Privacy

Each check sends only what it needs, to the services named below. A report runs the same checks as the individual tools, so the same information goes to the same places. It also requests the http:// and www or bare versions of the address. A calendar reminder you add is made in your browser, so nothing about it reaches us.

When you run an HTTP check, your URL is sent to our diagnostic server. That server contacts the destination and follows its redirects. The destination can see the URL requested, the selected request headers, and our server’s IP address.

A page audit makes the same request, reads the page’s HTML on our server, and fetches the site’s robots.txt, security.txt, its home page (for the icon link), and its icon, and asks for the page once more allowing compression. To weigh the page, it also asks for the size of up to 40 of the files the page links to, downloading one only when its server doesn’t say. The icon is sent to your browser inside the results, so your browser never contacts the site. We don’t run the page’s scripts. Text you type into the search preview stays in your browser.

A CORS check, when you give an origin in the redirect tracer, sends the final address what a browser would send first: an OPTIONS request with that origin, the method, and the header names you entered, or, when a browser wouldn’t ask first, a GET with the origin.

For DNS checks, our server sends only the hostname and selected record types to the resolvers you select: Cloudflare, Google, Quad9, or OpenDNS. The DNS lookup also asks the first of them for the reverse name of each address it finds. The hostname and record types are also sent to the domain’s own name servers, which already answer for it. An expected value you enter stays in your browser. They see our server’s IP address and process queries under their own privacy policies. The URL path and query string are not sent to DNS providers. Standard DNS queries are not encrypted in transit. To check DNSSEC, the hostname is also sent once to Cloudflare over HTTPS.

For email checks, our server asks Cloudflare for the domain’s MX and TXT records, the addresses of its mail servers, its DMARC record, the domains its SPF record includes, and the DKIM selector you enter, or common selectors when you ask us to try them, plus its MTA-STS and TLS-RPT records. When it has an MTA-STS record, we fetch its policy from mta-sts.<domain>. We also connect to mail.<domain>, imap.<domain>, and smtp.<domain> on mail app ports to read their certificates, sending nothing after the encrypted connection is set up. We don’t send any mail.

For TLS checks, our server resolves the hostname through its configured DNS resolver and connects to one public address on port 443, once for the certificate and once for each TLS version it tries. The destination sees the hostname in the TLS handshake and our server’s IP address. We do not send the URL path, query, cookies, or an HTTP request to that endpoint. No revocation or automatic issuer lookup is made.

For registration checks, we identify the registered domain using the Public Suffix List and find its HTTPS RDAP service through IANA. That service receives only the registered domain and our server’s IP address, not your URL path or query. We do not follow contact or registrar referral links.

The registration cache

We keep up to 256 registration summaries in server memory for up to 15 minutes. These contain the registered domain, public registration facts, notices, source, and observation time. We do not cache your submitted path, query, or subdomain. Registrant contact cards are discarded. Expired entries are removed on the next registration lookup, and a server restart clears the cache. Registry rate-limit hints may be retained for up to one hour. The IANA service directory is cached for up to 24 hours.

What stays in your browser

The application doesn’t save reports or a history of submitted URLs to a database. Copying or downloading a report creates a copy you control. Connected check summaries use browser memory only and clear on refresh. The only thing kept in your browser’s local storage is whether you prefer the Answers or Details view. Share and rerun links include the target URL in the fragment; anyone you share a link with can read that URL. Avoid checking URLs containing private access tokens.

What we count

To see which tools are used and what people run into, we count checks by day: how many of each kind our server answered, how many a rate limit turned away, and how many failed. When a report or tool finishes, your browser also tells our server which one ran and which kinds of results it found, such as an SPF record with too many DNS lookups, named by the Learn section that explains them. The counts don’t include the address you checked, your IP address, or anything else about you. Your IP address is held in memory for a minute, only to limit how often these reports are accepted. The total appears at the foot of every page.

Rate limits and hosting

The API temporarily keeps client identifiers and usage counters in memory to enforce limits. Idle counters expire after approximately 10 minutes. Our hosting and network providers may process connection metadata and operational logs according to their own policies.

The site is served through Cloudflare, which handles the secure connection to your browser. Cloudflare therefore sees each request, including the addresses you submit for checking, and processes it under its own privacy policy. Your browser may also report failed connections to Cloudflare (Network Error Logging).

No account or tracking

SignalDNS uses no advertising scripts, third-party analytics, or account cookies. Response cookie values are redacted from the displayed evidence. HTTP responses and submitted URLs are untrusted data and are displayed as text.