zerobounce.ai
Full report

example.com email and security report

All 20 checks for example.com on one page, last run October 15, 2026; DNS, website and WHOIS checks repeat every 14 days.

By using these tools you accept the Terms and the Privacy page.

Full report · Domain

example.com

2 of 20 checks failed, 4 need attention. 2 passed with things to tighten.

Checked Oct 15, 2026; next free refresh due Oct 29, 2026.

Up to 5 re-checks a day per network.

  • 2 failed
  • 4 need attention
  • 9 passed
  • 5 for information

Spamhaus intelligenceexample.com

Reputation +34.3 Positive: Spamhaus’s own score rates this domain as reputable.

Tags
phish, spam
Registered
Aug 14, 1995 at RESERVED-Internet Assigned Numbers Authority
Expires
Aug 13, 2027
Last seen
Oct 14, 2026
Human score
+25
Infrastructure score
+10.75
SMTP score
-1.5

Tags are Spamhaus’s labels for the domain: what kind of domain it is, and kinds of abuse Spamhaus has seen involving it, including abuse by others (large providers’ domains are often misused in phishing and spam). They describe what was seen, not a verdict; the score is Spamhaus’s overall assessment.

Scores: positive is good, negative is bad, 0 is neutral. The overall score combines the dimensions (human, identity, infrastructure, malware, SMTP).

From the Spamhaus Intelligence API on Oct 15, 2026. It is asked again only when someone presses Re-check.

AI intelligenceexample.comOpen full profile

Safe The verdict is safe because Google Safe Browsing and all 92 VirusTotal vendors flag nothing, no blocklists list it, Spamhaus's reputation score is positive, and the domain has existed for 31 years.

Infrastructure · Says it is run by Internet Assigned Numbers Authority (IANA)

example.com is a reserved domain meant for use in documentation and examples, and its homepage says as much. It serves writers, developers and educators who need a safe placeholder domain. It is not a real service and should not be relied on for testing or monitoring.

Background: example.com, along with example.net and example.org, is reserved by the IETF for documentation purposes (RFC 2606, later RFC 6761). IANA manages it. (from the model’s own knowledge, not our checks)

Worth knowing: The homepage states: "This domain is for use in documentation examples without needing permission. This is not a service; avoid relying on it for testing and monitoring purposes."

Why this verdict

  • Pass: Google Safe Browsing doesn’t list it.

  • Pass: None of the 92 security vendors on VirusTotal flag it.

  • Pass: It isn’t on any of the 9 domain blocklists that answered.

  • Pass: Spamhaus’s reputation score for it is positive (+34.3).

  • Pass: It was registered 31 years ago.

Written by Claude Sonnet 5.5 (high confidence) from this site’s checks Oct 14, 2026, 7:40 PM UTC. The verdict comes from fixed rules over the checks, not from the model. AI text can be wrong; the checks it used are listed on the AI intelligence page.

Fix first: 8 problems and 9 warnings

  • Problem: TLS 1.1 enabledTLS checker

    TLS 1.1 is deprecated (RFC 8996) and capped at B.

  • Problem: TLS 1.0 enabledTLS checker

    TLS 1.0 is deprecated (RFC 8996) and capped at B.

  • Problem: 3DES acceptedTLS checker

    DES-CBC3-SHA.

  • Problem: HTTPSSecurity headers

    Served over HTTPS, but plain HTTP doesn’t redirect to it.

  • Problem: Strict-Transport-SecuritySecurity headers

    Not set.

  • Problem: Content-Security-PolicySecurity headers

    Not set.

  • Problem: Clickjacking protectionSecurity headers

    Neither X-Frame-Options nor CSP frame-ancestors is set, so any site can frame this page.

  • Problem: X-Content-Type-OptionsSecurity headers

    Not set, so browsers may guess content types.

  • Warning: Sender rules: alignmentSender requirements checker

    No DKIM key was found at the common selectors, so alignment may rest on SPF alone, which aligns only when the Return-Path (envelope sender) is example.com.

  • Warning: No aggregate reports (rua)DMARC checker

    Without rua, receivers send no reports, so you can’t see who sends mail as your domain or whether your own mail passes.

  • Warning: 1 lookup couldn’t be checkedBlacklist check

    They count as unknown, not clean.

  • Warning: Some suites lack forward secrecyTLS checker

    AES128-GCM-SHA256, AES256-GCM-SHA384, AES128-SHA, AES256-SHA and 3 more.

  • Warning: CBC suites offered over TLS 1.2TLS checker

    8 forward-secret CBC suites (ECDHE-ECDSA-AES128-SHA, ECDHE-ECDSA-AES256-SHA, ECDHE-ECDSA-AES128-SHA256 and 5 more).

  • Warning: No HSTS headerTLS checker

    Without Strict-Transport-Security, a first visit over plain HTTP can be downgraded.

  • Warning: Referrer-PolicySecurity headers

    Not set.

  • Warning: Permissions-PolicySecurity headers

    Not set.

  • Warning: The destination is served over plain HTTPRedirect trace

    Anything typed into it can be read or changed on the way.

Setup at a glance

Mail provider
Receives no mail (null MX)
SPF
-all
DKIM
Every selector answers (wildcard)
DMARC
p=reject
DMARC reports
None set
BIMI
None
DNSSEC
On
DNS hosting
Cloudflare DNS
CDN
Cloudflare (proxied)
Registrar
RESERVED-Internet Assigned Numbers Authority
Registered
1995-08-14
Expires
2027-08-13
Website network
AS13335 Cloudflare, Inc. (US)
TLS certificate
SSL Corporation, expires 2026-12-25
Technologies
Cloudflare
Blocklists
Not listed
VirusTotal
Clean
Google Safe Browsing
Not listed
Spamhaus reputation
+34.3
AI verdict
Safe · infrastructure

Email authentication2 need attention, 1 to tighten

Deliverability score

example.com

Pass

example.com doesn’t receive email.

It publishes a null MX and locks down SPF and DMARC, so receivers that enforce DMARC reject mail sent in its name.

  • Null MX: receives no mail
  • SPF 0/10 lookups

Sender requirements checker

example.com

Partly meets

Partly meets the Gmail, Yahoo and Microsoft sender rules that DNS can show.

To look at: DKIM, alignment. Rules that depend on the message itself need a test message.

  • Gmail: partly
  • Yahoo: partly
  • Microsoft: partly
  • Warning: Sender rules: DKIM
  • Warning: Sender rules: alignment

SPF checker

example.com

A+

The SPF record is valid and within every limit.

0 of 10 lookups, -all, no fixed IP ranges.

  • 0/10 lookups
  • -all

DKIM checker

example.com

Warning

Every selector answers, so the keys can’t be told apart.

A made-up selector (tanase-y9emh99n) also returns a record, so example.com answers every name under _domainkey.

DMARC checker

example.com

A

Spoofed mail is rejected: DMARC is fully enforced.

Published at _dmarc.example.com. p=reject, no working report address.

  • p=reject
  • No working report address
  • Warning: No aggregate reports (rua)

BIMI checker

example.com

Optional

This domain hasn’t set up BIMI.

BIMI is optional. DMARC is already enforced, so publishing a BIMI record is the next step to show your logo in Gmail, Apple Mail and Yahoo.

DANE checker

example.com

Note

This domain doesn’t accept mail.

The domain publishes a null MX (RFC 7505), so there is nothing for DANE to protect.

Reputation1 failed, 1 to tighten

Blacklist check

example.com

Not listed

No listings found for example.com.

The domain and its 4 mail and web addresses were checked against 38 blocklists. 1 lookup couldn’t be checked and count as unknown, not clean.

  • Domain + 4 addresses
  • 38 lists
  • 1 unknown
  • Warning: 1 lookup couldn’t be checked

VirusTotal check

example.com

Clean

No security vendor flags example.com.

61 of 92 rate it harmless and the rest have no opinion. A clean result isn’t a guarantee: new phishing sites can be missed for hours. Last analysed Oct 15, 2026.

  • 0 malicious
  • 0 suspicious
  • 92 vendors

Google Safe Browsing check

example.com

Not listed

Google’s Safe Browsing lists don’t include example.com.

Checked the site’s home address against Google’s malware, phishing and unwanted-software lists. Google’s site status, which also counts single pages, found no unsafe content on example.com. New threats can take hours to be listed.

  • Home address
  • Site status: No unsafe content found
  • Google Web Risk

Disposable email check

example.com

Not disposable

example.com isn’t disposable, but it can’t receive email.

example.com publishes a null MX record (RFC 7505), which says it accepts no email at all. Mail to it bounces.

  • 97,385 listed domains
  • Problem: Refuses all mail (null MX)

Website1 failed, 2 need attention

Redirect trace

http://example.com/

Review

The link goes to example.com, with no redirects.

The page is titled “Example Domain”. No domain in the chain is on Cloudflare’s malware and phishing blocklist. 1 thing to look at below.

  • No redirects
  • Ends at HTTP 200
  • Warning: The destination is served over plain HTTP

TLS checker

example.com

C

Working TLS, but 3 settings cap the grade.

TLS 1.3, TLS 1.2, TLS 1.1 and TLS 1.0 enabled, 32 cipher suites accepted, the certificate runs for 71 more days.

  • TLS 1.3, 1.2, 1.1, 1.0
  • Certificate: 71 days left
  • Problem: TLS 1.1 enabled
  • Problem: TLS 1.0 enabled
  • Problem: 3DES accepted
  • +3 more in the full results

Security headers

https://example.com/

F

5 important protections are missing.

Scored 22 of 100: 2 passed, 5 failed, 2 need attention.

  • No HSTS
  • No CSP
  • HTTP 200
  • Problem: HTTPS
  • Problem: Strict-Transport-Security
  • Problem: Content-Security-Policy
  • +4 more in the full results

Core Web Vitals check

example.com

Passes

example.com passes Core Web Vitals.

For 75% of real Chrome visits over the 28 days to Oct 13, 2026, loading (LCP 1.01 s), responsiveness (INP 82 ms) and visual stability (CLS 0.00) are in Google’s good range.

  • LCP 1.01 s
  • INP 82 ms
  • CLS 0.00
  • Whole site
  • Chrome UX Report

Domain and networkNothing to fix

Domain analyzer

example.com

2 services

example.com uses 2 services across 2 categories.

Mail by Accepts no email (null MX), DNS at Cloudflare DNS, web through Cloudflare (proxied). Registered with RESERVED-Internet Assigned Numbers Authority until Aug 13, 2027.

  • Mail: Accepts no email (null MX)
  • DNS: Cloudflare DNS
  • CDN: Cloudflare (proxied)

WHOIS lookup

example.com

Registered

example.com is registered with RESERVED-Internet Assigned Numbers Authority.

Created Aug 14, 1995 (31.2 years ago). Expires Aug 13, 2027, 301 days left.

  • RESERVED-Internet Assigned Numbers Authority
  • Since 1995
  • Expires Aug 13, 2027

ASN lookup

104.20.23.154

AS13335

AS13335 · Cloudflare, Inc.

104.20.23.154 is in 104.20.16.0/20 announced by AS13335 (United States, registered with ARIN on Jul 14, 2010). The route is RPKI valid.

  • 104.20.16.0/20
  • United States
  • RPKI valid

Change historysince October 15, 2026

    • First checkedMail: none (null MX) · SPF -all · DMARC p=reject · DKIM: every selector answers · Registrar: RESERVED-Internet Assigned Numbers Authority