Turn every result into a next step.

The domain does not currently resolve to a public web server.

The site has no AAAA record. IPv6 is useful, but not required for a healthy IPv4 site.

Fewer than two authoritative nameservers were returned.

The Start of Authority record describes the DNS zone and should exist on authoritative servers.

CAA limits which certificate authorities may issue certificates for the domain.

A CNAME should not coexist with A, AAAA, MX, TXT or other data at the same DNS name.

A TTL below five minutes increases resolver traffic and is rarely needed outside a migration.

The primary web address has no PTR record.

The resolver could not authenticate this DNS answer with a DNSSEC chain of trust.

RPKI checks whether the network announcing the site address is authorised to originate its IP prefix.

The domain does not advertise a server for inbound email.

A null MX explicitly says that the domain accepts no inbound email.

Receiving systems cannot verify which services may send mail for the domain.

The SPF record does not finish with a controlled all mechanism.

The domain has no published policy for handling mail that fails aligned SPF and DKIM.

A p=none policy gathers evidence but does not ask receivers to block impersonation.

No aggregate-report destination (rua) was found in the DMARC record.

MTA-STS can require supporting mail servers to use trusted TLS when delivering email.

TLS-RPT reports failures involving encrypted mail transport.

BIMI can display a verified brand mark in supporting mail clients.

DKIM public keys live under selector names that cannot be reliably discovered by guessing.

No TLSA record was found for the primary mail exchanger.

The primary mail exchanger did not advertise opportunistic TLS to this checker.

The checker could not get a response from the public website address.

The final page returned an error or non-success response.

Visitors using an http:// link are not sent directly to the secure version.

Several redirects slow the first visit and create more failure points.

The first response exceeded the current diagnostic threshold from this test location.

Browsers are not instructed to use HTTPS automatically on future visits.

No CSP header was found to limit where executable and embedded content may load from.

The final response lacks X-Content-Type-Options: nosniff.

The site does not state how much address information browsers may send to other sites.

The response identifies part of the serving software. This is informational.

The site does not publish a valid security.txt file with a Contact field.

One or more initial-response cookies omit Secure or SameSite protection.

Cross-origin scripts or stylesheets may load without an integrity hash.

CORS and CORP control which other origins may read or embed web resources.

A remote Chromium browser could not successfully load and render the public page.

A trusted HTTPS connection could not be established for the hostname.

The current certificate has fewer than 30 days remaining.

TLS 1.2 could not be negotiated or an obsolete TLS version is still accepted.

TLS 1.3 improves connection setup and uses modern cryptography, but TLS 1.2 remains acceptable.

The server did not supply an intermediate certificate chain alongside its leaf certificate.

The negotiated connection did not demonstrate a modern-strength cipher.

Google’s current threat lists associate the submitted URL with malware, social engineering or unwanted software.

Spamhaus returned a negative reputation signal or could not authenticate the configured Intelligence credential.

One or more VirusTotal engines marked the domain as malicious or suspicious.