Full report

example.org email and security report

All 20 checks for example.org on one page, last run October 15, 2026; DNS, website and WHOIS checks repeat every 14 days.

By using these tools you accept the Terms and the Privacy page.

Full report · Domain

example.org

3 of 20 checks failed, 4 need attention. 1 passed with things to tighten.

Checked Oct 15, 2026; next free refresh due Oct 29, 2026.

Up to 5 re-checks a day per network.

  • 3 failed
  • 4 need attention
  • 8 passed
  • 5 for information

Spamhaus intelligenceexample.org

The Spamhaus Intelligence API didn’t answer. Try again in a minute.

AI intelligenceexample.orgOpen full profile

Caution The verdict is caution because the domain appears on one domain blocklist (HostKarma), even though Google Safe Browsing and all 92 VirusTotal vendors report nothing and the domain is 31 years old.

Infrastructure · Says it is run by ICANN

example.org is a reserved example domain whose homepage reads "Example Domain" and says it is for use in documentation examples without needing permission. It serves writers and developers who need a safe placeholder hostname, and it is explicitly not a service. It was registered 31 years ago (1995) and sits behind Cloudflare.

Background: example.org, along with example.com and example.net, is reserved for documentation and testing use under IANA/IETF rules (RFC 2606, later RFC 6761), and the IANA-managed example domains are widely used in technical documentation. (from the model’s own knowledge, not our checks)

Worth knowing: The domain publishes a null MX record, so it accepts no email, and it enforces DMARC with p=reject and SPF with -all.

Why this verdict

  • Warning: It is listed on one domain blocklist (HostKarma).

  • Pass: Google Safe Browsing doesn’t list it.

  • Pass: None of the 92 security vendors on VirusTotal flag it.

  • Pass: It was registered 31 years ago.

Written by Claude Sonnet 5.5 (high confidence) from this site’s checks Oct 15, 2026, 1:04 PM UTC. The verdict comes from fixed rules over the checks, not from the model. AI text can be wrong; the checks it used are listed on the AI intelligence page.

Fix first: 9 problems and 8 warnings

  • Problem: example.org is on HostKarmaBlacklist check

    Black list: domain of a confirmed spam source

  • Problem: TLS 1.1 enabledTLS checker

    TLS 1.1 is deprecated (RFC 8996) and capped at B.

  • Problem: TLS 1.0 enabledTLS checker

    TLS 1.0 is deprecated (RFC 8996) and capped at B.

  • Problem: 3DES acceptedTLS checker

    DES-CBC3-SHA.

  • Problem: HTTPSSecurity headers

    Served over HTTPS, but plain HTTP doesn’t redirect to it.

  • Problem: Strict-Transport-SecuritySecurity headers

    Not set.

  • Problem: Content-Security-PolicySecurity headers

    Not set.

  • Problem: Clickjacking protectionSecurity headers

    Neither X-Frame-Options nor CSP frame-ancestors is set, so any site can frame this page.

  • Problem: X-Content-Type-OptionsSecurity headers

    Not set, so browsers may guess content types.

  • Warning: Sender rules: alignmentSender requirements checker

    No DKIM key was found at the common selectors, so alignment may rest on SPF alone, which aligns only when the Return-Path (envelope sender) is example.org.

  • Warning: No aggregate reports (rua)DMARC checker

    Without rua, receivers send no reports, so you can’t see who sends mail as your domain or whether your own mail passes.

  • Warning: Some suites lack forward secrecyTLS checker

    AES128-GCM-SHA256, AES256-GCM-SHA384, AES128-SHA, AES256-SHA and 3 more.

  • Warning: CBC suites offered over TLS 1.2TLS checker

    8 forward-secret CBC suites (ECDHE-ECDSA-AES128-SHA, ECDHE-ECDSA-AES256-SHA, ECDHE-ECDSA-AES128-SHA256 and 5 more).

  • Warning: No HSTS headerTLS checker

    Without Strict-Transport-Security, a first visit over plain HTTP can be downgraded.

  • Warning: Referrer-PolicySecurity headers

    Not set.

  • Warning: Permissions-PolicySecurity headers

    Not set.

  • Warning: The destination is served over plain HTTPRedirect trace

    Anything typed into it can be read or changed on the way.

Setup at a glance

Mail provider
Receives no mail (null MX)
SPF
-all
DKIM
Every selector answers (wildcard)
DMARC
p=reject
DMARC reports
None set
BIMI
None
DNSSEC
On
DNS hosting
Cloudflare DNS
CDN
Cloudflare (proxied)
Registrar
ICANN
Registered
1995-08-31
Expires
2027-08-30
Website network
AS13335 Cloudflare, Inc. (US)
TLS certificate
SSL Corporation, expires 2026-12-25
Technologies
Cloudflare
Blocklists
1 listing
VirusTotal
Clean
Google Safe Browsing
Not listed
AI verdict
Caution · infrastructure

Email authentication2 need attention, 1 to tighten

Pass

example.org doesn’t receive email.

It publishes a null MX and locks down SPF and DMARC, so receivers that enforce DMARC reject mail sent in its name.

  • Null MX: receives no mail
  • SPF 0/10 lookups
Partly meets

Partly meets the Gmail, Yahoo and Microsoft sender rules that DNS can show.

To look at: DKIM, alignment. Rules that depend on the message itself need a test message.

  • Gmail: partly
  • Yahoo: partly
  • Microsoft: partly
  • Warning: Sender rules: DKIM
  • Warning: Sender rules: alignment

SPF checker

example.org

A+

The SPF record is valid and within every limit.

0 of 10 lookups, -all, no fixed IP ranges.

  • 0/10 lookups
  • -all

DKIM checker

example.org

Warning

Every selector answers, so the keys can’t be told apart.

A made-up selector (tanase-buuzyi7p) also returns a record, so example.org answers every name under _domainkey.

DMARC checker

example.org

A

Spoofed mail is rejected: DMARC is fully enforced.

Published at _dmarc.example.org. p=reject, no working report address.

  • p=reject
  • No working report address
  • Warning: No aggregate reports (rua)

BIMI checker

example.org

Optional

This domain hasn’t set up BIMI.

BIMI is optional. DMARC is already enforced, so publishing a BIMI record is the next step to show your logo in Gmail, Apple Mail and Yahoo.

DANE checker

example.org

Note

This domain doesn’t accept mail.

The domain publishes a null MX (RFC 7505), so there is nothing for DANE to protect.

Reputation2 failed

Blacklist check

example.org

1 listing

example.org has 1 listing.

the domain is on 1 domain blocklist (HostKarma). Details and delisting links are below.

  • Domain + 4 addresses
  • 38 lists
  • 1 unknown
  • Problem: example.org is on HostKarma

VirusTotal check

example.org

Clean

No security vendor flags example.org.

59 of 92 rate it harmless and the rest have no opinion. A clean result isn’t a guarantee: new phishing sites can be missed for hours. Last analysed Oct 15, 2026.

  • 0 malicious
  • 0 suspicious
  • 92 vendors
Not listed

Google’s Safe Browsing lists don’t include example.org.

Checked the site’s home address against Google’s malware, phishing and unwanted-software lists. Google’s site status, which also counts single pages, found no unsafe content on example.org. New threats can take hours to be listed.

  • Home address
  • Site status: No unsafe content found
  • Google Web Risk
Not disposable

example.org isn’t disposable, but it can’t receive email.

example.org publishes a null MX record (RFC 7505), which says it accepts no email at all. Mail to it bounces.

  • 97,385 listed domains
  • Problem: Refuses all mail (null MX)

Website1 failed, 2 need attention

Redirect trace

http://example.org/

Review

The link goes to example.org, with no redirects.

The page is titled “Example Domain”. No domain in the chain is on Cloudflare’s malware and phishing blocklist. 1 thing to look at below.

  • No redirects
  • Ends at HTTP 200
  • Warning: The destination is served over plain HTTP

TLS checker

example.org

C

Working TLS, but 3 settings cap the grade.

TLS 1.3, TLS 1.2, TLS 1.1 and TLS 1.0 enabled, 32 cipher suites accepted, the certificate runs for 71 more days.

  • TLS 1.3, 1.2, 1.1, 1.0
  • Certificate: 71 days left
  • Problem: TLS 1.1 enabled
  • Problem: TLS 1.0 enabled
  • Problem: 3DES accepted
  • +3 more in the full results

Security headers

https://example.org/

F

5 important protections are missing.

Scored 22 of 100: 2 passed, 5 failed, 2 need attention.

  • No HSTS
  • No CSP
  • HTTP 200
  • Problem: HTTPS
  • Problem: Strict-Transport-Security
  • Problem: Content-Security-Policy
  • +4 more in the full results
Passes

example.org passes Core Web Vitals.

For 75% of real Chrome visits over the 28 days to Oct 13, 2026, loading (LCP 675 ms), responsiveness (INP 38 ms) and visual stability (CLS 0.00) are in Google’s good range.

  • LCP 675 ms
  • INP 38 ms
  • CLS 0.00
  • Whole site
  • Chrome UX Report

Domain and networkNothing to fix

Domain analyzer

example.org

2 services

example.org uses 2 services across 2 categories.

Mail by Accepts no email (null MX), DNS at Cloudflare DNS, web through Cloudflare (proxied). Registered with ICANN until Aug 30, 2027.

  • Mail: Accepts no email (null MX)
  • DNS: Cloudflare DNS
  • CDN: Cloudflare (proxied)

WHOIS lookup

example.org

Registered

example.org is registered with ICANN.

Created Aug 31, 1995 (31.1 years ago). Expires Aug 30, 2027, 318 days left.

  • ICANN
  • Since 1995
  • Expires Aug 30, 2027

ASN lookup

104.20.26.136

AS13335

AS13335 · Cloudflare, Inc.

104.20.26.136 is in 104.20.16.0/20 announced by AS13335 (United States, registered with ARIN on Jul 14, 2010). The route is RPKI valid.

  • 104.20.16.0/20
  • United States
  • RPKI valid

Change historysince October 15, 2026

    • First checkedMail: none (null MX) · SPF -all · DMARC p=reject · DKIM: every selector answers · Registrar: ICANN