{ "ok": true, "domain": "grapheneos.org", "generated_at": "2026-08-11T01:56:59-05:00", "cache": { "hit": true, "ttl": 0 }, "score": { "total": 95, "label": "Excellent", "categories": { "dns": 90, "mail": 100, "security": 92, "network": 85, "availability": 100 }, "category_weights": { "dns": 25, "mail": 20, "security": 25, "network": 10, "availability": 20 }, "items": [ { "category": "dns", "title": "IPv4 (A)", "max_points": 30, "earned_points": 30, "lost_points": 0, "detail": "1 IPv4 address(es) detected." }, { "category": "dns", "title": "IPv6 (AAAA)", "max_points": 10, "earned_points": 10, "lost_points": 0, "detail": "1 IPv6 address(es) detected." }, { "category": "dns", "title": "Name server redundancy", "max_points": 20, "earned_points": 20, "lost_points": 0, "detail": "2 NS record(s); 2 or more required." }, { "category": "dns", "title": "SOA record", "max_points": 10, "earned_points": 10, "lost_points": 0, "detail": "Authoritative zone record." }, { "category": "dns", "title": "DNSSEC chain", "max_points": 15, "earned_points": 15, "lost_points": 0, "detail": "DS and DNSKEY detected." }, { "category": "dns", "title": "CAA policy", "max_points": 5, "earned_points": 5, "lost_points": 0, "detail": "Certificate authority restriction." }, { "category": "dns", "title": "DNS propagation", "max_points": 10, "earned_points": 0, "lost_points": 10, "detail": "Agreement between public resolvers." }, { "category": "mail", "title": "MX records", "max_points": 20, "earned_points": 20, "lost_points": 0, "detail": "1 MX record(s)." }, { "category": "mail", "title": "SPF", "max_points": 25, "earned_points": 25, "lost_points": 0, "detail": "SPF policy published." }, { "category": "mail", "title": "DMARC", "max_points": 25, "earned_points": 25, "lost_points": 0, "detail": "DMARC policy published." }, { "category": "mail", "title": "DKIM", "max_points": 20, "earned_points": 20, "lost_points": 0, "detail": "A DKIM selector was verified." }, { "category": "mail", "title": "MTA-STS", "max_points": 5, "earned_points": 5, "lost_points": 0, "detail": "Mail transport policy." }, { "category": "mail", "title": "TLS-RPT", "max_points": 5, "earned_points": 5, "lost_points": 0, "detail": "TLS reporting policy." }, { "category": "security", "title": "Valid TLS certificate", "max_points": 55, "earned_points": 55, "lost_points": 0, "detail": "4 day(s) remaining." }, { "category": "security", "title": "Certificate lifetime", "max_points": 10, "earned_points": 2, "lost_points": 8, "detail": "Full points require at least 30 days remaining." }, { "category": "security", "title": "HTTP security headers", "max_points": 35, "earned_points": 35, "lost_points": 0, "detail": "9 of 9 evaluated headers detected." }, { "category": "network", "title": "PTR reverse DNS", "max_points": 30, "earned_points": 30, "lost_points": 0, "detail": "PTR: dal.grapheneos.org" }, { "category": "network", "title": "IPv4 diversity", "max_points": 35, "earned_points": 20, "lost_points": 15, "detail": "Two or more IPv4 addresses receive full points." }, { "category": "network", "title": "IPv6 connectivity", "max_points": 35, "earned_points": 35, "lost_points": 0, "detail": "AAAA availability." }, { "category": "availability", "title": "DNS resolution", "max_points": 40, "earned_points": 40, "lost_points": 0, "detail": "At least one address family must resolve." }, { "category": "availability", "title": "HTTP response", "max_points": 40, "earned_points": 40, "lost_points": 0, "detail": "HTTP/2 200 " }, { "category": "availability", "title": "HTTPS final URL", "max_points": 20, "earned_points": 20, "lost_points": 0, "detail": "Final URL uses HTTPS." } ], "methodology": "Each category is normalized to 100. The total is the weighted sum: DNS 25%, Email 20%, Security 25%, Network 10%, Availability 20%.", "diagnostics": [ { "level": "ok", "title": "IPv4 (A)", "detail": "1 IPv4 address(es) detected.", "category": "dns", "max_points": 30, "earned_points": 30, "lost_points": 0 }, { "level": "ok", "title": "IPv6 (AAAA)", "detail": "1 IPv6 address(es) detected.", "category": "dns", "max_points": 10, "earned_points": 10, "lost_points": 0 }, { "level": "ok", "title": "Name server redundancy", "detail": "2 NS record(s); 2 or more required.", "category": "dns", "max_points": 20, "earned_points": 20, "lost_points": 0 }, { "level": "ok", "title": "SOA record", "detail": "Authoritative zone record.", "category": "dns", "max_points": 10, "earned_points": 10, "lost_points": 0 }, { "level": "ok", "title": "DNSSEC chain", "detail": "DS and DNSKEY detected.", "category": "dns", "max_points": 15, "earned_points": 15, "lost_points": 0 }, { "level": "ok", "title": "CAA policy", "detail": "Certificate authority restriction.", "category": "dns", "max_points": 5, "earned_points": 5, "lost_points": 0 }, { "level": "error", "title": "DNS propagation", "detail": "Agreement between public resolvers.", "category": "dns", "max_points": 10, "earned_points": 0, "lost_points": 10 }, { "level": "ok", "title": "MX records", "detail": "1 MX record(s).", "category": "mail", "max_points": 20, "earned_points": 20, "lost_points": 0 }, { "level": "ok", "title": "SPF", "detail": "SPF policy published.", "category": "mail", "max_points": 25, "earned_points": 25, "lost_points": 0 }, { "level": "ok", "title": "DMARC", "detail": "DMARC policy published.", "category": "mail", "max_points": 25, "earned_points": 25, "lost_points": 0 }, { "level": "ok", "title": "DKIM", "detail": "A DKIM selector was verified.", "category": "mail", "max_points": 20, "earned_points": 20, "lost_points": 0 }, { "level": "ok", "title": "MTA-STS", "detail": "Mail transport policy.", "category": "mail", "max_points": 5, "earned_points": 5, "lost_points": 0 }, { "level": "ok", "title": "TLS-RPT", "detail": "TLS reporting policy.", "category": "mail", "max_points": 5, "earned_points": 5, "lost_points": 0 }, { "level": "ok", "title": "Valid TLS certificate", "detail": "4 day(s) remaining.", "category": "security", "max_points": 55, "earned_points": 55, "lost_points": 0 }, { "level": "warning", "title": "Certificate lifetime", "detail": "Full points require at least 30 days remaining.", "category": "security", "max_points": 10, "earned_points": 2, "lost_points": 8 }, { "level": "ok", "title": "HTTP security headers", "detail": "9 of 9 evaluated headers detected.", "category": "security", "max_points": 35, "earned_points": 35, "lost_points": 0 }, { "level": "ok", "title": "PTR reverse DNS", "detail": "PTR: dal.grapheneos.org", "category": "network", "max_points": 30, "earned_points": 30, "lost_points": 0 }, { "level": "warning", "title": "IPv4 diversity", "detail": "Two or more IPv4 addresses receive full points.", "category": "network", "max_points": 35, "earned_points": 20, "lost_points": 15 }, { "level": "ok", "title": "IPv6 connectivity", "detail": "AAAA availability.", "category": "network", "max_points": 35, "earned_points": 35, "lost_points": 0 }, { "level": "ok", "title": "DNS resolution", "detail": "At least one address family must resolve.", "category": "availability", "max_points": 40, "earned_points": 40, "lost_points": 0 }, { "level": "ok", "title": "HTTP response", "detail": "HTTP/2 200 ", "category": "availability", "max_points": 40, "earned_points": 40, "lost_points": 0 }, { "level": "ok", "title": "HTTPS final URL", "detail": "Final URL uses HTTPS.", "category": "availability", "max_points": 20, "earned_points": 20, "lost_points": 0 } ] }, "dns": { "records": { "A": [ "121.127.40.19" ], "AAAA": [ "2a02:6ea0:d206::1" ], "CNAME": [], "MX": [ "0 mail.grapheneos.org." ], "TXT": [ "\"oa1:btc recipient_address=bc1prqf5hks5dnd4j87wxw3djn20559yhj7wvvcv6fqxpwlg96udkzgqtamhry; recipient_name=GrapheneOS Foundation; tx_description=Donation to GrapheneOS Foundation;\"", "\"oa1:xmr recipient_address=862CebHaBpFPgYoNC6zw4U8rsXrDjD8s5LMJNS7yVCRHMUKr9dDi7adMSLUMjkDYJ85xahQTCJHHyK5RCvvRJu9x7iSzN9D; recipient_name=GrapheneOS Foundation; tx_description=Donation to GrapheneOS Foundation;\"", "\"v=spf1 a:mail.grapheneos.org -all\"", "\"facebook-domain-verification=jv1fv1fh38fz7v1yi5jai9e0c6sid2\"", "\"yandex-verification: 10fdf27f68b946c5\"", "\"google-site-verification=QCDUfSSfeAUufP-H3m4f5uvhknjIZVBVVmMSDaFRdz0\"" ], "NS": [ "ns1.grapheneos.org.", "ns2.grapheneos.org." ], "SOA": [ "ns1.grapheneos.org. hostmaster.grapheneos.org. 2026081100 3600 1800 1209600 3600" ], "CAA": [ "0 iodef \"mailto:caa-reports@grapheneos.org\"", "0 issuemail \";\"", "0 issue \"letsencrypt.org; validationmethods=http-01; accounturi=https://acme-staging-v02.api.letsencrypt.org/acme/acct/254068453\"", "0 issue \"letsencrypt.org; validationmethods=http-01; accounturi=https://acme-v02.api.letsencrypt.org/acme/acct/2919943146\"", "0 issuevmc \";\"" ], "DS": [ "35166 13 2 EABEFF74404F49D8F65B1D765E10EE3E83A0B57B6C5F421ECFAC93B5 8779ECFE" ], "DNSKEY": [ "257 3 13 3qeqaXyJS3XFTPjPP3KkKe6eoGObQ7hQdbSuETyqCQaTejTudbH/TRGM rViP737n3UYw9ZFGK84cfu5EARFkMQ==" ], "RRSIG": [ "SOA 13 2 86400 20260820000000 20260730000000 35166 grapheneos.org. JqxdSqdwm3zQSagfcep+rP35BExdtYV31SAUMEXU7Za5Tcy/7QPt5m5P w+qK1+Ec19bqtp8eiSYCzsKhtbUGoQ==", "AAAA 13 2 300 20260820000000 20260730000000 35166 grapheneos.org. GBgI0qppjIIbdvJFJiZxRBGjrsF6PTm4xQCPw64v8BR/rqX+x7iW8NoB Aa5vqO3TaAyAjIv85NdSFauKmAyIEw==", "DS 8 2 3600 20260830152406 20260809142406 44925 org. f4AYrpMwCLnAMeN+nJ9m+v65Zov7RhMTdpRImBcOlU7nhAPRX9Jkv8w7 q9AOXD0L5HJnvhnY9rKIzP63EhdV9X2ax6cz4z0M0u4xH9uqxaX1Hci6 uKf82i5RdxEwcLiv1w1pVKumBbaT/U4gb/g5aYrKcZyvMdAazqfIwf6V AMQ=", "MX 13 2 86400 20260820000000 20260730000000 35166 grapheneos.org. NmPhmEnuje73xTs0Bk4Dpx5S7ZQb91y8+bUOLh/X2HOFcROxLqHwPIiF JrCJ9xj9uhlGuHf9ubOZj4H6aDNrcA==", "CAA 13 2 3600 20260820000000 20260730000000 35166 grapheneos.org. dBFwqUgKiYY0B5jDSGpDkvHfB0DB03MiGZlImyi1vbU1WMFe8fd7z1xn POi/Ic/uHER503cvwfMi6e51OGuWEg==" ], "NSEC": [ "_atproto.grapheneos.org. A NS SOA MX TXT AAAA SSHFP RRSIG NSEC DNSKEY HTTPS CAA" ], "NSEC3": [], "SRV": [], "NAPTR": [], "TLSA": [], "SSHFP": [ "4 2 00000000000000000000000000000000000000000000000000000000 00000000" ] }, "ipv4": [ "121.127.40.19" ], "ipv6": [ "2a02:6ea0:d206::1" ] }, "mail": { "spf": "v=spf1 a:mail.grapheneos.org -all", "dmarc": "v=DMARC1; p=reject; adkim=s; aspf=s; fo=1; rua=mailto:dmarc-aggregate-reports@grapheneos.org; ruf=mailto:dmarc-failure-reports@grapheneos.org", "dkim_selector": "default", "dkim_host": "default._domainkey.grapheneos.org", "dkim": "v=DKIM1; k=rsa; t=s; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAscpBvhA4SSPi2+Mdj8Ds4UB24dpeEST2hhhcm3d95rIqq0q7I7Tn39S/Mnr/ijk4a6W1V7nwMcz41JDIb1dneMJIpNlXrl79HN8wIlyxRith39VxbuohGnb5XN779uMEzJXyCPpYoffAbqSg6syzPf5VxNVRQihC62EebPjwSTlSvvT0+9oJ+Lk9Fyg00IZZt18vZJA8dJmDAuhAFvxSkzX0YzGug/N0fJXISQdMjIoSviBWzIUaLei7oDtgx0U3zhwOX3QnBQq2zxkGo4MTo5VF1dYEe3I9KC4k+Xdht3AOkXmd0AiJdMYjj2e16VOWJm3UCKPSgiY+d2Od0GMYowIDAQAB", "spf_analysis": { "valid": true, "lookups": 1, "final": "-all", "message": "Within the estimated limit" }, "dmarc_analysis": { "valid": true, "policy": "reject" }, "bimi": "v=BIMI1; l=https://grapheneos.org/bimi.svg", "mta_sts": "v=STSv1; id=2023062500", "tls_rpt": "v=TLSRPTv1; rua=mailto:smtp-tls-reports@grapheneos.org" }, "advanced": { "ptr": "dal.grapheneos.org", "propagation": { "consistent": false, "results": [ { "provider": "Google", "server": "8.8.8.8", "result": [ "121.127.40.19" ], "time_ms": 117.71 }, { "provider": "Cloudflare", "server": "1.1.1.1", "result": [ "121.127.40.19" ], "time_ms": 26.73 }, { "provider": "Quad9", "server": "9.9.9.9", "result": [ "121.127.40.19" ], "time_ms": 75.71 }, { "provider": "OpenDNS", "server": "208.67.222.222", "result": [ "91.246.30.2" ], "time_ms": 40.16 }, { "provider": "AdGuard", "server": "94.140.14.14", "result": [ "121.127.40.19" ], "time_ms": 46.57 } ] } }, "ssl": { "available": true, "issuer": "Let's Encrypt", "subject": "", "valid_from": "2026-08-09T09:48:02-05:00", "valid_to": "2026-08-16T01:48:01-05:00", "days_remaining": 4, "san": [ "grapheneos.app", "grapheneos.ca", "grapheneos.com", "grapheneos.dev", "grapheneos.foundation", "grapheneos.info", "grapheneos.net", "grapheneos.org", "grapheneos.ovh", "grapheneos.page", "vanadium.app", "www.grapheneos.app", "www.grapheneos.ca", "www.grapheneos.com", "www.grapheneos.dev", "www.grapheneos.foundation", "www.grapheneos.info", "www.grapheneos.net", "www.grapheneos.org", "www.grapheneos.ovh", "www.grapheneos.page", "www.vanadium.app" ], "protocol": "TLSv1.3", "cipher": "TLS_AES_256_GCM_SHA384" }, "http": { "url": "https://grapheneos.org/", "status": "HTTP/2 200 ", "http_version": "3", "headers": { "server": "nginx", "date": "Tue, 11 Aug 2026 06:56:53 GMT", "content-type": "text/html; charset=utf-8", "content-length": "6997", "last-modified": "Fri, 10 Jul 2026 00:28:54 GMT", "vary": "Accept-Encoding", "etag": "\"6a503cc6-1b55\"", "strict-transport-security": "max-age=63072000; includeSubDomains; preload", "x-content-type-options": "nosniff", "referrer-policy": "no-referrer", "cross-origin-opener-policy": "same-origin", "cross-origin-embedder-policy": "require-corp", "origin-agent-cluster": "?1", "x-frame-options": "DENY", "x-xss-protection": "0", "content-security-policy": "default-src 'none'; connect-src 'self' https://releases.grapheneos.org/; font-src 'self'; img-src 'self'; manifest-src 'self'; script-src 'self'; style-src 'self'; webrtc 'block'; form-action 'none'; frame-ancestors 'none'; base-uri 'none'; require-trusted-types-for 'script'; trusted-types 'none'", "permissions-policy": "accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), bluetooth=(), camera=(), clipboard-read=(), clipboard-write=(), display-capture=(), document-domain=(), encrypted-media=(), fullscreen=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), speaker-selection=(), sync-xhr=(), usb=(), xr-spatial-tracking=()", "cross-origin-resource-policy": "same-origin", "cache-control": "public, no-cache", "link": "; rel=preload; as=style; integrity=sha256-3YJzdyJynCAgxYqLgVZmD2nuqqEGDieSuKvkXeAnhNo=, ; rel=preload; as=font; crossorigin, ; rel=preload; as=font; crossorigin, ; rel=preload; as=image; fetchpriority=high, ; rel=preload; as=image; fetchpriority=high, ; rel=modulepreload; integrity=sha256-zwyfsj5sBaDlYSIuJ30uHe8gfCUAiLb4XVIBXD8Djn4=", "accept-ranges": "bytes" }, "security_checks": { "strict-transport-security": true, "content-security-policy": true, "x-content-type-options": true, "x-frame-options": true, "referrer-policy": true, "permissions-policy": true, "cross-origin-opener-policy": true, "cross-origin-embedder-policy": true, "cross-origin-resource-policy": true }, "server": "nginx", "powered_by": "" }, "webpage": { "url": "https://grapheneos.org/", "title": "GrapheneOS: the private and secure mobile OS", "description": "GrapheneOS is a security and privacy focused mobile OS with Android app compatibility.", "success": true, "error": "", "status": 200 }, "network": { "121.127.40.19": { "success": false, "country": "", "region": "", "city": "", "asn": "", "organization": "", "isp": "" } }, "smtp": { "host": "mail.grapheneos.org", "ports": [ { "port": 25, "open": false, "time_ms": 9.8, "banner": "", "error": "Network is unreachable" }, { "port": 465, "open": false, "time_ms": 26.4, "banner": "", "error": "No connection" }, { "port": 587, "open": false, "time_ms": 4021.3, "banner": "", "error": "Connection timed out" } ] }, "visitor": { "ip": "216.73.217.62", "reverse": "", "country": "", "country_code": "", "region": "", "city": "", "latitude": null, "longitude": null, "isp": "", "organization": "", "asn": "", "timezone": "", "browser": "Other", "os": "Other", "language": "", "user_agent": "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)", "is_bot": true, "cloudflare": false }, "analysis_time_ms": 141.8 }