zerobounce.ai
Full report

zerobounce.com email and security report

All 20 checks for zerobounce.com on one page, last run October 15, 2026; DNS, website and WHOIS checks repeat every 14 days.

By using these tools you accept the Terms and the Privacy page.

Full report · Domain

zerobounce.com

3 of 20 checks need attention; none failed. 4 passed with things to tighten.

Checked Oct 15, 2026; next free refresh due Oct 29, 2026.

Up to 5 re-checks a day per network.

  • 3 need attention
  • 13 passed
  • 4 for information

Spamhaus intelligencezerobounce.com

Reputation +5.8 Positive: Spamhaus’s own score rates this domain as reputable.

Tags
None
Registered
Nov 3, 2016 at Cloudflare, Inc.
Expires
Nov 3, 2028
Last seen
Jul 16, 2026
Infrastructure score
+4.75
SMTP score
+1

Scores: positive is good, negative is bad, 0 is neutral. The overall score combines the dimensions (human, identity, infrastructure, malware, SMTP).

From the Spamhaus Intelligence API on Oct 15, 2026. It is asked again only when someone presses Re-check.

AI intelligencezerobounce.comOpen full profile

Safe The verdict is safe because Google Safe Browsing doesn't list the domain, none of the 92 VirusTotal vendors flag it, it isn't on any of the 9 domain blocklists that answered, and it was registered 9 years ago.

Software or service · Says it is run by ZeroBounce

zerobounce.com is a domain for ZeroBounce, an email validation and deliverability platform that offers list cleaning, email verification, an email finder, warmup, blacklist and DMARC monitoring, and APIs. It redirects to www.zerobounce.net and serves marketers, agencies, developers and enterprises that want to reduce bounces and improve inbox placement.

Background: ZeroBounce is an email validation company based in Santa Barbara, California, known for its email verification and deliverability tools. (from the model’s own knowledge, not our checks)

Worth knowing: The homepage redirects from zerobounce.com to www.zerobounce.net, and the domain enforces DMARC with p=reject.

Why this verdict

  • Pass: Google Safe Browsing doesn’t list it.

  • Pass: None of the 92 security vendors on VirusTotal flag it.

  • Pass: It isn’t on any of the 9 domain blocklists that answered.

  • Pass: It was registered 9 years ago.

Written by Claude Sonnet 5.5 (high confidence) from this site’s checks Oct 15, 2026, 2:32 PM UTC. The verdict comes from fixed rules over the checks, not from the model. AI text can be wrong; the checks it used are listed on the AI intelligence page.

Fix first: 1 problem and 8 warnings

  • Problem: The certificate has expiredBIMI checker

    It expired on 2026-06-20.

  • Warning: k1, mandrill: 1024-bit RSA keyDKIM checker

    Accepted, but RFC 8301 says signers SHOULD use at least 2048 bits, and 1024-bit keys are within reach of well-funded attackers.

  • Warning: Report size limit (!5k)DMARC checker

    RFC 9989 dropped the !size suffix, and receivers following it ignore it.

  • Warning: 1 lookup couldn’t be checkedBlacklist check

    They count as unknown, not clean.

  • Warning: Some suites lack forward secrecyTLS checker

    AES128-GCM-SHA256, AES256-GCM-SHA384, AES128-SHA, AES256-SHA and 2 more.

  • Warning: CBC suites offered over TLS 1.2TLS checker

    8 forward-secret CBC suites (ECDHE-ECDSA-AES128-SHA, ECDHE-ECDSA-AES256-SHA, ECDHE-ECDSA-AES128-SHA256 and 5 more).

  • Warning: No HSTS headerTLS checker

    Without Strict-Transport-Security, a first visit over plain HTTP can be downgraded.

  • Warning: Content-Security-PolicySecurity headers

    Set, but weakened: 'unsafe-inline' scripts are allowed; 'unsafe-eval' allows eval(); data: URLs allowed as scripts; scripts allowed over plain HTTP; wildcard s…

  • Warning: 1 link with an empty hrefBroken link checker

    An empty href reloads the current page.

Setup at a glance

Mail provider
Google Workspace
Mail servers (MX)
aspmx.l.google.com, alt1.aspmx.l.google.com +2 more
SPF
-all
DKIM
google (2048-bit RSA), k1 (1024-bit RSA) +5 more
DMARC
p=reject
DMARC reports
Own address (zerobounce.net!5k)
MTA-STS
None
TLS-RPT
Published
BIMI
Published with a VMC
DNSSEC
On
DNS hosting
Cloudflare DNS
CDN
Cloudflare (proxied)
Registrar
Cloudflare, Inc
Registered
2016-11-03
Expires
2028-11-03
Website network
AS13335 Cloudflare, Inc. (US)
TLS certificate
Google Trust Services, expires 2026-12-12
Technologies
Atlassian Statuspage, Cloudflare, Cloudflare Bot Management, Google Tag Manager, Google Workspace +9 more
Blocklists
Not listed
VirusTotal
Clean
Google Safe Browsing
Not listed
Spamhaus reputation
+5.8
AI verdict
Safe · software or service

Email authentication1 needs attention, 2 to tighten

Deliverability score

zerobounce.com

A

Strong setup, with a little hardening left.

Scored 93 of 100 across 16 checks: 14 passed, 2 notes.

  • Mail: Google Workspace
  • SPF 5/10 lookups
  • DMARC p=reject
  • Gmail/Yahoo DNS rules: met

Sender requirements checker

zerobounce.com

Meets

Meets the Gmail, Yahoo and Microsoft sender rules that DNS can show.

The rest depends on the mail you send: send a test message to check alignment, TLS, unsubscribe headers and the sending IP.

  • Gmail: meets
  • Yahoo: meets
  • Microsoft: meets

SPF checker

zerobounce.com

A+

The SPF record is valid and within every limit.

5 of 10 lookups, -all, 129,417 IPv4 addresses and 6 IPv6 ranges listed.

  • 5/10 lookups
  • -all
  • 129,417 IPv4 addresses

DKIM checker

zerobounce.com

A

7 DKIM keys found; 2 could be stronger.

Tried 60 selectors; found google, k1, mte1, mte2, mandrill, zendesk1, zendesk2.

  • google: RSA 2048 bits
  • k1: RSA 1024 bits
  • mte1: RSA 2048 bits
  • +4 more
  • Warning: k1, mandrill: 1024-bit RSA key

DMARC checker

zerobounce.com

A

Spoofed mail is rejected: DMARC is fully enforced.

Published at _dmarc.zerobounce.com. p=reject, aggregate reports to 1 address.

  • p=reject
  • Reports to 1 address
  • Warning: Report size limit (!5k)

BIMI checker

zerobounce.com

C

The logo is valid, but the certificate has a problem.

1 failed.

  • VMC certificate
  • Problem: The certificate has expired

DANE checker

zerobounce.com

Optional

DANE isn’t set up for this domain.

Mail to zerobounce.com uses opportunistic TLS: encrypted when possible, but a network attacker can strip it. The mail servers’ own DNS isn’t DNSSEC-signed, so DANE can’t be added for them; if they belong to your mail provider, only the provider can enable it. Missing DANE doesn’t break mail.

  • 4 mail servers
  • MX signed (DNSSEC)
  • 0 with DANE

Reputation1 to tighten

Blacklist check

zerobounce.com

Not listed

No listings found for zerobounce.com.

The domain and its 10 mail and web addresses were checked against 38 blocklists. 1 lookup couldn’t be checked and count as unknown, not clean. Allow-listed on SPFBL whitelist.

  • Domain + 10 addresses
  • 38 lists
  • 1 unknown
  • Warning: 1 lookup couldn’t be checked

VirusTotal check

zerobounce.com

Clean

No security vendor flags zerobounce.com.

56 of 92 rate it harmless and the rest have no opinion. A clean result isn’t a guarantee: new phishing sites can be missed for hours. Last analysed Oct 2, 2026.

  • 0 malicious
  • 0 suspicious
  • 92 vendors

Google Safe Browsing check

zerobounce.com

Not listed

Google’s Safe Browsing lists don’t include zerobounce.com.

Checked the site’s home address against Google’s malware, phishing and unwanted-software lists. Google’s site status, which also counts single pages, found no unsafe content on zerobounce.com. New threats can take hours to be listed.

  • Home address
  • Site status: No unsafe content found
  • Google Web Risk

Disposable email check

zerobounce.com

Not disposable

zerobounce.com isn’t on the disposable lists.

That doesn’t prove the address is real: new throwaway services appear every day.

  • 97,385 listed domains
  • Accepts mail (4 MXs)

Website2 need attention, 1 to tighten

Redirect trace

http://zerobounce.com/

Clean

The link goes to www.zerobounce.net after 1 redirect.

The page is titled “Email Validation Tools & Email List Cleaning | ZeroBounce”. No domain in the chain is on Cloudflare’s malware and phishing blocklist.

  • 1 redirect
  • Ends at HTTP 200
  • 2 domains

TLS checker

zerobounce.com

A

Solid TLS, with 3 things to tighten.

TLS 1.3 and TLS 1.2 enabled, 23 cipher suites accepted, the certificate runs for 57 more days.

  • TLS 1.3, 1.2
  • Certificate: 57 days left
  • Warning: Some suites lack forward secrecy
  • Warning: CBC suites offered over TLS 1.2
  • Warning: No HSTS header

Security headers

https://zerobounce.com/

B

Solid headers, with one thing to tighten.

Scored 78 of 100: 8 passed, 1 need attention.

  • HSTS preload
  • CSP weak
  • HTTP 200
  • Warning: Content-Security-Policy

Core Web Vitals check

zerobounce.com

No field data

Google has no real-user data for zerobounce.com.

The Chrome UX Report only includes sites and pages that search engines can find and that have enough Chrome visitors who share usage statistics, so smaller, newer or private sites aren’t in it. That says nothing about speed: a lab test such as Google PageSpeed Insights can still measure the page.

  • Chrome UX Report

Tech stack detector

https://zerobounce.com/

32 technologies

www.zerobounce.net runs on Next.js and Cloudflare.

32 technologies across 17 categories.

  • WordPress
  • Next.js
  • Cloudflare
  • Cloudflare Bot Management

Domain and networkNothing to fix

Domain analyzer

zerobounce.com

16 services

zerobounce.com uses 16 services across 9 categories.

Mail by Google Workspace, DNS at Cloudflare DNS, web through Cloudflare (proxied). Registered with Cloudflare, Inc. until Nov 3, 2028.

  • Mail: Google Workspace
  • DNS: Cloudflare DNS
  • CDN: Cloudflare (proxied)

WHOIS lookup

zerobounce.com

Registered

zerobounce.com is registered with Cloudflare, Inc.

Created Nov 3, 2016 (9.9 years ago). Expires Nov 3, 2028, 750 days left.

  • Cloudflare, Inc
  • Since 2016
  • Expires Nov 3, 2028

ASN lookup

104.18.2.114

AS13335

AS13335 · Cloudflare, Inc.

104.18.2.114 is in 104.18.0.0/20 announced by AS13335 (United States, registered with ARIN on Jul 14, 2010). The route is RPKI valid.

  • 104.18.0.0/20
  • United States
  • RPKI valid

Change historysince October 15, 2026

    • First checkedMail: Google Workspace · SPF -all · DMARC p=reject · DKIM: google, k1, mandrill +4 more · Registrar: Cloudflare, Inc