About dotvitals

What dotvitals does

You give dotvitals a domain, a URL or an IP address and it runs a set of read-only checks against it: DNS records and DNSSEC, email authentication (SPF, DKIM, DMARC, BIMI, MTA-STS, TLS-RPT), TLS certificate and protocol configuration, HTTP security headers and cookies, common open ports, WHOIS/RDAP registration data, page performance measured by loading the page in a real browser, and basic SEO signals.

Each finding is explained in plain language first, with a technical layer underneath for people who want the detail, and most findings link to a generator that produces the DNS record or header value needed to fix them.

Every individual check (SPF checker, DNSSEC checker, port checker, and so on) is also available on its own page under Tools, so you do not have to run a full report to look up one thing.

The email header analyzer is the one tool that works differently: it runs entirely inside your browser, and the headers you paste never reach a server of ours at all. The privacy policy explains what that means.

What it deliberately does not do

dotvitals only runs checks that are equivalent to things a browser, a mail server or a normal DNS client already does when they interact with a site: DNS lookups, an HTTP GET of the homepage, a TLS handshake, an SMTP EHLO, a connect-only probe of a short list of common ports.

• It never attempts to exploit a vulnerability, brute-force credentials or directories, or send test emails to anyone.
• It never scans arbitrary port ranges or crawls more than a handful of pages without the target owner verifying ownership first.
• It never targets internal, private or cloud-metadata addresses; every resolved address is validated before any connection is made, and the probe host's own firewall refuses the same ranges a second time.

The full detail of what is probed, which addresses our traffic comes from, and how a server owner can ask about or opt out of being checked lives on the scanner policy page.

How dotvitals is funded

dotvitals is free to use, with no account required for the checks described above. Running the scanners, the edge infrastructure and the outbound probing has an ongoing cost, and the plan is to cover that cost with advertising rather than a paywall or a subscription.

No advertising is enabled today. There are no ad scripts loaded, no ad network cookies set, and no consent banner shown, because there is nothing here that needs consent. This is stated plainly so it does not need to be taken on trust: you can verify it in your browser's network tab on any page. The cookie policy lists everything this site stores in your browser, and it is updated before any of that changes.

dotvitals does not sell access to scan data, does not sell the list of domains people check, and does not use the domain you submit as an advertising signal.

Who runs dotvitals

dotvitals is a personal project, not a company. Nothing here was incorporated, nothing is registered anywhere, and there is no office — one person builds it, pays for the servers, and reads the mailboxes.

dotvitals is built and operated from Romania. contact@dotvitals.com is the address for anything about the site and abuse@dotvitals.com for anything about a scan that reached your server; both are read by the person who runs it rather than by a support queue.

The operator's full identity is provided to a data protection or other supervisory authority that asks for it, and on a legitimate legal request.

Accuracy and scope

dotvitals reports what its checks observed at the time they ran. DNS, TLS and HTTP configurations change, propagation takes time, and some checks are served from a short-lived cache rather than a fresh probe — the result page always shows when a result was captured.

When a check could not run, dotvitals says so instead of reporting a pass. A module that failed is reported as untested, with the reason, and the rest of the report is still shown.

A clean report is not a security guarantee and a failing check is not proof of an active problem; both are inputs to your own judgment, not a substitute for it. See the terms of service for the full disclaimer.

Where to go next

• Read the scanner policy before scanning a domain you do not control.
• Read the privacy policy to see exactly what is stored about a scan and for how long.
• Use the contact page for general questions, corrections, takedown requests or abuse reports.
• Report a security issue in dotvitals itself through /.well-known/security.txt.