How the Domain Health audit works
The scanner treats each category as an independent stage. DNS checks establish the domain and mail routing foundation, email checks inspect sender-authentication policy, TLS checks inspect certificate and protocol signals, and HTTP checks review redirects and response security. Deep mode can add public infrastructure and vulnerability observations. A failed or unreachable stage does not erase findings produced by the other stages.
Reading the report
Findings distinguish passed, warning, failed, inconclusive, unreachable, skipped, and error outcomes. Severity describes potential impact; confidence describes how directly the evidence supports the result. Expand a finding to review bounded evidence, remediation guidance, references, and a CLI verification command. Partial results appear while later stages are queued.
Scope and safety
Only public targets are accepted. Private, loopback, link-local, reserved, credential-bearing, and unsupported URL targets are rejected before work is queued. Safe transports revalidate redirect destinations and resolved addresses. Results are observations from the scanner location, not a penetration test or a guarantee that a service is safe. Quick reports expire after 6 hours and Deep reports after 12 hours; reports are unlisted and marked noindex.
CLI Equivalent
dig +short A example.com
dig +short MX example.com
curl -sSIL --max-redirs 5 https://example.com
openssl s_client -connect example.com:443 -servername example.com </dev/null