// site check

Does your domain actually point where you think?

One pass over the four ways of writing your address, the certificate behind them, the headers they return and the records that say who may send mail as you. Free, no signup, and the report is never stored.

// what gets checked

Twenty-odd checks, and a reason for every one

Every finding says what we observed and why it matters. Where we cannot prove something from outside, we say what we looked for instead of guessing.

Addresses and redirects

There are four ways to write your address. All four should end up at exactly one of them.

http goes to https: Whether the insecure address hands visitors over, or quietly serves a second working copy of the site.
One canonical hostname: Whether the bare domain and the www form agree, or whether search engines are looking at two separate sites.
Permanent, not temporary: Whether the canonical redirect is a 301 or 308, which passes ranking on, or a 302, which does not.
Chain length: How many hops sit between the address someone typed and the page they get.
www resolves: Whether visitors who type the www form reach the site or a browser error.

Certificates

The failure that gets discovered by a customer rather than by you.

Trust and expiry: Whether the chain verifies, and how many days of validity are left.
Missing intermediates: The chain that desktop browsers repair silently while mobile apps, API clients and payment callbacks fail on it.
Protocol version: Whether anything is still negotiating a TLS version browsers dropped in 2020.

Response headers

What the server tells a browser it is allowed to do.

HSTS: Whether returning visitors are pinned to https before the first request goes out.
Framing and sniffing: Whether another site can frame yours, and whether the browser is left to guess content types.
Compression: Whether HTML is served compressed, which is usually a one-line change.
Version disclosure: Whether the server publishes its exact version to anyone who asks.

Email authentication

The records that decide whether someone else can send mail as your domain, and whether your own mail arrives.

SPF: Present, singular, and ending in something other than a blanket allow.
DMARC: Present, with a policy that does more than watch. Google and Yahoo have required it from bulk senders since 2024.
DKIM: Whether a signing key is published at any of the selectors the common providers use.

Delivery

A single sample from our probe, for context rather than as a verdict.

Time to first byte: How long the server took to start answering.
HTTP/2: Whether the connection can carry more than one request at a time.
Nameservers and IPv6: What is serving the domain, and whether there is a second nameserver to fall back on.

// bot etiquette

Someone ran this check against your site

If you found relay19-sitecheck/1.0 in your logs, a person pasted your domain into the box above. It is a one-off, human-initiated check: at most eight requests to your homepage on ports 80 and 443, one TLS handshake, and a set of public DNS queries. Nothing is crawled, no form is submitted, no path other than the front page is requested, and the report is not stored or sent anywhere. It is rate limited per domain, so it cannot be used to generate traffic against you. We do keep a line recording that the request happened, which /privacy sets out in full.

If you would rather we did not, mail abuse@relay19.com and we will block the domain from the checker.