ip.addresses,2606:4700:10::6814:179a,prefix,2606:4700::/43
ip.addresses,2606:4700:10::6814:179a,network_type,cloud
ip.addresses,2606:4700:10::6814:179a,country,
ip.addresses,2606:4700:10::6814:179a,city,
ip.addresses,2606:4700:10::6814:179a,spamhaus,false
ip.addresses,2606:4700:10::6814:179a,c2,false
ip.addresses,2606:4700:10::6814:179a,tor,false
ip.addresses,2606:4700:10::6814:179a,vpn,false
ip.addresses,2606:4700:10::ac42:93f3,address,2606:4700:10::ac42:93f3
ip.addresses,2606:4700:10::ac42:93f3,asn,AS13335
ip.addresses,2606:4700:10::ac42:93f3,org,"Cloudflare, Inc."
ip.addresses,2606:4700:10::ac42:93f3,prefix,2606:4700::/43
ip.addresses,2606:4700:10::ac42:93f3,network_type,cloud
ip.addresses,2606:4700:10::ac42:93f3,country,
ip.addresses,2606:4700:10::ac42:93f3,city,
ip.addresses,2606:4700:10::ac42:93f3,spamhaus,false
ip.addresses,2606:4700:10::ac42:93f3,c2,false
ip.addresses,2606:4700:10::ac42:93f3,tor,false
ip.addresses,2606:4700:10::ac42:93f3,vpn,false
tls.addresses,172.66.147.243,address,172.66.147.243
tls.addresses,172.66.147.243,port,443
tls.addresses,172.66.147.243,outcome,ok
tls.addresses,172.66.147.243,message,
tls.addresses,2606:4700:10::ac42:93f3,address,2606:4700:10::ac42:93f3
tls.addresses,2606:4700:10::ac42:93f3,port,443
tls.addresses,2606:4700:10::ac42:93f3,outcome,NOT_TESTED_FROM_HERE
tls.addresses,2606:4700:10::ac42:93f3,message,Network unreachable (os error 101)
tls.addresses,104.20.23.154,address,104.20.23.154
tls.addresses,104.20.23.154,port,443
tls.addresses,104.20.23.154,outcome,ok
tls.addresses,104.20.23.154,message,
tls.chain@172.66.147.243:443,0,position,leaf
tls.chain@172.66.147.243:443,0,subject,CN=example.com
tls.chain@172.66.147.243:443,0,issuer,"C=US, O=SSL Corporation, CN=Cloudflare TLS Issuing ECC CA 3"
tls.chain@172.66.147.243:443,0,sans,example.com
tls.chain@172.66.147.243:443,0,sans,*.example.com
tls.chain@172.66.147.243:443,0,not_before,2026-09-26T22:49:11Z
tls.chain@172.66.147.243:443,0,not_after,2026-12-25T22:56:35Z
tls.chain@172.66.147.243:443,0,days_remaining,49
tls.chain@172.66.147.243:443,0,key,ECDSA P-256 256
tls.chain@172.66.147.243:443,0,signature_algorithm,ecdsa-with-SHA256
tls.chain@172.66.147.243:443,0,fingerprint_sha256,85:CA:6A:B0:68:E9:BC:CE:88:B6:C4:AA:3C:47:F7:D1:72:28:13:4A:45:7F:87:0D:38:00:E6:22:3A:0D:F0:7A
tls.chain@172.66.147.243:443,0,fingerprint_sha1,89:9C:B2:59:E7:DE:8D:F1:00:33:A2:AF:48:C2:2C:2F:65:80:A2:1D
tls.chain@172.66.147.243:443,0,serial,01:EE:E6:AA:BB:52:1D:5E:14:FC:31:5F:D9:98:56:90
tls.chain@172.66.147.243:443,0,policy,DV
tls.chain@172.66.147.243:443,0,self_signed,false
tls.chain@172.66.147.243:443,0,expired,false
tls.chain@172.66.147.243:443,0,ocsp_url,http://o.cf-i.ssl.com
tls.chain@172.66.147.243:443,0,ca_issuers_url,http://i.cf-i.ssl.com/Cloudflare-TLS-I-E3.cer
tls.chain@172.66.147.243:443,1,position,intermediate
tls.chain@172.66.147.243:443,1,subject,"C=US, O=SSL Corporation, CN=Cloudflare TLS Issuing ECC CA 3"
tls.chain@172.66.147.243:443,1,issuer,"C=US, O=SSL Corporation, CN=SSL.com TLS Transit ECC CA R2"
tls.chain@172.66.147.243:443,1,not_before,2025-05-29T19:49:45Z
tls.chain@172.66.147.243:443,1,not_after,2035-05-27T19:49:44Z
tls.chain@172.66.147.243:443,1,days_remaining,3123
tls.chain@172.66.147.243:443,1,key,ECDSA P-256 256
tls.chain@172.66.147.243:443,1,signature_algorithm,ecdsa-with-SHA384
tls.chain@172.66.147.243:443,1,fingerprint_sha256,F1:5F:29:AB:EF:73:AA:4D:D9:AB:75:4B:AE:AE:36:85:BD:D3:87:4B:46:B5:25:07:11:77:62:86:85:71:80:26
tls.chain@172.66.147.243:443,1,fingerprint_sha1,AE:80:1E:D1:C5:5B:B5:79:D7:92:08:B0:D7:72:AC:FB:8C:C3:A2:08
tls.chain@172.66.147.243:443,1,serial,31:EE:E8:8A:FB:87:CD:9E:F8:33:66:04:74:3F:9B:27
tls.chain@172.66.147.243:443,1,policy,OV
tls.chain@172.66.147.243:443,1,self_signed,false
tls.chain@172.66.147.243:443,1,expired,false
tls.chain@172.66.147.243:443,1,ca_issuers_url,http://cert.ssl.com/SSL.com-TLS-T-ECC-R2.cer
tls.chain@172.66.147.243:443,2,position,intermediate
tls.chain@172.66.147.243:443,2,subject,"C=US, O=SSL Corporation, CN=SSL.com TLS Transit ECC CA R2"
tls.chain@172.66.147.243:443,2,issuer,"C=US, O=SSL Corporation, CN=SSL.com TLS ECC Root CA 2022"
tls.chain@172.66.147.243:443,2,not_before,2022-10-21T17:02:23Z
tls.chain@172.66.147.243:443,2,not_after,2037-10-17T17:02:22Z
tls.chain@172.66.147.243:443,2,days_remaining,3997
tls.chain@172.66.147.243:443,2,key,ECDSA P-384 384
tls.chain@172.66.147.243:443,2,signature_algorithm,ecdsa-with-SHA384
tls.chain@172.66.147.243:443,2,fingerprint_sha256,5D:1B:C3:99:27:4E:64:9E:1C:72:69:7D:E9:1A:54:AD:72:50:88:C5:22:1C:B6:1E:17:EE:9C:29:0B:C4:2A:92
tls.chain@172.66.147.243:443,2,fingerprint_sha1,E1:51:88:4D:AE:92:4B:08:EF:26:46:01:21:D7:79:06:D5:D1:8A:C8
tls.chain@172.66.147.243:443,2,serial,60:4D:8A:F8:D0:0B:A8:74:8B:95:58:53:17:2C:5F:2E
tls.chain@172.66.147.243:443,2,policy,OV
tls.chain@172.66.147.243:443,2,self_signed,false
tls.chain@172.66.147.243:443,2,expired,false
tls.chain@172.66.147.243:443,2,ca_issuers_url,http://cert.ssl.com/SSLcom-TLS-Root-2022-ECC.cer
tls.chain@172.66.147.243:443,3,position,intermediate
tls.chain@172.66.147.243:443,3,subject,"C=US, O=SSL Corporation, CN=SSL.com TLS ECC Root CA 2022"
tls.chain@172.66.147.243:443,3,issuer,"C=GB, ST=Greater Manchester, L=Salford, O=Comodo CA Limited, CN=AAA Certificate Services"
tls.chain@172.66.147.243:443,3,not_before,2025-08-01T00:00:00Z
tls.chain@172.66.147.243:443,3,not_after,2028-12-31T23:59:59Z
tls.chain@172.66.147.243:443,3,days_remaining,786
tls.chain@172.66.147.243:443,3,key,ECDSA P-384 384
tls.chain@172.66.147.243:443,3,signature_algorithm,sha256WithRSAEncryption
tls.chain@172.66.147.243:443,3,fingerprint_sha256,BA:06:D3:D3:E3:48:FC:E7:47:8C:C8:4B:42:2D:0E:63:8E:9E:22:1E:F1:A0:B5:3A:DC:14:CC:70:E0:4B:8A:B8
tls.chain@172.66.147.243:443,3,fingerprint_sha1,5C:85:D2:01:CA:68:B3:9F:CC:D2:4A:89:27:35:9E:F2:95:AF:83:DC
tls.chain@172.66.147.243:443,3,serial,17:3D:CA:60:EA:9F:8E:10:26:DA:FC:D7:28:10:E4:8E
tls.chain@172.66.147.243:443,3,policy,EV
tls.chain@172.66.147.243:443,3,self_signed,false
tls.chain@172.66.147.243:443,3,expired,false
tls.chain@172.66.147.243:443,3,ocsp_url,http://ocsp.comodoca.com
tls.handshake@172.66.147.243:443,,version,TLSv1.3
tls.handshake@172.66.147.243:443,,cipher_suite,TLS13_AES_256_GCM_SHA384
tls.handshake@172.66.147.243:443,,key_exchange_group,X25519
tls.handshake@172.66.147.243:443,,sni,example.com
tls.handshake@172.66.147.243:443,,ocsp_stapled,true
tls.handshake@172.66.147.243:443,,ocsp_status,good
tls.handshake@172.66.147.243:443,,ocsp_this_update,2026-11-02T19:22:00Z
tls.handshake@172.66.147.243:443,,ocsp_next_update,2026-11-09T19:22:00Z
tls.handshake@172.66.147.243:443,,ocsp_live_status,good
tls.handshake@172.66.147.243:443,,ech,false
tls.handshake@172.66.147.243:443,,handshake_ms,21 ms
tls.chain@104.20.23.154:443,0,position,leaf
tls.chain@104.20.23.154:443,0,subject,CN=example.com
tls.chain@104.20.23.154:443,0,issuer,"C=US, O=SSL Corporation, CN=Cloudflare TLS Issuing ECC CA 3"
tls.chain@104.20.23.154:443,0,sans,example.com
tls.chain@104.20.23.154:443,0,sans,*.example.com
tls.chain@104.20.23.154:443,0,not_before,2026-09-26T22:49:11Z
tls.chain@104.20.23.154:443,0,not_after,2026-12-25T22:56:35Z
tls.chain@104.20.23.154:443,0,days_remaining,49
tls.chain@104.20.23.154:443,0,key,ECDSA P-256 256
tls.chain@104.20.23.154:443,0,signature_algorithm,ecdsa-with-SHA256
tls.chain@104.20.23.154:443,0,fingerprint_sha256,85:CA:6A:B0:68:E9:BC:CE:88:B6:C4:AA:3C:47:F7:D1:72:28:13:4A:45:7F:87:0D:38:00:E6:22:3A:0D:F0:7A
tls.chain@104.20.23.154:443,0,fingerprint_sha1,89:9C:B2:59:E7:DE:8D:F1:00:33:A2:AF:48:C2:2C:2F:65:80:A2:1D
tls.chain@104.20.23.154:443,0,serial,01:EE:E6:AA:BB:52:1D:5E:14:FC:31:5F:D9:98:56:90
tls.chain@104.20.23.154:443,0,policy,DV
tls.chain@104.20.23.154:443,0,self_signed,false
tls.chain@104.20.23.154:443,0,expired,false
tls.chain@104.20.23.154:443,0,ocsp_url,http://o.cf-i.ssl.com
tls.chain@104.20.23.154:443,0,ca_issuers_url,http://i.cf-i.ssl.com/Cloudflare-TLS-I-E3.cer
tls.chain@104.20.23.154:443,1,position,intermediate
tls.chain@104.20.23.154:443,1,subject,"C=US, O=SSL Corporation, CN=Cloudflare TLS Issuing ECC CA 3"
tls.chain@104.20.23.154:443,1,issuer,"C=US, O=SSL Corporation, CN=SSL.com TLS Transit ECC CA R2"
tls.chain@104.20.23.154:443,1,not_before,2025-05-29T19:49:45Z
tls.chain@104.20.23.154:443,1,not_after,2035-05-27T19:49:44Z
tls.chain@104.20.23.154:443,1,days_remaining,3123
tls.chain@104.20.23.154:443,1,key,ECDSA P-256 256
tls.chain@104.20.23.154:443,1,signature_algorithm,ecdsa-with-SHA384
tls.chain@104.20.23.154:443,1,fingerprint_sha256,F1:5F:29:AB:EF:73:AA:4D:D9:AB:75:4B:AE:AE:36:85:BD:D3:87:4B:46:B5:25:07:11:77:62:86:85:71:80:26
tls.chain@104.20.23.154:443,1,fingerprint_sha1,AE:80:1E:D1:C5:5B:B5:79:D7:92:08:B0:D7:72:AC:FB:8C:C3:A2:08
tls.chain@104.20.23.154:443,1,serial,31:EE:E8:8A:FB:87:CD:9E:F8:33:66:04:74:3F:9B:27
tls.chain@104.20.23.154:443,1,policy,OV
tls.chain@104.20.23.154:443,1,self_signed,false
tls.chain@104.20.23.154:443,1,expired,false
tls.chain@104.20.23.154:443,1,ca_issuers_url,http://cert.ssl.com/SSL.com-TLS-T-ECC-R2.cer
tls.chain@104.20.23.154:443,2,position,intermediate
tls.chain@104.20.23.154:443,2,subject,"C=US, O=SSL Corporation, CN=SSL.com TLS Transit ECC CA R2"
tls.chain@104.20.23.154:443,2,issuer,"C=US, O=SSL Corporation, CN=SSL.com TLS ECC Root CA 2022"
tls.chain@104.20.23.154:443,2,not_before,2022-10-21T17:02:23Z
tls.chain@104.20.23.154:443,2,not_after,2037-10-17T17:02:22Z
tls.chain@104.20.23.154:443,2,days_remaining,3997
tls.chain@104.20.23.154:443,2,key,ECDSA P-384 384
tls.chain@104.20.23.154:443,2,signature_algorithm,ecdsa-with-SHA384
tls.chain@104.20.23.154:443,2,fingerprint_sha256,5D:1B:C3:99:27:4E:64:9E:1C:72:69:7D:E9:1A:54:AD:72:50:88:C5:22:1C:B6:1E:17:EE:9C:29:0B:C4:2A:92
tls.chain@104.20.23.154:443,2,fingerprint_sha1,E1:51:88:4D:AE:92:4B:08:EF:26:46:01:21:D7:79:06:D5:D1:8A:C8
tls.chain@104.20.23.154:443,2,serial,60:4D:8A:F8:D0:0B:A8:74:8B:95:58:53:17:2C:5F:2E
tls.chain@104.20.23.154:443,2,policy,OV
tls.chain@104.20.23.154:443,2,self_signed,false
tls.chain@104.20.23.154:443,2,expired,false
tls.chain@104.20.23.154:443,2,ca_issuers_url,http://cert.ssl.com/SSLcom-TLS-Root-2022-ECC.cer
tls.chain@104.20.23.154:443,3,position,intermediate
tls.chain@104.20.23.154:443,3,subject,"C=US, O=SSL Corporation, CN=SSL.com TLS ECC Root CA 2022"
tls.chain@104.20.23.154:443,3,issuer,"C=GB, ST=Greater Manchester, L=Salford, O=Comodo CA Limited, CN=AAA Certificate Services"
tls.chain@104.20.23.154:443,3,not_before,2025-08-01T00:00:00Z
tls.chain@104.20.23.154:443,3,not_after,2028-12-31T23:59:59Z
tls.chain@104.20.23.154:443,3,days_remaining,786
tls.chain@104.20.23.154:443,3,key,ECDSA P-384 384
tls.chain@104.20.23.154:443,3,signature_algorithm,sha256WithRSAEncryption
tls.chain@104.20.23.154:443,3,fingerprint_sha256,BA:06:D3:D3:E3:48:FC:E7:47:8C:C8:4B:42:2D:0E:63:8E:9E:22:1E:F1:A0:B5:3A:DC:14:CC:70:E0:4B:8A:B8
tls.chain@104.20.23.154:443,3,fingerprint_sha1,5C:85:D2:01:CA:68:B3:9F:CC:D2:4A:89:27:35:9E:F2:95:AF:83:DC
tls.chain@104.20.23.154:443,3,serial,17:3D:CA:60:EA:9F:8E:10:26:DA:FC:D7:28:10:E4:8E
tls.chain@104.20.23.154:443,3,policy,EV
tls.chain@104.20.23.154:443,3,self_signed,false
tls.chain@104.20.23.154:443,3,expired,false
tls.chain@104.20.23.154:443,3,ocsp_url,http://ocsp.comodoca.com
tls.handshake@104.20.23.154:443,,version,TLSv1.3
tls.handshake@104.20.23.154:443,,cipher_suite,TLS13_AES_256_GCM_SHA384
tls.handshake@104.20.23.154:443,,key_exchange_group,X25519
tls.handshake@104.20.23.154:443,,sni,example.com
tls.handshake@104.20.23.154:443,,ocsp_stapled,true
tls.handshake@104.20.23.154:443,,ocsp_status,good
tls.handshake@104.20.23.154:443,,ocsp_this_update,2026-11-02T19:22:00Z
tls.handshake@104.20.23.154:443,,ocsp_next_update,2026-11-09T19:22:00Z
tls.handshake@104.20.23.154:443,,ocsp_live_status,good
tls.handshake@104.20.23.154:443,,ech,false
tls.handshake@104.20.23.154:443,,handshake_ms,6 ms
tls.probes@172.66.147.243:443,,ssl3,disabled
tls.probes@172.66.147.243:443,,ssl3_answer,alert handshake_failure
tls.probes@172.66.147.243:443,,tls1_0,enabled
tls.probes@172.66.147.243:443,,tls1_0_answer,server_hello TLSv1.0 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
tls.probes@172.66.147.243:443,,tls1_1,enabled
tls.probes@172.66.147.243:443,,tls1_1_answer,server_hello TLSv1.1 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
tls.probes@172.66.147.243:443,,tls1_2,enabled
tls.probes@172.66.147.243:443,,tls1_2_answer,server_hello TLSv1.2 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
tls.probes@172.66.147.243:443,,tls1_3,enabled
tls.probes@172.66.147.243:443,,tls1_3_answer,handshake TLSv1.3
tls.probes@172.66.147.243:443,,suites_insecure,refused
tls.probes@172.66.147.243:443,,suites_insecure_answer,alert handshake_failure
tls.probes@172.66.147.243:443,,suites_cbc,accepted
tls.probes@172.66.147.243:443,,suites_cbc_answer,server_hello TLSv1.2 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
tls.probes@172.66.147.243:443,,suites_static_rsa,accepted
tls.probes@172.66.147.243:443,,suites_static_rsa_answer,server_hello TLSv1.2 TLS_RSA_WITH_AES_128_GCM_SHA256
tls.protocols,,ssl3,disabled
tls.protocols,,tls1_0,enabled
tls.protocols,,tls1_1,enabled
tls.protocols,,tls1_2,enabled
tls.protocols,,tls1_3,enabled
tls.protocols,,suites_insecure,refused
tls.protocols,,suites_cbc,accepted
tls.protocols,,suites_static_rsa,accepted
tls.protocols,,forward_secrecy_all_suites,false
tls.ct,172.66.147.243,address,172.66.147.243
tls.ct,172.66.147.243,sct_count,2
tls.ct,172.66.147.243,log_ids,"944e4387faecc1ef81f3192426a8186501c7d35f3802013f72677d55372e19d8, cb38f715897c84a1445f5bc1ddfbc96ef29a59cd470a690585b0cb14c31458e7"
tls.ct,104.20.23.154,address,104.20.23.154
tls.ct,104.20.23.154,sct_count,2
tls.ct,104.20.23.154,log_ids,"944e4387faecc1ef81f3192426a8186501c7d35f3802013f72677d55372e19d8, cb38f715897c84a1445f5bc1ddfbc96ef29a59cd470a690585b0cb14c31458e7"
{"id":"gDO79E9Z","domain":"example.com","created_at":1793994940,"last_seen_at":1793994940,"predecessor_id":"CDVR1RYA","profile_version":5,"grade":"B","engine_version":"0.31.0","run":{"profile_version":5,"engine_version":"0.31.0","evidence_schema_version":1,"grade":"B","complete":true,"sections":[{"protocol":"dns","outcome":"measured","reason":null},{"protocol":"email","outcome":"measured","reason":null},{"protocol":"http","outcome":"measured","reason":null},{"protocol":"ip","outcome":"measured","reason":null},{"protocol":"tls","outcome":"measured","reason":null}],"checks":[{"id":"dns.caa","status":"warn","findings":["No CAA records found: any Certificate Authority can issue certificates for this domain; cf. RFC 8659"],"evidence":["dns.caa"]},{"id":"dns.cname_apex","status":"pass","evidence":["dns.cname","dns.soa"]},{"id":"dns.dnssec","status":"pass","evidence":["dns.dnskey","dns.ds","dns.nsec","dns.nsec3"]},{"id":"dns.dnskey_algorithm","status":"pass","evidence":["dns.dnskey"]},{"id":"dns.dnssec_rollover","status":"pass","evidence":["dns.dnskey","dns.ds"]},{"id":"dns.https_svcb","status":"pass","evidence":["dns.https","dns.svcb"]},{"id":"dns.ns","status":"pass","evidence":["dns.ns"]},{"id":"dns.ns_lame","status":"pass","evidence":["dns.ns"]},{"id":"dns.ns_delegation","status":"pass","evidence":["dns.ns"]},{"id":"dns.ttl","status":"pass","evidence":["dns.a","dns.aaaa","dns.mx","dns.caa","dns.ns","dns.https","dns.cname","dns.dnskey","dns.ds","dns.nsec","dns.nsec3","dns.soa","dns.svcb","dns.txt"]},{"id":"email.mx","status":"not_applicable","findings":["Null MX"]},{"id":"email.spf","status":"pass","findings":["domain declares it sends no mail (Null MX or SPF -all only)"],"evidence":["email.spf","email.mx"]},{"id":"email.dkim","status":"not_applicable","findings":["only revoked DKIM keys"]},{"id":"email.dmarc","status":"warn","findings":["no aggregate reports"],"evidence":["email.dmarc"]},{"id":"email.mta_sts","status":"not_applicable","findings":["Null MX"]},{"id":"email.tls_rpt","status":"not_applicable","findings":["Null MX"]},{"id":"email.bimi","status":"not_applicable","findings":["Null MX"]},{"id":"email.dane","status":"not_applicable","findings":["Null MX"]},{"id":"email.dnsbl","status":"not_applicable","findings":["Null MX"]},{"id":"email.fcrdns","status":"not_applicable","findings":["Null MX"]},{"id":"http.https_redirect","status":"fail","findings":["HTTP port 80 does not redirect to HTTPS"],"evidence":["http.port80","http.port80_probe"]},{"id":"http.hsts","status":"fail","findings":["No HSTS header found"],"evidence":["http.headers"]},{"id":"http.cors","status":"pass","evidence":["http.cors"]},{"id":"http.cookie_secure","status":"not_applicable","findings":["not applicable"],"evidence":["http.cookies"]},{"id":"http.csp","status":"warn","findings":["No Content-Security-Policy header"],"evidence":["http.headers"]},{"id":"http.x_frame_options","status":"warn","findings":["Missing x-frame-options header"],"evidence":["http.headers"]},{"id":"http.x_content_type_options","status":"warn","findings":["Missing x-content-type-options header"],"evidence":["http.headers"]},{"id":"http.referrer_policy","status":"warn","findings":["Missing referrer-policy header"],"evidence":["http.headers"]},{"id":"http.permissions_policy","status":"warn","findings":["Missing permissions-policy header"],"evidence":["http.headers"]},{"id":"http.coop","status":"warn","findings":["Missing cross-origin-opener-policy header"],"evidence":["http.headers","http.isolation"]},{"id":"http.deprecated_headers","status":"pass","evidence":["http.headers"]},{"id":"http.info_leakage","status":"warn","findings":["Info leakage headers: Server"],"evidence":["http.headers"]},{"id":"http.caching","status":"warn","findings":["No Cache-Control header"],"evidence":["http.headers","http.caching"]},{"id":"ip.reputation","status":"pass","evidence":["ip.addresses"]},{"id":"tls.tls_reachable","status":"pass","evidence":["tls.addresses"]},{"id":"tls.chain_trusted","status":"pass","evidence":["tls.chain@172.66.147.243:443","tls.chain@104.20.23.154:443"]},{"id":"tls.not_expired","status":"pass","evidence":["tls.chain@172.66.147.243:443","tls.chain@104.20.23.154:443"]},{"id":"tls.hostname_match","status":"pass","evidence":["tls.chain@172.66.147.243:443","tls.chain@104.20.23.154:443"]},{"id":"tls.chain_complete","status":"pass","evidence":["tls.chain@172.66.147.243:443","tls.chain@104.20.23.154:443"]},{"id":"tls.strong_signature","status":"pass","evidence":["tls.chain@172.66.147.243:443","tls.chain@104.20.23.154:443"]},{"id":"tls.key_strength","status":"pass","evidence":["tls.chain@172.66.147.243:443","tls.chain@104.20.23.154:443"]},{"id":"tls.expiry_window","status":"pass","evidence":["tls.chain@172.66.147.243:443","tls.chain@104.20.23.154:443"]},{"id":"tls.cert_lifetime","status":"pass","evidence":["tls.chain@172.66.147.243:443","tls.chain@104.20.23.154:443"]},{"id":"tls.san_quality","status":"pass","evidence":["tls.chain@172.66.147.243:443","tls.chain@104.20.23.154:443"]},{"id":"tls.aia_reachability","status":"not_applicable","findings":["Chain is complete; AIA URLs not required for verification"],"evidence":["tls.chain@172.66.147.243:443","tls.chain@104.20.23.154:443"]},{"id":"tls.tls_version","status":"pass","evidence":["tls.handshake@172.66.147.243:443","tls.handshake@104.20.23.154:443"]},{"id":"tls.forward_secrecy","status":"pass","evidence":["tls.handshake@172.66.147.243:443","tls.handshake@104.20.23.154:443"]},{"id":"tls.aead_cipher","status":"pass","evidence":["tls.handshake@172.66.147.243:443","tls.handshake@104.20.23.154:443"]},{"id":"tls.legacy_versions","status":"fail","findings":["172.66.147.243: accepts TLS 1.0, TLS 1.1"],"evidence":["tls.probes@172.66.147.243:443","tls.protocols"]},{"id":"tls.weak_suites","status":"warn","findings":["172.66.147.243: accepts CBC suite TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA","172.66.147.243: accepts static RSA suite TLS_RSA_WITH_AES_128_GCM_SHA256"],"evidence":["tls.probes@172.66.147.243:443","tls.protocols"]},{"id":"tls.ct_logged","status":"pass","evidence":["tls.ct"]},{"id":"tls.ocsp_stapled","status":"pass","evidence":["tls.handshake@172.66.147.243:443","tls.handshake@104.20.23.154:443"]},{"id":"tls.caa_compliant","status":"pass","evidence":["tls.caa"]},{"id":"tls.dane_valid","status":"not_applicable","findings":["DANE check skipped (requires DNSSEC)"],"evidence":["tls.chain@172.66.147.243:443","tls.chain@104.20.23.154:443"]},{"id":"tls.consistency","status":"pass","evidence":["tls.chain@172.66.147.243:443","tls.chain@104.20.23.154:443","tls.handshake@172.66.147.243:443","tls.handshake@104.20.23.154:443"]},{"id":"tls.alpn_consistency","status":"pass","evidence":["tls.handshake@172.66.147.243:443","tls.handshake@104.20.23.154:443"]},{"id":"tls.ech_advertised","status":"warn","findings":["172.66.147.243: ECH not advertised in HTTPS DNS record","104.20.23.154: ECH not advertised in HTTPS DNS record"],"evidence":["tls.handshake@172.66.147.243:443","tls.handshake@104.20.23.154:443","dns.https"]}],"blocks":[{"id":"dns.a","title":"A","shape":{"kind":"records","data":[{"owner":{"t":"text","v":"example.com."},"type":{"t":"text","v":"A"},"ttl":{"t":"int","v":300},"data":{"t":"text","v":"104.20.23.154"}},{"owner":{"t":"text","v":"example.com."},"type":{"t":"text","v":"A"},"ttl":{"t":"int","v":300},"data":{"t":"text","v":"172.66.147.243"}}]}},{"id":"dns.aaaa","title":"AAAA","shape":{"kind":"records","data":[{"owner":{"t":"text","v":"example.com."},"type":{"t":"text","v":"AAAA"},"ttl":{"t":"int","v":300},"data":{"t":"text","v":"2606:4700:10::6814:179a"}},{"owner":{"t":"text","v":"example.com."},"type":{"t":"text","v":"AAAA"},"ttl":{"t":"int","v":300},"data":{"t":"text","v":"2606:4700:10::ac42:93f3"}}]}},{"id":"dns.mx","title":"MX","shape":{"kind":"records","data":[{"owner":{"t":"text","v":"example.com."},"type":{"t":"text","v":"MX"},"ttl":{"t":"int","v":196},"data":{"t":"text","v":"0 ."}}]}},{"id":"dns.caa","title":"CAA","shape":{"kind":"records","data":[]}},{"id":"dns.ns","title":"NS","shape":{"kind":"records","data":[{"owner":{"t":"text","v":"example.com."},"type":{"t":"text","v":"NS"},"ttl":{"t":"int","v":21600},"data":{"t":"text","v":"elliott.ns.cloudflare.com."}},{"owner":{"t":"text","v":"example.com."},"type":{"t":"text","v":"NS"},"ttl":{"t":"int","v":21600},"data":{"t":"text","v":"hera.ns.cloudflare.com."}}]}},{"id":"dns.https","title":"HTTPS","shape":{"kind":"records","data":[{"owner":{"t":"text","v":"example.com."},"type":{"t":"text","v":"HTTPS"},"ttl":{"t":"int","v":300},"data":{"t":"text","v":"1 . alpn=h3,h2 ipv4hint=104.20.23.154,172.66.147.243 ipv6hint=2606:4700:10::6814:179a,2606:4700:10::ac42:93f3"}}]}},{"id":"dns.cname","title":"CNAME","shape":{"kind":"records","data":[]}},{"id":"dns.dnskey","title":"DNSKEY","shape":{"kind":"records","data":[{"owner":{"t":"text","v":"example.com."},"type":{"t":"text","v":"DNSKEY"},"ttl":{"t":"int","v":3505},"data":{"t":"text","v":"256 3 13 MjyZielP0GqniI1+j+wAG/3t0ImDDIlj1CxR0oobkZQHSKH2Fqx6tm2NcYu57POJ83SzCWLkqIjZHS1mh5wbaw=="}},{"owner":{"t":"text","v":"example.com."},"type":{"t":"text","v":"DNSKEY"},"ttl":{"t":"int","v":3505},"data":{"t":"text","v":"256 3 13 kxipjoIbNZDsWqEKaYaGq6fM/XThrRp1ue6AV9R/n3eWxpGCeCWJb47PEEEj/Q6VAYFW/7UFo5mXoZfxKYZa3A=="}},{"owner":{"t":"text","v":"example.com."},"type":{"t":"text","v":"DNSKEY"},"ttl":{"t":"int","v":3505},"data":{"t":"text","v":"256 3 13 oJMRESz5E4gYzS/q6XDrvU1qMPYIjCWzJaOau8XNEZeqCYKD5ar0IRd8KqXXFJkqmVfRvMGPmM1x8fGAa2XhSA=="}},{"owner":{"t":"text","v":"example.com."},"type":{"t":"text","v":"DNSKEY"},"ttl":{"t":"int","v":3505},"data":{"t":"text","v":"257 3 13 mdsswUyr3DPW132mOi8V9xESWE8jTo0dxCjjnopKl+GqJxpVXckHAeF+KkxLbxILfDLUT0rAK9iUzy1L53eKGQ=="}}]}},{"id":"dns.ds","title":"DS","shape":{"kind":"records","data":[{"owner":{"t":"text","v":"example.com."},"type":{"t":"text","v":"DS"},"ttl":{"t":"int","v":15912},"data":{"t":"text","v":"2371 13 2 C988EC423E3880EB8DD8A46FE06CA230EE23F35B578D64E78B29C3E1C83D245A"}}]}},{"id":"dns.nsec","title":"NSEC","shape":{"kind":"records","data":[{"owner":{"t":"text","v":"example.com."},"type":{"t":"text","v":"NSEC"},"ttl":{"t":"int","v":1800},"data":{"t":"text","v":"\\000.example.com. A NS SOA PTR HINFO MX TXT AAAA Unknown SRV NAPTR CERT SSHFP RRSIG NSEC DNSKEY TLSA SMIMEA Unknown CDS CDNSKEY OPENPGPKEY SVCB HTTPS Unknown CAA"}}]}},{"id":"dns.nsec3","title":"NSEC3","shape":{"kind":"records","data":[]}},{"id":"dns.soa","title":"SOA","shape":{"kind":"records","data":[{"owner":{"t":"text","v":"example.com."},"type":{"t":"text","v":"SOA"},"ttl":{"t":"int","v":581},"data":{"t":"text","v":"elliott.ns.cloudflare.com. dns.cloudflare.com. 2418004112 10000 2400 604800 1800"}}]}},{"id":"dns.svcb","title":"SVCB","shape":{"kind":"records","data":[]}},{"id":"dns.txt","title":"TXT","shape":{"kind":"records","data":[{"owner":{"t":"text","v":"example.com."},"type":{"t":"text","v":"TXT"},"ttl":{"t":"int","v":300},"data":{"t":"text","v":"\"_k2n1y4vw3qtb4skdx9e7dxt97qrmmq9\""}},{"owner":{"t":"text","v":"example.com."},"type":{"t":"text","v":"TXT"},"ttl":{"t":"int","v":300},"data":{"t":"text","v":"\"v=spf1 -all\""}}]}},{"id":"email.mx","title":"MX","shape":{"kind":"table","data":{"key":"host","columns":["host","preference"],"rows":[[{"t":"text","v":"."},{"t":"int","v":0}]]}}},{"id":"email.mx_addresses","title":"MX addresses","shape":{"kind":"table","data":{"key":"address","columns":["address","host"],"rows":[]}}},{"id":"email.spf","title":"SPF","shape":{"kind":"fields","data":[["record",{"t":"text","v":"v=spf1 -all"}],["lookup_count",{"t":"int","v":0}],["void_lookups",{"t":"int","v":0}]]}},{"id":"email.dmarc","title":"DMARC","shape":{"kind":"fields","data":[["record",{"t":"text","v":"v=DMARC1;p=reject;sp=reject;adkim=s;aspf=s"}],["p",{"t":"text","v":"reject"}],["sp",{"t":"text","v":"reject"}],["adkim",{"t":"text","v":"s"}],["aspf",{"t":"text","v":"s"}]]}},{"id":"email.mta_sts","title":"MTA-STS","shape":{"kind":"fields","data":[]}},{"id":"email.tls_rpt","title":"TLS-RPT","shape":{"kind":"fields","data":[]}},{"id":"email.bimi","title":"BIMI","shape":{"kind":"fields","data":[]}},{"id":"email.dnssec","title":"DNSSEC","shape":{"kind":"fields","data":[["dnskey_present",{"t":"bool","v":true}]]}},{"id":"email.dkim","title":"DKIM keys","shape":{"kind":"table","data":{"key":"key","columns":["key","selector","state","key_type","bits"],"rows":[[{"t":"text","v":"default#1"},{"t":"text","v":"default"},{"t":"text","v":"revoked"},{"t":"text","v":""},{"t":"text","v":""}]]}}},{"id":"email.summary","title":"Summary","shape":{"kind":"fields","data":[["grade",{"t":"text","v":"B"}]]}},{"id":"http.redirects","title":"Redirects","shape":{"kind":"chain","data":[]}},{"id":"http.port80","title":"Port 80 redirects","shape":{"kind":"chain","data":[]}},{"id":"http.port80_probe","title":"Port 80 probe","shape":{"kind":"fields","data":[["url",{"t":"text","v":"http://example.com/"}],["status_code",{"t":"int","v":200}],["redirects_to_https",{"t":"bool","v":false}]]}},{"id":"http.headers","title":"Response headers","shape":{"kind":"table","data":{"key":"name","columns":["name","value"],"rows":[[{"t":"text","v":"date"},{"t":"text","v":"Fri, 06 Nov 2026 19:55:40 GMT"}],[{"t":"text","v":"content-type"},{"t":"text","v":"text/html; charset=utf-8"}],[{"t":"text","v":"server"},{"t":"text","v":"cloudflare"}],[{"t":"text","v":"last-modified"},{"t":"text","v":"Thu, 05 Nov 2026 21:17:41 GMT"}],[{"t":"text","v":"allow"},{"t":"text","v":"GET, HEAD"}],[{"t":"text","v":"age"},{"t":"text","v":"5"}],[{"t":"text","v":"cf-cache-status"},{"t":"text","v":"HIT"}],[{"t":"text","v":"content-encoding"},{"t":"text","v":"br"}],[{"t":"text","v":"cf-ray"},{"t":"text","v":"a566a838cea43727-FRA"}],[{"t":"text","v":"alt-svc"},{"t":"text","v":"h3=\":443\"; ma=86400"}]]}}},{"id":"http.caching","title":"Caching","shape":{"kind":"fields","data":[["last_modified",{"t":"time","v":"2026-11-05T21:17:41Z"}],["age",{"t":"int","v":5}]]}},{"id":"http.cdn","title":"CDN","shape":{"kind":"fields","data":[["provider",{"t":"text","v":"Cloudflare"}],["cache_status",{"t":"text","v":"HIT"}],["indicator",{"t":"text","v":"cf-ray"}],["indicator",{"t":"text","v":"cf-cache-status"}]]}},{"id":"http.isolation","title":"Cross-origin isolation","shape":{"kind":"fields","data":[["missing",{"t":"text","v":"cross-origin-opener-policy"}],["missing",{"t":"text","v":"cross-origin-embedder-policy"}],["missing",{"t":"text","v":"cross-origin-resource-policy"}]]}},{"id":"http.server","title":"Server","shape":{"kind":"fields","data":[["final_url",{"t":"text","v":"https://example.com/"}],["status_code",{"t":"int","v":200}],["http_version",{"t":"text","v":"h2"}],["inspection_ms",{"t":"duration","v":403}],["address",{"t":"addr","v":"172.66.147.243"}],["org",{"t":"text","v":"Cloudflare, Inc."}],["network_type",{"t":"text","v":"cloud"}]]}},{"id":"http.cors","title":"CORS","shape":{"kind":"fields","data":[["allows_any_origin",{"t":"bool","v":false}],["reflects_origin",{"t":"bool","v":false}],["allows_credentials",{"t":"bool","v":false}]]}},{"id":"http.cookies","title":"Cookies","shape":{"kind":"table","data":{"key":"cookie","columns":["cookie","name","secure","http_only","same_site"],"rows":[]}}},{"id":"ip.addresses","title":"Addresses","shape":{"kind":"table","data":{"key":"address","columns":["address","asn","org","prefix","network_type","country","city","spamhaus","c2","tor","vpn"],"rows":[[{"t":"addr","v":"104.20.23.154"},{"t":"text","v":"AS13335"},{"t":"text","v":"Cloudflare, Inc."},{"t":"text","v":"104.20.0.0/18"},{"t":"text","v":"cloud"},{"t":"text","v":""},{"t":"text","v":""},{"t":"bool","v":false},{"t":"bool","v":false},{"t":"bool","v":false},{"t":"bool","v":false}],[{"t":"addr","v":"172.66.147.243"},{"t":"text","v":"AS13335"},{"t":"text","v":"Cloudflare, Inc."},{"t":"text","v":"172.66.128.0/19"},{"t":"text","v":"cloud"},{"t":"text","v":""},{"t":"text","v":""},{"t":"bool","v":false},{"t":"bool","v":false},{"t":"bool","v":false},{"t":"bool","v":false}],[{"t":"addr","v":"2606:4700:10::6814:179a"},{"t":"text","v":"AS13335"},{"t":"text","v":"Cloudflare, Inc."},{"t":"text","v":"2606:4700::/43"},{"t":"text","v":"cloud"},{"t":"text","v":""},{"t":"text","v":""},{"t":"bool","v":false},{"t":"bool","v":false},{"t":"bool","v":false},{"t":"bool","v":false}],[{"t":"addr","v":"2606:4700:10::ac42:93f3"},{"t":"text","v":"AS13335"},{"t":"text","v":"Cloudflare, Inc."},{"t":"text","v":"2606:4700::/43"},{"t":"text","v":"cloud"},{"t":"text","v":""},{"t":"text","v":""},{"t":"bool","v":false},{"t":"bool","v":false},{"t":"bool","v":false},{"t":"bool","v":false}]]}}},{"id":"tls.addresses","title":"Addresses","shape":{"kind":"table","data":{"key":"address","columns":["address","port","outcome","message"],"rows":[[{"t":"addr","v":"172.66.147.243"},{"t":"int","v":443},{"t":"text","v":"ok"},{"t":"text","v":""}],[{"t":"addr","v":"2606:4700:10::ac42:93f3"},{"t":"int","v":443},{"t":"text","v":"NOT_TESTED_FROM_HERE"},{"t":"text","v":"Network unreachable (os error 101)"}],[{"t":"addr","v":"104.20.23.154"},{"t":"int","v":443},{"t":"text","v":"ok"},{"t":"text","v":""}]]}}},{"id":"tls.chain@172.66.147.243:443","title":"Certificate chain 172.66.147.243:443","shape":{"kind":"chain","data":[[["position",{"t":"text","v":"leaf"}],["subject",{"t":"text","v":"CN=example.com"}],["issuer",{"t":"text","v":"C=US, O=SSL Corporation, CN=Cloudflare TLS Issuing ECC CA 3"}],["sans",{"t":"text","v":"example.com"}],["sans",{"t":"text","v":"*.example.com"}],["not_before",{"t":"time","v":"2026-09-26T22:49:11Z"}],["not_after",{"t":"time","v":"2026-12-25T22:56:35Z"}],["days_remaining",{"t":"int","v":49}],["key",{"t":"text","v":"ECDSA P-256 256"}],["signature_algorithm",{"t":"text","v":"ecdsa-with-SHA256"}],["fingerprint_sha256",{"t":"text","v":"85:CA:6A:B0:68:E9:BC:CE:88:B6:C4:AA:3C:47:F7:D1:72:28:13:4A:45:7F:87:0D:38:00:E6:22:3A:0D:F0:7A"}],["fingerprint_sha1",{"t":"text","v":"89:9C:B2:59:E7:DE:8D:F1:00:33:A2:AF:48:C2:2C:2F:65:80:A2:1D"}],["serial",{"t":"text","v":"01:EE:E6:AA:BB:52:1D:5E:14:FC:31:5F:D9:98:56:90"}],["policy",{"t":"text","v":"DV"}],["self_signed",{"t":"bool","v":false}],["expired",{"t":"bool","v":false}],["ocsp_url",{"t":"text","v":"http://o.cf-i.ssl.com"}],["ca_issuers_url",{"t":"text","v":"http://i.cf-i.ssl.com/Cloudflare-TLS-I-E3.cer"}]],[["position",{"t":"text","v":"intermediate"}],["subject",{"t":"text","v":"C=US, O=SSL Corporation, CN=Cloudflare TLS Issuing ECC CA 3"}],["issuer",{"t":"text","v":"C=US, O=SSL Corporation, CN=SSL.com TLS Transit ECC CA R2"}],["not_before",{"t":"time","v":"2025-05-29T19:49:45Z"}],["not_after",{"t":"time","v":"2035-05-27T19:49:44Z"}],["days_remaining",{"t":"int","v":3123}],["key",{"t":"text","v":"ECDSA P-256 256"}],["signature_algorithm",{"t":"text","v":"ecdsa-with-SHA384"}],["fingerprint_sha256",{"t":"text","v":"F1:5F:29:AB:EF:73:AA:4D:D9:AB:75:4B:AE:AE:36:85:BD:D3:87:4B:46:B5:25:07:11:77:62:86:85:71:80:26"}],["fingerprint_sha1",{"t":"text","v":"AE:80:1E:D1:C5:5B:B5:79:D7:92:08:B0:D7:72:AC:FB:8C:C3:A2:08"}],["serial",{"t":"text","v":"31:EE:E8:8A:FB:87:CD:9E:F8:33:66:04:74:3F:9B:27"}],["policy",{"t":"text","v":"OV"}],["self_signed",{"t":"bool","v":false}],["expired",{"t":"bool","v":false}],["ca_issuers_url",{"t":"text","v":"http://cert.ssl.com/SSL.com-TLS-T-ECC-R2.cer"}]],[["position",{"t":"text","v":"intermediate"}],["subject",{"t":"text","v":"C=US, O=SSL Corporation, CN=SSL.com TLS Transit ECC CA R2"}],["issuer",{"t":"text","v":"C=US, O=SSL Corporation, CN=SSL.com TLS ECC Root CA 2022"}],["not_before",{"t":"time","v":"2022-10-21T17:02:23Z"}],["not_after",{"t":"time","v":"2037-10-17T17:02:22Z"}],["days_remaining",{"t":"int","v":3997}],["key",{"t":"text","v":"ECDSA P-384 384"}],["signature_algorithm",{"t":"text","v":"ecdsa-with-SHA384"}],["fingerprint_sha256",{"t":"text","v":"5D:1B:C3:99:27:4E:64:9E:1C:72:69:7D:E9:1A:54:AD:72:50:88:C5:22:1C:B6:1E:17:EE:9C:29:0B:C4:2A:92"}],["fingerprint_sha1",{"t":"text","v":"E1:51:88:4D:AE:92:4B:08:EF:26:46:01:21:D7:79:06:D5:D1:8A:C8"}],["serial",{"t":"text","v":"60:4D:8A:F8:D0:0B:A8:74:8B:95:58:53:17:2C:5F:2E"}],["policy",{"t":"text","v":"OV"}],["self_signed",{"t":"bool","v":false}],["expired",{"t":"bool","v":false}],["ca_issuers_url",{"t":"text","v":"http://cert.ssl.com/SSLcom-TLS-Root-2022-ECC.cer"}]],[["position",{"t":"text","v":"intermediate"}],["subject",{"t":"text","v":"C=US, O=SSL Corporation, CN=SSL.com TLS ECC Root CA 2022"}],["issuer",{"t":"text","v":"C=GB, ST=Greater Manchester, L=Salford, O=Comodo CA Limited, CN=AAA Certificate Services"}],["not_before",{"t":"time","v":"2025-08-01T00:00:00Z"}],["not_after",{"t":"time","v":"2028-12-31T23:59:59Z"}],["days_remaining",{"t":"int","v":786}],["key",{"t":"text","v":"ECDSA P-384 384"}],["signature_algorithm",{"t":"text","v":"sha256WithRSAEncryption"}],["fingerprint_sha256",{"t":"text","v":"BA:06:D3:D3:E3:48:FC:E7:47:8C:C8:4B:42:2D:0E:63:8E:9E:22:1E:F1:A0:B5:3A:DC:14:CC:70:E0:4B:8A:B8"}],["fingerprint_sha1",{"t":"text","v":"5C:85:D2:01:CA:68:B3:9F:CC:D2:4A:89:27:35:9E:F2:95:AF:83:DC"}],["serial",{"t":"text","v":"17:3D:CA:60:EA:9F:8E:10:26:DA:FC:D7:28:10:E4:8E"}],["policy",{"t":"text","v":"EV"}],["self_signed",{"t":"bool","v":false}],["expired",{"t":"bool","v":false}],["ocsp_url",{"t":"text","v":"http://ocsp.comodoca.com"}]]]}},{"id":"tls.handshake@172.66.147.243:443","title":"Handshake 172.66.147.243:443","shape":{"kind":"fields","data":[["version",{"t":"text","v":"TLSv1.3"}],["cipher_suite",{"t":"text","v":"TLS13_AES_256_GCM_SHA384"}],["key_exchange_group",{"t":"text","v":"X25519"}],["sni",{"t":"text","v":"example.com"}],["ocsp_stapled",{"t":"bool","v":true}],["ocsp_status",{"t":"text","v":"good"}],["ocsp_this_update",{"t":"time","v":"2026-11-02T19:22:00Z"}],["ocsp_next_update",{"t":"time","v":"2026-11-09T19:22:00Z"}],["ocsp_live_status",{"t":"text","v":"good"}],["ech",{"t":"bool","v":false}],["handshake_ms",{"t":"duration","v":21}]]}},{"id":"tls.chain@104.20.23.154:443","title":"Certificate chain 104.20.23.154:443","shape":{"kind":"chain","data":[[["position",{"t":"text","v":"leaf"}],["subject",{"t":"text","v":"CN=example.com"}],["issuer",{"t":"text","v":"C=US, O=SSL Corporation, CN=Cloudflare TLS Issuing ECC CA 3"}],["sans",{"t":"text","v":"example.com"}],["sans",{"t":"text","v":"*.example.com"}],["not_before",{"t":"time","v":"2026-09-26T22:49:11Z"}],["not_after",{"t":"time","v":"2026-12-25T22:56:35Z"}],["days_remaining",{"t":"int","v":49}],["key",{"t":"text","v":"ECDSA P-256 256"}],["signature_algorithm",{"t":"text","v":"ecdsa-with-SHA256"}],["fingerprint_sha256",{"t":"text","v":"85:CA:6A:B0:68:E9:BC:CE:88:B6:C4:AA:3C:47:F7:D1:72:28:13:4A:45:7F:87:0D:38:00:E6:22:3A:0D:F0:7A"}],["fingerprint_sha1",{"t":"text","v":"89:9C:B2:59:E7:DE:8D:F1:00:33:A2:AF:48:C2:2C:2F:65:80:A2:1D"}],["serial",{"t":"text","v":"01:EE:E6:AA:BB:52:1D:5E:14:FC:31:5F:D9:98:56:90"}],["policy",{"t":"text","v":"DV"}],["self_signed",{"t":"bool","v":false}],["expired",{"t":"bool","v":false}],["ocsp_url",{"t":"text","v":"http://o.cf-i.ssl.com"}],["ca_issuers_url",{"t":"text","v":"http://i.cf-i.ssl.com/Cloudflare-TLS-I-E3.cer"}]],[["position",{"t":"text","v":"intermediate"}],["subject",{"t":"text","v":"C=US, O=SSL Corporation, CN=Cloudflare TLS Issuing ECC CA 3"}],["issuer",{"t":"text","v":"C=US, O=SSL Corporation, CN=SSL.com TLS Transit ECC CA R2"}],["not_before",{"t":"time","v":"2025-05-29T19:49:45Z"}],["not_after",{"t":"time","v":"2035-05-27T19:49:44Z"}],["days_remaining",{"t":"int","v":3123}],["key",{"t":"text","v":"ECDSA P-256 256"}],["signature_algorithm",{"t":"text","v":"ecdsa-with-SHA384"}],["fingerprint_sha256",{"t":"text","v":"F1:5F:29:AB:EF:73:AA:4D:D9:AB:75:4B:AE:AE:36:85:BD:D3:87:4B:46:B5:25:07:11:77:62:86:85:71:80:26"}],["fingerprint_sha1",{"t":"text","v":"AE:80:1E:D1:C5:5B:B5:79:D7:92:08:B0:D7:72:AC:FB:8C:C3:A2:08"}],["serial",{"t":"text","v":"31:EE:E8:8A:FB:87:CD:9E:F8:33:66:04:74:3F:9B:27"}],["policy",{"t":"text","v":"OV"}],["self_signed",{"t":"bool","v":false}],["expired",{"t":"bool","v":false}],["ca_issuers_url",{"t":"text","v":"http://cert.ssl.com/SSL.com-TLS-T-ECC-R2.cer"}]],[["position",{"t":"text","v":"intermediate"}],["subject",{"t":"text","v":"C=US, O=SSL Corporation, CN=SSL.com TLS Transit ECC CA R2"}],["issuer",{"t":"text","v":"C=US, O=SSL Corporation, CN=SSL.com TLS ECC Root CA 2022"}],["not_before",{"t":"time","v":"2022-10-21T17:02:23Z"}],["not_after",{"t":"time","v":"2037-10-17T17:02:22Z"}],["days_remaining",{"t":"int","v":3997}],["key",{"t":"text","v":"ECDSA P-384 384"}],["signature_algorithm",{"t":"text","v":"ecdsa-with-SHA384"}],["fingerprint_sha256",{"t":"text","v":"5D:1B:C3:99:27:4E:64:9E:1C:72:69:7D:E9:1A:54:AD:72:50:88:C5:22:1C:B6:1E:17:EE:9C:29:0B:C4:2A:92"}],["fingerprint_sha1",{"t":"text","v":"E1:51:88:4D:AE:92:4B:08:EF:26:46:01:21:D7:79:06:D5:D1:8A:C8"}],["serial",{"t":"text","v":"60:4D:8A:F8:D0:0B:A8:74:8B:95:58:53:17:2C:5F:2E"}],["policy",{"t":"text","v":"OV"}],["self_signed",{"t":"bool","v":false}],["expired",{"t":"bool","v":false}],["ca_issuers_url",{"t":"text","v":"http://cert.ssl.com/SSLcom-TLS-Root-2022-ECC.cer"}]],[["position",{"t":"text","v":"intermediate"}],["subject",{"t":"text","v":"C=US, O=SSL Corporation, CN=SSL.com TLS ECC Root CA 2022"}],["issuer",{"t":"text","v":"C=GB, ST=Greater Manchester, L=Salford, O=Comodo CA Limited, CN=AAA Certificate Services"}],["not_before",{"t":"time","v":"2025-08-01T00:00:00Z"}],["not_after",{"t":"time","v":"2028-12-31T23:59:59Z"}],["days_remaining",{"t":"int","v":786}],["key",{"t":"text","v":"ECDSA P-384 384"}],["signature_algorithm",{"t":"text","v":"sha256WithRSAEncryption"}],["fingerprint_sha256",{"t":"text","v":"BA:06:D3:D3:E3:48:FC:E7:47:8C:C8:4B:42:2D:0E:63:8E:9E:22:1E:F1:A0:B5:3A:DC:14:CC:70:E0:4B:8A:B8"}],["fingerprint_sha1",{"t":"text","v":"5C:85:D2:01:CA:68:B3:9F:CC:D2:4A:89:27:35:9E:F2:95:AF:83:DC"}],["serial",{"t":"text","v":"17:3D:CA:60:EA:9F:8E:10:26:DA:FC:D7:28:10:E4:8E"}],["policy",{"t":"text","v":"EV"}],["self_signed",{"t":"bool","v":false}],["expired",{"t":"bool","v":false}],["ocsp_url",{"t":"text","v":"http://ocsp.comodoca.com"}]]]}},{"id":"tls.handshake@104.20.23.154:443","title":"Handshake 104.20.23.154:443","shape":{"kind":"fields","data":[["version",{"t":"text","v":"TLSv1.3"}],["cipher_suite",{"t":"text","v":"TLS13_AES_256_GCM_SHA384"}],["key_exchange_group",{"t":"text","v":"X25519"}],["sni",{"t":"text","v":"example.com"}],["ocsp_stapled",{"t":"bool","v":true}],["ocsp_status",{"t":"text","v":"good"}],["ocsp_this_update",{"t":"time","v":"2026-11-02T19:22:00Z"}],["ocsp_next_update",{"t":"time","v":"2026-11-09T19:22:00Z"}],["ocsp_live_status",{"t":"text","v":"good"}],["ech",{"t":"bool","v":false}],["handshake_ms",{"t":"duration","v":6}]]}},{"id":"tls.probes@172.66.147.243:443","title":"Protocol probes 172.66.147.243:443","shape":{"kind":"fields","data":[["ssl3",{"t":"text","v":"disabled"}],["ssl3_answer",{"t":"text","v":"alert handshake_failure"}],["tls1_0",{"t":"text","v":"enabled"}],["tls1_0_answer",{"t":"text","v":"server_hello TLSv1.0 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA"}],["tls1_1",{"t":"text","v":"enabled"}],["tls1_1_answer",{"t":"text","v":"server_hello TLSv1.1 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA"}],["tls1_2",{"t":"text","v":"enabled"}],["tls1_2_answer",{"t":"text","v":"server_hello TLSv1.2 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"}],["tls1_3",{"t":"text","v":"enabled"}],["tls1_3_answer",{"t":"text","v":"handshake TLSv1.3"}],["suites_insecure",{"t":"text","v":"refused"}],["suites_insecure_answer",{"t":"text","v":"alert handshake_failure"}],["suites_cbc",{"t":"text","v":"accepted"}],["suites_cbc_answer",{"t":"text","v":"server_hello TLSv1.2 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA"}],["suites_static_rsa",{"t":"text","v":"accepted"}],["suites_static_rsa_answer",{"t":"text","v":"server_hello TLSv1.2 TLS_RSA_WITH_AES_128_GCM_SHA256"}]]}},{"id":"tls.protocols","title":"Protocols and features","shape":{"kind":"fields","data":[["ssl3",{"t":"text","v":"disabled"}],["tls1_0",{"t":"text","v":"enabled"}],["tls1_1",{"t":"text","v":"enabled"}],["tls1_2",{"t":"text","v":"enabled"}],["tls1_3",{"t":"text","v":"enabled"}],["suites_insecure",{"t":"text","v":"refused"}],["suites_cbc",{"t":"text","v":"accepted"}],["suites_static_rsa",{"t":"text","v":"accepted"}],["forward_secrecy_all_suites",{"t":"bool","v":false}]]}},{"id":"tls.ct","title":"Certificate Transparency","shape":{"kind":"table","data":{"key":"address","columns":["address","sct_count","log_ids"],"rows":[[{"t":"addr","v":"172.66.147.243"},{"t":"int","v":2},{"t":"text","v":"944e4387faecc1ef81f3192426a8186501c7d35f3802013f72677d55372e19d8, cb38f715897c84a1445f5bc1ddfbc96ef29a59cd470a690585b0cb14c31458e7"}],[{"t":"addr","v":"104.20.23.154"},{"t":"int","v":2},{"t":"text","v":"944e4387faecc1ef81f3192426a8186501c7d35f3802013f72677d55372e19d8, cb38f715897c84a1445f5bc1ddfbc96ef29a59cd470a690585b0cb14c31458e7"}]]}}},{"id":"tls.caa","title":"CAA","shape":{"kind":"records","data":[]}}]}}
Key records · 10 record types answered
| Type | Data | TTL |
|---|---|---|
| A | 104.20.23.154 | 300 |
| A | 172.66.147.243 | 300 |
| AAAA | 2606:4700:10::6814:179a | 300 |
| AAAA | 2606:4700:10::ac42:93f3 | 300 |
| NS | elliott.ns.cloudflare.com. | 21600 |
| NS | hera.ns.cloudflare.com. | 21600 |
| CAA | no records | |
| DS | 2371 13 2 C988EC423E3880EB8DD8A46FE06CA230EE23F35B578D64E78B29C… | 15912 |
← swipe the table
Feeds lines: DNS·01 DNSSEC · DNS·03 Rollover · DNS·04 CAA · DNS·05 NS · DNS·06 Lame NS · DNS·07 Deleg · DNS·10 TTL
Certificate chain · port 443 · 2 addresses, consistent
| # | Subject | Issuer | Key | Not after |
|---|---|---|---|---|
| 0 | example.com | Cloudflare TLS Issuing ECC CA 3 | ECDSA P-256 | 2026-12-25 |
| 1 | Cloudflare TLS Issuing ECC CA 3 | SSL.com TLS Transit ECC CA R2 | ECDSA P-256 | 2035-05-27 |
| 2 | SSL.com TLS Transit ECC CA R2 | SSL.com TLS ECC Root CA 2022 | ECDSA P-384 | 2037-10-17 |
| 3 | SSL.com TLS ECC Root CA 2022 | AAA Certificate Services | ECDSA P-384 | 2028-12-31 |
← swipe the table
Feeds lines: TLS·12 Trust · TLS·13 Expired · TLS·14 Hostname · TLS·15 Chain · TLS·16 Sig · TLS·17 Key · TLS·18 Expiry · TLS·19 Lifetime · TLS·20 SAN · TLS·21 AIA · TLS·30 DANE · TLS·31 Consist
Response · 200 · h2 · https://example.com/
| Header | Value |
|---|---|
| strict-transport-security | not sent |
| content-security-policy | not sent |
| x-frame-options | not sent |
| x-content-type-options | not sent |
| referrer-policy | not sent |
| permissions-policy | not sent |
← swipe the table
Feeds lines: HTTP·35 HSTS · HTTP·38 CSP · HTTP·39 XFO · HTTP·40 XCTO · HTTP·41 Referrer · HTTP·42 Perms · HTTP·43 COOP · HTTP·44 Legacy · HTTP·45 Leakage · HTTP·46 Caching
Mail records · 1 MX host
| Record | Value |
|---|---|
| MX | 0 . |
| SPF | v=spf1 -all |
| DMARC | v=DMARC1;p=reject;sp=reject;adkim=s;aspf=s |
| DKIM | default: revoked |
← swipe the table
Addresses · 4 addresses
| Address | ASN | Org | Country | Network | Listed |
|---|---|---|---|---|---|
| 104.20.23.154 | AS13335 | Cloudflare, Inc. | cloud | none | |
| 172.66.147.243 | AS13335 | Cloudflare, Inc. | cloud | none | |
| 2606:4700:10::6814:179a | AS13335 | Cloudflare, Inc. | cloud | none | |
| 2606:4700:10::ac42:93f3 | AS13335 | Cloudflare, Inc. | cloud | none |
← swipe the table
This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.