What a domain health check actually measures
When you run a scan on Site is OK, the result is a score out of 100 plus a set of findings and recommendations. A number alone isn't very useful — so here's an honest look at what the scan measures and what it deliberately leaves out.
Everything is checked from the outside
The scanner acts as a regular visitor reaching your domain from the public internet. It looks at the same things a browser, a mail server, or a certificate authority would see:
- Web endpoints — does the site answer on HTTP and HTTPS, and does plain HTTP redirect to the encrypted version?
- TLS — the certificate's validity, expiry, hostname match, chain, and the protocol versions on offer.
- DNS — the records that make the domain work: A/AAAA, MX, NS, CAA, plus DNSSEC signing and TTL sanity.
- Mail security — SPF, DKIM, DMARC, MTA-STS and TLS-RPT: the records that decide whether others can spoof mail from your domain.
- Reputation — whether the mail IPs appear on common DNS blocklists.
- Headers and cookies — the security headers a browser enforces, and whether cookies carry the right flags.
A scan can also target a bare IPv4 or IPv6 address instead of a domain — useful for checking a host before its DNS exists. In that case the zone-level checks are skipped (there is no zone), and you get the things that do apply: web endpoints, TLS (matched by IP SAN), reverse DNS, network registration, and blocklist reputation.
What's skipped on purpose
If a check can't produce a meaningful answer, it doesn't produce a fake one. No MX records means no mail section — not a zero. A domain protected by a WAF that refuses our probes is reported as blocked or filtered, not "down": a refusal is an answer, silence is not.
What a score is — and isn't
The score summarizes how many of the measured things look right. It's a starting point for fixing, not a security certification: passing every check doesn't prove an application is safe, and a lower score on a site that's intentionally configured a certain way isn't necessarily wrong. The recommendations that accompany each finding say why it matters — that's the part worth reading.