Infrastructure
· 17 checks — DNS, redirects, IPv6, crawlability, URL variants, and domain intelligence rolled into one auditable list.DCDN & DeliveryActionNo CDN detectedFIX
Consider using a CDN to improve global delivery speed and reduce origin load.
BDNS Records1 A records, 34 ms lookupREVIEW
| A | 9.163.40.246 |
| AAAA | — |
| CNAME | victorious-desert-0e3a17c10.7.azurestaticapps.net |
| NS | — |
| MX | — |
| TXT | — |
| CAA | Lookup not available with standard resolver |
Multiple A records provide failover if one server goes down.
Single A record means a single point of failure — if that IP goes down, your site is unreachable until DNS TTL expires.
Learn more ▾ ▴
Add multiple A records for round-robin failover, or use a managed DNS provider with health-checked failover (Route 53, Cloudflare, NS1). Short TTL (60-300s) lets clients recover faster on outages.
Source: SRE practice / DNS architecture
A CNAME at the zone apex can break MX and NS records. Use ALIAS/ANAME or A records instead.
CNAME at the apex (example.com) breaks every other apex record (MX, TXT, NS) — DNS-protocol violation per RFC 1034.
Learn more ▾ ▴
RFC 1034 forbids CNAME alongside other records at the same name. Some DNS providers offer ALIAS / ANAME / flattened-CNAME records that work around this — use those instead. Otherwise apex-level CNAME breaks email (no MX), domain ownership verification (no TXT), and more.
Source: RFC 1034
SPF helps prevent email spoofing. Add a TXT record starting with 'v=spf1'.
Without SPF, receiving servers can't validate sending IPs — your domain is easier to spoof in phishing.
Learn more ▾ ▴
SPF complements DMARC. Both should be published. SPF records list authorized sending IPs (e.g., `v=spf1 include:_spf.google.com ~all` for Google Workspace). After publishing, verify in Google Postmaster Tools or mxtoolbox.
Source: RFC 7208 (SPF)
BDNSSECUnsigned (DNSSEC not deployed)REVIEW
BCAA RecordsNo CAA records (any CA may issue certificates)REVIEW
CReverse DNSAction0/1 IPs match cert SANREVIEW
CIPv6 ReadinessActionNo IPv6 supportREVIEW
IPv6 support is increasingly important for global accessibility. About 40% of internet users have IPv6 connectivity.
No AAAA records — same impact as 'no IPv6 (AAAA) records'; IPv6-preferring clients pay extra latency falling back to IPv4.
Source: Google IPv6 stats
CCrawlabilityActionrobots.txt present, sitemap with 0 URLsREVIEW
Search engines may not be able to parse the sitemap. Fix XML validation errors.
An unparseable sitemap is silently ignored by Google — the URLs it advertises are never queued for crawl.
Learn more ▾ ▴
Google's sitemap parser is strict about XML validity. A single unescaped `&` or unclosed tag invalidates the whole file. Run your sitemap through a validator (Search Console's Sitemaps report flags it) and fix the offending entry. Most generators escape correctly; mistakes usually come from manually-written entries.
Source: sitemaps.org / Google Search Central
An empty sitemap provides no value. Add <url> entries for your pages.
An empty sitemap signals 'no content to index' to Google — actively harmful versus having no sitemap at all.
Learn more ▾ ▴
Google compares URLs in the sitemap against URLs it has crawled. An empty sitemap on a site with thousands of pages signals abandonment. Either populate it correctly (most CMSes auto-generate) or delete the file and let Google crawl normally.
Source: Google Search Central / sitemaps.org
Add a 'Sitemap:' directive to robots.txt so search engines can discover your sitemap.
robots.txt omits Sitemap: directive — crawlers must fetch /sitemap.xml by convention; reliable but missing the explicit hint.
Source: sitemaps.org
<!doctype html>
<html lang="en">
<head>
<meta charset="utf-8">
<title>
Kumorai - Multi-Cloud Automation, Orchestration, Compliance & Governance
</title>
<base href="/">
<meta content="width=device-width, initial-scale=1" name="viewport">
<link href="favicon.ico" rel="icon" type="image/x-icon">
<link rel="apple-touch-icon" sizes="180x180" href="apple-touch-icon.png">
<link rel="icon" type="image/png" sizes="32x32" href="favicon-32x32.png">
<link rel="icon" type="image/png" sizes="16x16" href="favicon-16x16.png">
<!-- <link rel="manifest" href="site.webmanifest"> -->
<link href="https://fonts.googleapis.com/icon?family=Material+Icons" rel="stylesheet">
<style>
@import url('https://fonts.googleapis.com/css2?family=Poppins:wght@300;400;600&display=swap');
</style>
<script src="assets/sql-formatter/sql-formatter.min.js"></script>
<link rel="stylesheet" href="styles.185da9dbc3624d954685.css"></head>
<body dir="ltr">
<style>
#vex-splash-screen {
display: block;
position: absolute;
top: 0;
left: 0;
width: 100%;
height: 100%;
background: #13293d;
z-index: 99999;
pointer-events: none;
}
#vex-splash-screen>.wrapper {
position: fixed;
top: 50%;
left: 50%;
transform: translate(-50%, -50%);
-webkit-transform: translate(-50%, -50%);
}
@-webkit-keyframes ball-scale-multiple {
0% {
-webkit-transform: scale(0);
transform: scale(0);
opacity: 0;
}
5% {
opacity: 1;
}
100% {
-webkit-transform: scale(1);
transform: scale(1);
opacity: 0;
}
}
@keyframes ball-scale-multiple {
0% {
-webkit-transform: scale(0);
transform: scale(0);
opacity: 0;
}
5% {
opacity: 1;
}
100% {
-webkit-transform: scale(1);
transform: scale(1);
opacity: 0;
}
}
.ball-scale-multiple {
position: relative;
-webkit-transform: translateY(-30px);
transform: translateY(-30px);
}
.ball-scale-multiple>div:nth-child(2) {
-webkit-animation-delay: -0.4s;
animation-delay: -0.4s;
}
.ball-scale-multiple>div:nth-child(3) {
-webkit-animation-delay: -0.2s;
animation-delay: -0.2s;
}
.ball-scale-multiple>div {
background-color: #fff;
border-radius: 100%;
-webkit-animation-fill-mode: both;
animation-fill-mode: both;
position: absolute;
left: -30px;
top: 0;
opacity: 0;
margin: 0;
width: 60px;
height: 60px;
-webkit-animation: ball-scale-multiple 1s 0s linear infinite;
animation: ball-scale-multiple 1s 0s linear infinite;
}
</style>
<div id="vex-splash-screen">
<div class="wrapper">
<div class="ball-scale-multiple">
<div></div>
<div></div>
<div></div>
</div>
</div>
</div>
<vex-root></vex-root>
<app-redirect></app-redirect>
<script src="runtime.3bed62c1df71dc36c41a.js" defer></script><script src="polyfills.be9a603a93183832c964.js" defer></script><script src="scripts.1997f9227ae5e5638520.js" defer></script><script src="main.b2e477fcccefdded4d1f.js" defer></script></body>
</html>
BTLS Certificate Expiry & Recommendations183 days until leaf cert expires — 2 issues to addressREVIEW
Certificate validity
Recommended actions
- Extend HSTS max-age to at least 31536000 (1 year) to meet the preload list criteria
- Enable DNSSEC on your domain for DNS spoofing protection
BCDN Cache ObservabilityNo CDN cache-status headers in the responseREVIEW
BOperational Status PageNo status page link detectedREVIEW
A+Subdomain TakeoverNo subdomain takeover risk detectedPASS
A+Multi-Resolver DNS SpeedMean 33ms across 3 resolvers (spread 5ms)PASS
A+Redirect ChainNo redirects — direct accessPASS
https://intent.kumorai.io
482 ms · HTTP/1.1 FINAL
| # | URL | Status | Time | Protocol | Server |
|---|---|---|---|---|---|
| 1 | https://intent.kumorai.io | 200 | 482 ms | HTTP/1.1 |
A+URL Variantswww/non-www, trailing slash, HTTP→HTTPSPASS
www / non-www
HTTP → HTTPS
Consistent
ADomain Intelligencekumorai.io — via Gandi SAS, 5 years, 11 months oldPASS
48 days
October 13, 2026
183 days
Issued by DigiCert Inc
5 years, 11 months
Registered October 13, 2020
Status unknown
Protects against DNS spoofing
Unknown
2603:1061:14:21::1
Gandi SAS
Expiry timeline
Recommended actions
- Renew the domain or enable auto-renewal to prevent accidental expiry
Consider enabling auto-renewal to prevent accidental expiration.
Domain expiry approaching — renew immediately and ensure auto-renew + alerting are configured.
Source: ICANN renewal policy
Domain cannot be transferred without explicit unlock from the registrar. This protects against unauthorized transfers.
Registrar lock (clientTransferProhibited et al.) prevents unauthorized domain transfers — strongest defense against domain hijacking.
Source: ICANN / domain-security best practice