Domain Health

The canary went down the shaft so you don't have to.

The verdict · display only · not copied

Could be worse. Will be, if ignored.

The canary has seen this film before.

The record · plain results · copy buttons copy only this

Check	Status	Finding
DNS resolves	Pass	Public address: 104.20.23.154, 172.66.147.243, 2606:4700:10::ac42:93f3
Mail routing (MX)	Pass	Null MX published — this domain deliberately accepts no email (RFC 7505).
SPF	Pass	SPF present, using about 0 of 10 allowed DNS lookups.
DKIM	Warn	No DKIM key found for common selectors (default, google, s1, s2, mail). Mail may be unsigned, or uses another selector.
DMARC	Pass	DMARC policy is p=reject — spoofed mail is actively handled.
SSL certificate (443)	Pass	Certificate for example.com from SSL Corporation, expires in 67 day(s).
HTTP security headers	Warn	Answering over HTTPS; missing header(s): HSTS, X-Content-Type-Options, X-Frame-Options, CSP.

The canary's advice · what it means and how to fix it

DKIM: DKIM cryptographically signs outgoing mail so receivers can prove it was not altered in transit. Major providers increasingly require it.
Fix: Generate the key in your mail provider's admin console, publish the TXT record it gives you at <selector>._domainkey, then enable signing. The selector field above lets you check a non-standard selector.

HTTP security headers: HSTS forces HTTPS, X-Content-Type-Options stops MIME-sniffing attacks, X-Frame-Options and CSP mitigate clickjacking and cross-site scripting.
Fix: Add them at your web server or CDN. Typical values: Strict-Transport-Security: max-age=31536000; includeSubDomains, X-Content-Type-Options: nosniff, X-Frame-Options: SAMEORIGIN, plus a Content-Security-Policy tailored to the site.

Domain Health: example.com (2026-10-19 20:07 UTC)
PASS  DNS resolves: Public address: 104.20.23.154, 172.66.147.243, 2606:4700:10::ac42:93f3
PASS  Mail routing (MX): Null MX published — this domain deliberately accepts no email (RFC 7505).
PASS  SPF: SPF present, using about 0 of 10 allowed DNS lookups.
WARN  DKIM: No DKIM key found for common selectors (default, google, s1, s2, mail). Mail may be unsigned, or uses another selector.
PASS  DMARC: DMARC policy is p=reject — spoofed mail is actively handled.
PASS  SSL certificate (443): Certificate for example.com from SSL Corporation, expires in 67 day(s).
WARN  HTTP security headers: Answering over HTTPS; missing header(s): HSTS, X-Content-Type-Options, X-Frame-Options, CSP.

DKIM — why it matters: DKIM cryptographically signs outgoing mail so receivers can prove it was not altered in transit. Major providers increasingly require it.
DKIM — how to fix: Generate the key in your mail provider's admin console, publish the TXT record it gives you at <selector>._domainkey, then enable signing. The selector field above lets you check a non-standard selector.

HTTP security headers — why it matters: HSTS forces HTTPS, X-Content-Type-Options stops MIME-sniffing attacks, X-Frame-Options and CSP mitigate clickjacking and cross-site scripting.
HTTP security headers — how to fix: Add them at your web server or CDN. Typical values: Strict-Transport-Security: max-age=31536000; includeSubDomains, X-Content-Type-Options: nosniff, X-Frame-Options: SAMEORIGIN, plus a Content-Security-Policy tailored to the site.

Copy buttons copy only the plain record — the grumpy verdict stays on the page.

Share this report: https://ipeeve.com/health/example.com (cached 15 minutes)