Bit Happens Bits happen. Fix them before shit happens. — home page
EN
MENU
X-RAY // FULL REPORT

DOMAIN
X-RAY.

Enter a domain and all 33 checks run at once: DNS, email, HTTPS, certificates and reputation. Each box explains the check, shows how to fix it and can be run again on its own.

Accepts a domain, URL or email address. Public lookups only: DNS, the site homepage and public databases. No port is scanned. Each group of results is cached for 5 minutes to 1 hour, with nothing about who asked; RUN AGAIN on a check always queries again.

DNS // 7 CHECKS

DNS and name servers

Addresses, authoritative servers, DNSSEC signing and who may issue certificates.

DNS

DNS records

WAITING

Queries the basic records of the domain: IPv4 (A) and IPv6 (AAAA) addresses, aliases (CNAME) and the SOA, which identifies the primary server and the zone serial number.

ABOUT THIS CHECK

What it is. Queries the basic records of the domain: IPv4 (A) and IPv6 (AAAA) addresses, aliases (CNAME) and the SOA, which identifies the primary server and the zone serial number.

Why it matters. Without A or AAAA the site does not open by name. The SOA serial helps confirm whether a change has already reached public DNS.

Check page: how to read the result and how to fix it →

Guide: How to troubleshoot DNS →

Open in DNS Lookup →

NS

Name servers

WAITING

Lists the authoritative name servers (NS) of the zone and the IP address of each one.

ABOUT THIS CHECK

What it is. Lists the authoritative name servers (NS) of the zone and the IP address of each one.

Why it matters. With a single server, or all of them on the same network, one failure takes the whole domain down. The recommendation is at least two servers on different networks.

Check page: how to read the result and how to fix it →

Guide: How to troubleshoot DNS →

DNSSEC

WAITING

Checks whether the zone is signed (DNSKEY), whether the DS record was published at the domain registry and whether the 1.1.1.1 resolver validated the chain of trust (AD flag).

ABOUT THIS CHECK

What it is. Checks whether the zone is signed (DNSKEY), whether the DS record was published at the domain registry and whether the 1.1.1.1 resolver validated the chain of trust (AD flag).

Why it matters. DNSSEC stops forged DNS answers from diverting visitors or email. Signing the zone without publishing the DS at the registry protects nothing.

Check page: how to read the result and how to fix it →

Guide: How to troubleshoot DNS →

CAA

WAITING

Reads the CAA records, which say which certificate authorities may issue certificates for the domain.

ABOUT THIS CHECK

What it is. Reads the CAA records, which say which certificate authorities may issue certificates for the domain.

Why it matters. Without CAA, any trusted authority can issue a certificate for your domain if it is fooled during validation. With CAA, requests to other authorities are refused.

Check page: how to read the result and how to fix it →

TXT

TXT records

WAITING

Lists the TXT records and identifies what they are for: SPF, ownership verifications (Google, Microsoft, Meta and others) and other uses.

ABOUT THIS CHECK

What it is. Lists the TXT records and identifies what they are for: SPF, ownership verifications (Google, Microsoft, Meta and others) and other uses.

Why it matters. TXT records of services you no longer use reveal suppliers and pile up junk in the zone. Review the ones you do not recognise.

Check page: how to read the result and how to fix it →

IPv6

WAITING

Checks whether the domain publishes a public IPv6 (AAAA) address.

ABOUT THIS CHECK

What it is. Checks whether the domain publishes a public IPv6 (AAAA) address.

Why it matters. Many ISPs and mobile networks already hand out IPv6. Without AAAA, those visitors depend on translation to IPv4 along the way.

Check page: how to read the result and how to fix it →

ASN

Network and hosting

WAITING

Identifies the autonomous system (ASN), the organisation and the prefix that announce the domain address, using the Team Cymru IP-to-ASN database.

ABOUT THIS CHECK

What it is. Identifies the autonomous system (ASN), the organisation and the prefix that announce the domain address, using the Team Cymru IP-to-ASN database.

Why it matters. Shows who hosts or protects the site, such as a CDN. The country is where the prefix is registered, not the physical location of the server.

Check page: how to read the result and how to fix it →

IP context in What Is My IP →

MAIL // 7 CHECKS

Email

Who receives the mail, who may send on behalf of the domain and how it protects itself from spoofing.

MX

Mail servers (MX)

WAITING

Lists the MX records, which say which servers receive the domain email, checks that each one resolves and identifies the provider.

ABOUT THIS CHECK

What it is. Lists the MX records, which say which servers receive the domain email, checks that each one resolves and identifies the provider.

Why it matters. Without MX the domain receives no email. A null MX (0 .) is the correct way to declare that the domain receives no mail.

Check page: how to read the result and how to fix it →

Open in Email Health →

SPF

WAITING

Reads the SPF policy, which lists who may send email on behalf of the domain, and estimates how many DNS lookups evaluating it takes.

ABOUT THIS CHECK

What it is. Reads the SPF policy, which lists who may send email on behalf of the domain, and estimates how many DNS lookups evaluating it takes.

Why it matters. Without SPF, or with +all, any server can pass itself off as the domain. More than 10 DNS lookups make the policy fail (PermError) at the receiver.

Check page: how to read the result and how to fix it →

Open in Email Health →

DMARC

WAITING

Reads the DMARC policy: what receivers should do with messages that fail SPF and DKIM, and where to send the reports.

ABOUT THIS CHECK

What it is. Reads the DMARC policy: what receivers should do with messages that fail SPF and DKIM, and where to send the reports.

Why it matters. With p=none the domain only monitors: spoofed email still arrives. It is p=quarantine or p=reject that blocks spoofing.

Check page: how to read the result and how to fix it →

Generate a record in Email Health →

DKIM

WAITING

Looks for DKIM keys on six common selectors: selector1, selector2, google, default, s1 and s2.

ABOUT THIS CHECK

What it is. Looks for DKIM keys on six common selectors: selector1, selector2, google, default, s1 and s2.

Why it matters. DKIM signs messages, and Gmail and Yahoo require signatures from bulk senders. Not finding it on the common selectors does not mean it is missing: the real selector shows in the DKIM-Signature header.

Check page: how to read the result and how to fix it →

Test a selector in Email Health →

MTA-STS

WAITING

Checks the _mta-sts record and the policy published at https://mta-sts.<domain>/.well-known/mta-sts.txt.

ABOUT THIS CHECK

What it is. Checks the _mta-sts record and the policy published at https://mta-sts.<domain>/.well-known/mta-sts.txt.

Why it matters. MTA-STS makes sending servers use valid TLS for delivery, so nobody on the path can downgrade the connection to plain text.

Check page: how to read the result and how to fix it →

TLS-RPT

WAITING

Checks the _smtp._tls record, which says where senders send reports of TLS failures when delivering email.

ABOUT THIS CHECK

What it is. Checks the _smtp._tls record, which says where senders send reports of TLS failures when delivering email.

Why it matters. Without reports, certificate or MTA-STS problems on your mail server go unnoticed.

Check page: how to read the result and how to fix it →

BIMI

WAITING

Looks for the BIMI record, which publishes the brand logo for compatible email clients.

ABOUT THIS CHECK

What it is. Looks for the BIMI record, which publishes the brand logo for compatible email clients.

Why it matters. It is optional and only works with DMARC at quarantine or reject. The main providers also require a mark certificate (VMC or CMC).

Check page: how to read the result and how to fix it →

WEB // 12 CHECKS

Website and HTTPS

What the homepage answers, with which protections, and what it shows to search engines and third parties.

HTTP

Site status

WAITING

Requests the homepage over HTTPS, follows the redirects and records the response code, the final destination and the response time.

ABOUT THIS CHECK

What it is. Requests the homepage over HTTPS, follows the redirects and records the response code, the final destination and the response time.

Why it matters. Shows whether the site is up as seen from outside your network, from the Cloudflare network, and how many hops visitors go through before the page.

Check page: how to read the result and how to fix it →

Open in HTTP & HTTPS →

REDIR

HTTPS redirect

WAITING

Requests http://<domain> and checks whether it redirects to HTTPS, and with which code.

ABOUT THIS CHECK

What it is. Requests http://<domain> and checks whether it redirects to HTTPS, and with which code.

Why it matters. Whoever types just the domain arrives over HTTP. Without a redirect, the first page travels unencrypted.

Check page: how to read the result and how to fix it →

HSTS

WAITING

Reads the Strict-Transport-Security header and checks whether the domain is on the browser preload list.

ABOUT THIS CHECK

What it is. Reads the Strict-Transport-Security header and checks whether the domain is on the browser preload list.

Why it matters. HSTS makes the browser use HTTPS only for a period, even if someone tries to downgrade the connection. Preload protects the very first visit too.

Check page: how to read the result and how to fix it →

HEADERS

Security headers

WAITING

Checks the protection headers of the response: CSP, X-Content-Type-Options, frame protection, Referrer-Policy, Permissions-Policy and COOP.

ABOUT THIS CHECK

What it is. Checks the protection headers of the response: CSP, X-Content-Type-Options, frame protection, Referrer-Policy, Permissions-Policy and COOP.

Why it matters. They reduce the impact of XSS, clickjacking and data leaks to third parties. Each missing one is one layer fewer.

Check page: how to read the result and how to fix it →

Open in HTTP & HTTPS →

COOKIE

Cookies

WAITING

Analyses the cookies set on the first visit and the attributes of each one: Secure, HttpOnly and SameSite. Cookie values are never read or stored.

ABOUT THIS CHECK

What it is. Analyses the cookies set on the first visit and the attributes of each one: Secure, HttpOnly and SameSite. Cookie values are never read or stored.

Why it matters. A session cookie without Secure can leak over HTTP, without HttpOnly it is exposed to scripts and without SameSite it is more exposed to CSRF.

Check page: how to read the result and how to fix it →

CDN

Server, CDN and WAF

WAITING

Identifies the CDN or the web application firewall (WAF) in front of the site, from its address and headers, and whether the software version is exposed. The site's Server header is not visible from here: Cloudflare replaces it on Worker requests.

ABOUT THIS CHECK

What it is. Identifies the CDN or the web application firewall (WAF) in front of the site, from its address and headers, and whether the software version is exposed. The site's Server header is not visible from here: Cloudflare replaces it on Worker requests.

Why it matters. A version exposed in Server or X-Powered-By makes it easier to look up known flaws of that version.

Check page: how to read the result and how to fix it →

ROBOTS

robots.txt

WAITING

Reads /robots.txt: the rules for search engines and AI robots, and the declared sitemaps.

ABOUT THIS CHECK

What it is. Reads /robots.txt: the rules for search engines and AI robots, and the declared sitemaps.

Why it matters. A forgotten Disallow: / takes the whole site out of Google. AI robots read these rules too.

Check page: how to read the result and how to fix it →

Sitemap

WAITING

Looks for the XML sitemap, declared in robots.txt or at /sitemap.xml, and counts the URLs it lists.

ABOUT THIS CHECK

What it is. Looks for the XML sitemap, declared in robots.txt or at /sitemap.xml, and counts the URLs it lists.

Why it matters. The sitemap helps search engines discover and re-index new pages faster.

Check page: how to read the result and how to fix it →

SEC.TXT

security.txt

WAITING

Reads /.well-known/security.txt (RFC 9116): the contact for reporting vulnerabilities, the expiry of the file and the accepted languages.

ABOUT THIS CHECK

What it is. Reads /.well-known/security.txt (RFC 9116): the contact for reporting vulnerabilities, the expiry of the file and the accepted languages.

Why it matters. Without a published contact, whoever finds a flaw on your site does not know whom to tell, or tells the public.

Check page: how to read the result and how to fix it →

SEO

Title, description and social

WAITING

Reads the title, meta description, canonical URL, language and Open Graph and Twitter tags of the homepage.

ABOUT THIS CHECK

What it is. Reads the title, meta description, canonical URL, language and Open Graph and Twitter tags of the homepage.

Why it matters. This is what shows on Google and when someone shares the link. A forgotten noindex takes the page out of search engines.

Check page: how to read the result and how to fix it →

MIXED

Mixed content and SRI

WAITING

Looks for resources loaded over http:// on an HTTPS page and for scripts from other domains without an integrity check (integrity attribute).

ABOUT THIS CHECK

What it is. Looks for resources loaded over http:// on an HTTPS page and for scripts from other domains without an integrity check (integrity attribute).

Why it matters. A script over HTTP is blocked by the browser or can be tampered with on the way. SRI guarantees that the file from another domain is the one you approved.

Check page: how to read the result and how to fix it →

3RD

Third parties and trackers

WAITING

Lists the external domains the homepage loads (scripts, frames, stylesheets and images) and identifies known trackers.

ABOUT THIS CHECK

What it is. Lists the external domains the homepage loads (scripts, frames, stylesheets and images) and identifies known trackers.

Why it matters. Every third party receives data about your visitors and is one more point of failure. Under privacy laws such as the GDPR and the LGPD, trackers need a legal basis, usually consent.

Check page: how to read the result and how to fix it →

CERT // 2 CHECKS

Certificates

Certificate Transparency: the certificate in use and the subdomains that appear in valid certificates.

CERT

HTTPS certificate

WAITING

Searches the public Certificate Transparency logs for the newest valid certificate of the domain: issuer, validity and names covered.

ABOUT THIS CHECK

What it is. Searches the public Certificate Transparency logs for the newest valid certificate of the domain: issuer, validity and names covered.

Why it matters. An expired certificate takes the site down with a security warning. The Cloudflare Worker cannot read the certificate of the connection, so the data comes from the public logs.

Check page: how to read the result and how to fix it →

Open in HTTP & HTTPS →

REP // 5 CHECKS

Registration and reputation

Domain registration and expiry, blocklists, breaches, history and popularity.

RDAP

Domain registration

WAITING

Queries RDAP, the successor of WHOIS: registrar, creation, update and expiry dates, status and name servers at the registry.

ABOUT THIS CHECK

What it is. Queries RDAP, the successor of WHOIS: registrar, creation, update and expiry dates, status and name servers at the registry.

Why it matters. An expired domain takes site and email down at once. Statuses such as clientTransferProhibited protect against an unwanted transfer.

Check page: how to read the result and how to fix it →

Open in RDAP / WHOIS →

BLOCK

Filtering DNS blocks

WAITING

Resolves the domain on public DNS resolvers that block malware, phishing and adult content (Quad9, Cloudflare, AdGuard, OpenDNS and CleanBrowsing) and compares with the unfiltered answer.

ABOUT THIS CHECK

What it is. Resolves the domain on public DNS resolvers that block malware, phishing and adult content (Quad9, Cloudflare, AdGuard, OpenDNS and CleanBrowsing) and compares with the unfiltered answer.

Why it matters. If the domain lands on a blocklist, people who use those resolvers, such as many companies and schools, cannot open the site, and you get no warning.

Check page: how to read the result and how to fix it →

HIBP

Data breaches

WAITING

Queries Have I Been Pwned for data breaches recorded for the domain.

ABOUT THIS CHECK

What it is. Queries Have I Been Pwned for data breaches recorded for the domain.

Why it matters. If the site has leaked user data, the passwords of that time may be tried on other services (credential stuffing).

Check page: how to read the result and how to fix it →

ARCHIVE

Wayback Machine history

WAITING

Finds the first and the latest capture of the site in the Internet Archive.

ABOUT THIS CHECK

What it is. Finds the first and the latest capture of the site in the Internet Archive.

Why it matters. Shows how long the site has existed and lets you see old versions, useful to investigate changes or removed content.

Check page: how to read the result and how to fix it →

RANK

Global rank (Tranco)

WAITING

Looks up the position of the domain on Tranco, a research list of the 1 million most visited sites in the world.

ABOUT THIS CHECK

What it is. Looks up the position of the domain on Tranco, a research list of the 1 million most visited sites in the world.

Why it matters. Gives a sense of scale. Most domains are not on the list, and that is normal.

Check page: how to read the result and how to fix it →

EXTRA // ON DEMAND

Website screenshot

See the homepage as a browser renders it. It is not one of the 33 automatic checks: it only uses Browser Run minutes when you ask.

SCREENSHOT

Homepage preview

OPTIONAL

The capture opens only the HTTPS homepage of the public domain and shows the visible area, as on a 1280×800 screen. The image may stay cached for up to six hours; sites that block automated browsers may not show, and domains blocked by a security or adult-content filter are not captured.

First enter a domain and start the X-Ray.

ABOUT THIS SCREENSHOT

What it is. An image of how the Cloudflare browser renders the homepage of the site, with images and fonts loaded: the visible part of a 1280×800 screen.

Why it matters. It helps you see redirects, blocks and presentation differences, without picking another check.

Limits. It requires Turnstile, uses the free browser quota and does not allow paths, authenticated pages or private IPs. A used-up limit does not change the other results.

RESULT // WORKFLOWUse the result in your ticket or handoff
History stays in this browser.
RECENT LOCAL QUERIES
FAQ

Frequently asked questions

What does the Domain X-Ray check?

33 public checks in five groups: DNS (records, name servers, DNSSEC, CAA, IPv6 and network), email (MX, SPF, DMARC, DKIM, MTA-STS, TLS-RPT and BIMI), website and HTTPS (status, redirect, HSTS, headers, cookies, robots.txt, sitemap, security.txt, SEO, mixed content and third parties), certificates, and registration and reputation (RDAP, blocklists, breaches, Wayback and ranking).

Does the X-Ray scan ports or run intrusive tests?

No. It queries public DNS, requests the homepage and a few public files of the site (robots.txt, sitemap and security.txt) as a visitor would, and queries public databases. Port checks are a separate tool, only for assets you manage.

Why do some checks show NOT TESTED?

When the check does not apply, such as the website checks on a domain without a public IP address, or when the source has no data, such as a registry without public RDAP. NOT TESTED is not a problem with the domain.

Why are DKIM, TLS-RPT and BIMI shown as INFO and not OK?

Because the check only confirms that the record exists in DNS. For DKIM, a published key does not prove that messages go out signed; check the DKIM-Signature header of a message you sent.

Is the certificate shown the one the server presents now?

It is the newest valid certificate in the public Certificate Transparency logs. The Cloudflare Worker cannot read the certificate of the connection; to see what the server presents, run openssl s_client (the command is on the HTTPS certificate check page).

Can I run just one check again?

Yes. Each box has a RUN AGAIN button that repeats only that check, useful after fixing a record. Remember that DNS answers are cached for the record TTL.

Is the result stored?

Each group of results stays in the Cloudflare cache for 5 minutes to 1 hour, with the domain and the result and nothing about who asked; ANALYZE AGAIN WITHOUT CACHE and RUN AGAIN on a check query again. A screenshot, when you ask for one, is cached for up to six hours. The local history and the JSON, Markdown or PDF export stay in your browser.