For website owners and administrators

How our checker works

Domain Detective helps people understand how a domain is set up by reading its public records. If you have seen our checker in your logs, this page explains what it did and how to reach us.

What one check does

• Public DNS lookups for the domain (for example A, AAAA, MX, NS, TXT, CAA and DMARC records), made through a public DNS resolver.
• One registration lookup using the registry's public RDAP service.
• One HTTPS request for the home page, following a small number of redirects. We read the response headers, the certificate, the names and settings of any cookies it sets (never their values) and what the page itself contains (title, the scripts and other files it refers to, links to legal pages, published company details). We stop reading after 1 MB and do not load any of the files the page refers to.
• One plain HTTP request for the home page, to see whether visitors are sent to HTTPS.
• One HTTPS request to the www (or bare) form of the name, without following its redirect, to see whether the two agree.
• A few short TLS handshakes with no request, to see which TLS versions (1.0 to 1.3) and whether HTTP/2 the server accepts.

Paid subscribers can also ask for public certificate-transparency, web-archive and network-registry records; those come from the public services that publish them, not from your servers.

What we never do

• No port scanning, login attempts, form submissions or vulnerability probing.
• No crawling: we request the home page only. We do not follow its links, run its scripts or load its images and other files.
• Only the standard web ports, 80 and 443.
• No requests to private or internal network addresses.

How to recognise our requests

Paid subscribers can monitor a domain on a schedule (at most every 15 minutes, often hourly or daily). When a change or an outage seems to have happened, the check is repeated a few minutes later to confirm it before anyone is alerted.

Contact and opting out

If our requests cause you any problem, or you would like your domain excluded from website checks, contact us with the domain name, and we will deal with it promptly.

The results we show describe what our server observed at a particular time. They are not a verdict about whether a site is safe.