Skip to content
whois.me.uk
Menu
Sign in

example.com

domain Spoofing protected

Registrar RESERVED-Internet Assigned Numbers Authority · expires 13 Aug 2027 · DNS by Cloudflare · hosted by Cloudflare · HTTPS 200, certificate 58 days left · headers F · TLS 95/100

Re-run JSON PDF Watch this
15 / 100 · Poor 18 pass 11 caution 2 fail 8 note Checked 4 seconds ago · 4772 ms

Findings

  • Fail 1 nameserver(s) do not answer authoritatively DNS-LAME-DELEGATION

    NS 13 2 86400 20261029190024 20261027170024 34505 example.com. 3F6HdVbiIBHwVRbadHEv+it+O/YSnKpZ8fWoUPYuzKRL+gg+mYumNeSO2S8R+dwX8h0lWwhozZ3v5knzw5mA+g== (does not resolve)

    How to fix: Every delegated nameserver must host the zone and answer with the AA flag. Remove servers that no longer serve the zone or load the zone onto them.

    Read the fix guide →

  • Fail Security headers grade F SEC-HEADERS-GRADE

    0 / 100: almost no browser protections are declared.

    How to fix: Start with Strict-Transport-Security and X-Content-Type-Options, then add a Content-Security-Policy in report-only mode.

    Read the fix guide →

  • Caution NS set inside the zone differs from the delegation DNS-NS-SET-MISMATCH

    elliott.ns.cloudflare.com lists: elliott.ns.cloudflare.com, hera.ns.cloudflare.com

    How to fix: Keep the NS records in the zone identical to the nameservers configured at the registrar.

    Read the fix guide →

  • Caution DKIM selector google is revoked (empty key) DKIM-REVOKED
    Read the fix guide →
  • Caution DKIM selector 20230601 is revoked (empty key) DKIM-REVOKED
    Read the fix guide →
  • Caution DKIM selector 20221208 is revoked (empty key) DKIM-REVOKED
    Read the fix guide →
  • Caution DKIM selector 20210112 is revoked (empty key) DKIM-REVOKED
    Read the fix guide →
  • Caution Plain HTTP serves content instead of redirecting to HTTPS WEB-HTTP-NO-REDIRECT

    How to fix: Redirect http:// to https:// with a 301.

    Read the fix guide →

  • Caution No HTTP Strict Transport Security header HSTS-MISSING

    Browsers may still try plain HTTP first on each visit.

    How to fix: Send "Strict-Transport-Security: max-age=31536000; includeSubDomains".

    Read the fix guide →

  • Caution 104.20.23.154 has no reverse DNS IP-NO-PTR

    Mail from this address is likely to be rejected or scored as spam.

    How to fix: Ask the network owner to publish a PTR record.

    Read the fix guide →

  • Caution 172.66.147.243 has no reverse DNS IP-NO-PTR

    Mail from this address is likely to be rejected or scored as spam.

    How to fix: Ask the network owner to publish a PTR record.

    Read the fix guide →

  • Caution 2606:4700:10:0:0:0:ac42:93f3 has no reverse DNS IP-NO-PTR

    Mail from this address is likely to be rejected or scored as spam.

    How to fix: Ask the network owner to publish a PTR record.

    Read the fix guide →

  • Caution 2606:4700:10:0:0:0:6814:179a has no reverse DNS IP-NO-PTR

    Mail from this address is likely to be rejected or scored as spam.

    How to fix: Ask the network owner to publish a PTR record.

    Read the fix guide →

  • Note Registrant details are withheld DOMAIN-REGISTRANT-REDACTED

    The registry does not publish registrant details

  • Note No CAA record DNS-NO-CAA

    Any certificate authority may issue certificates for this domain.

    Read the fix guide →

  • Note Null MX: this domain declares that it does not receive mail MX-NULL

    RFC 7505 null MX (". 0").

    Read the fix guide →

  • Note No aggregate report address (rua) DMARC-NO-RUA

    You receive no visibility of who sends as your domain.

    Read the fix guide →

  • Note No MTA-STS policy MTASTS-NONE

    Optional; protects inbound mail against TLS downgrade.

  • Note No Content-Security-Policy CSP-MISSING
    Read the fix guide →
  • Note No X-Content-Type-Options header NOSNIFF-MISSING
    Read the fix guide →
  • Note No clickjacking protection (X-Frame-Options or frame-ancestors) XFO-MISSING
    Read the fix guide →
  • Pass Registration valid for another 288 days DOMAIN-EXPIRY-OK

    2027-08-13T04:00:00Z

  • Pass Transfer lock is on DOMAIN-TRANSFER-LOCK

    Protects against unauthorised transfers.

  • Pass DNSSEC delegation is signed at the registry DOMAIN-DNSSEC-DELEGATED
  • Pass Zone transfers are refused to outsiders DNS-AXFR-CLOSED

    2 server(s) tested

  • Pass Nameservers agree on the zone serial DNS-SERIAL-OK

    2418004112

  • Pass IPv6 address published for the apex DNS-IPV6-OK
  • Pass DNSSEC signed and validated DNSSEC-VALIDATED

    DS at the parent matches a DNSKEY in the zone; the validating resolver set the AD flag.

  • Pass SPF uses 0 of 10 permitted DNS lookups SPF-LOOKUPS-OK
  • Pass SPF ends with -all SPF-HARDFAIL-ALL
  • Pass DMARC policy is p=reject DMARC-REJECT

    Spoofed mail that fails authentication is rejected.

  • Pass Spoofing protection: enforced SPOOF-PROTECTED

    SPF and DMARC together reject or quarantine forged mail.

  • Pass Site answers over HTTPS WEB-HTTPS-OK

    HTTP 200 in 66 ms

  • Pass TLS score 95 (A) TLS-SCORE

    On our published rubric: validity, trust, key, protocols, HSTS.

    Read the fix guide →

  • Pass Certificate valid for 58 more days TLS-VALIDITY-OK

    2026-12-25T22:56:35+00:00

  • Pass Certificate chain verifies TLS-TRUSTED

    SSL Corporation Cloudflare TLS Issuing ECC CA 3

  • Pass TLS 1.3 supported; legacy protocols refused TLS-MODERN

    TLSv1.3

  • Pass Responds to ping from LON1 PING-OK

    avg 5.397 ms

  • Pass Not listed on 117 blocklists checked BLOCKLIST-CLEAN

By facet

Registry

100

0 fail · 0 caution · 3 pass

DNS

80

1 fail · 1 caution · 4 pass

Mail

80

0 fail · 4 caution · 4 pass

Web & TLS

75

1 fail · 2 caution · 6 pass

Reputation

80

0 fail · 4 caution · 1 pass

The score starts at 100 and loses 15 per fail and 5 per caution. Notes are informational. Findings above are grouped from every facet; open a facet for its records and raw data.