Infrastructure - https://eanhost.dpdns.org BeaverCheck Audit

D

Crawlability

Action

robots.txt present, no sitemap

FIX

robots.txt present, no sitemap

robots.txt is present

Got: 26 bytes

robots.txt blocks all crawlers

Disallow: / for all user-agents prevents search engines from indexing any page. This will remove the site from search results.

No sitemap.xml found

A sitemap helps search engines discover and index your pages more efficiently.

robots.txt does not reference a sitemap

Add a 'Sitemap:' directive to robots.txt so search engines can discover your sitemap.

Disallow: / for all user-agents prevents search engines from indexing any page. This will remove the site from search results.

Why this matters

Disallow: / in robots.txt blocks every search crawler — the site becomes invisible in organic search.

Learn more ▾

Common deployment mistake: a staging robots.txt with `User-agent: * / Disallow: /` ships to prod. The site falls out of search results within days. Verify your robots.txt is the production-intended version. If this is intentional (private site), no action needed.

Source: Google Search Central

A sitemap helps search engines discover and index your pages more efficiently.

Why this matters

No sitemap.xml — Google relies on crawl-graph discovery alone, slowing indexing of deep or fresh URLs.

Learn more ▾

A sitemap accelerates Google's discovery of new and updated content. Most CMSes auto-generate one; static-site frameworks need a build-step plugin. Reference it from robots.txt and submit in Search Console to confirm Google can fetch it.

Source: sitemaps.org / Google Search Central

Add a 'Sitemap:' directive to robots.txt so search engines can discover your sitemap.

Why this matters

robots.txt omits Sitemap: directive — crawlers must fetch /sitemap.xml by convention; reliable but missing the explicit hint.

Source: sitemaps.org

robots.txt 200 OK

Size 26 B Sitemaps referenced 0 User-agents * Blocking Yes — all crawlers blocked

User-agent: *
Disallow: /

sitemap.xml No sitemap found

No sitemap found

Adding a sitemap helps search engines discover your pages.

B

DNSSEC

Unsigned (DNSSEC not deployed)

REVIEW

Unsigned (DNSSEC not deployed)

DNSSEC is not deployed

The zone is not DNSSEC-signed. Users on validating resolvers (Cloudflare 1.1.1.1, Quad9 9.9.9.9, growing default in mobile resolvers) get no protection against DNS spoofing for this domain. Most registrars now offer DNSSEC at a single click; consider enabling it for sites where authenticity matters (banking, healthcare, government).

B

CAA Records

No CAA records (any CA may issue certificates)

REVIEW

No CAA records (any CA may issue certificates)

No CAA records published

Without CAA records, any publicly-trusted CA can issue certificates for this domain. Adding a CAA record (`yourdomain. IN CAA 0 issue "letsencrypt.org"`) restricts issuance to CAs you authorize. Required by CAB Forum baseline since 2017; the default of 'any CA' is widely supported but is the broader attack surface for issuance fraud.

C

Reverse DNS

Action

0/4 IPs match cert SAN

REVIEW

0/4 IPs match cert SAN

PTR lookup failed for 188.114.96.2: lookup 188.114.96.2: no such host

No reverse DNS record set for this IP. Common on bare cloud-VM IPs without provider-side PTR; not a security issue.

PTR lookup failed for 188.114.97.2: lookup 188.114.97.2: no such host

No reverse DNS record set for this IP. Common on bare cloud-VM IPs without provider-side PTR; not a security issue.

PTR lookup failed for 2a06:98c1:3121::2: lookup 2a06:98c1:3121::2: no such host

No reverse DNS record set for this IP. Common on bare cloud-VM IPs without provider-side PTR; not a security issue.

PTR lookup failed for 2a06:98c1:3120::2: lookup 2a06:98c1:3120::2: no such host

No reverse DNS record set for this IP. Common on bare cloud-VM IPs without provider-side PTR; not a security issue.

B

Multi-Resolver DNS Speed

Mean 109ms across 3 resolvers (spread 112ms)

REVIEW

Mean 109ms across 3 resolvers (spread 112ms)

Google: 55ms

Got: 55ms via 8.8.8.8:53

Cloudflare: 107ms

Got: 107ms via 1.1.1.1:53

Quad9: 167ms

Got: 167ms via 9.9.9.9:53

B

TLS Certificate Expiry & Recommendations

81 days until leaf cert expires — 3 issues to address

REVIEW

Certificate validity

81

days left

0d 30d 60d 90d+

Recommended actions

Enable HSTS: Strict-Transport-Security: max-age=31536000; includeSubDomains
Enable DNSSEC on your domain for DNS spoofing protection
Enable OCSP stapling on your TLS server to remove a CA roundtrip and protect user privacy

B

Operational Status Page

No status page link detected

REVIEW

No status page link detected

No operational status page link detected

Status pages communicate planned maintenance and incidents to users -- a hallmark of operationally-mature services. Most SaaS teams publish one via Atlassian Statuspage, Instatus, BetterUptime, or a self-hosted Cachet. Smaller sites legitimately don't need one; flagged as Info, not a failure.

B

Health Check Endpoint

No conventional health endpoint found

REVIEW

No conventional health endpoint found

Health endpoints (/health, /healthz, /status, /ping, /api/health) let uptime monitors, load balancers, and orchestration systems (Kubernetes, ECS, Fly.io) verify the service is alive. Marketing sites and small services often skip them legitimately; flagged as Info, not a failure. Probe results: /api/health: 404, /health: 404, /healthz: 404, /ping: 404, /status: 404.

A+

DNS Records

2 A records, 186 ms lookup

PASS

2 A records, 186 ms lookup

Resolves to 2 IPv4 address(es)

Got: 188.114.96.2, 188.114.97.2

Has 2 IPv6 (AAAA) record(s)

Got: 2a06:98c1:3121::2, 2a06:98c1:3120::2

2 nameserver(s) configured

Got: john.ns.cloudflare.com, faye.ns.cloudflare.com

No MX records — email not configured via DNS

No SPF record found in TXT records

SPF helps prevent email spoofing. Add a TXT record starting with 'v=spf1'.

DNS resolution time: 186 ms

Got: 186 ms

A	188.114.96.2, 188.114.97.2
AAAA	2a06:98c1:3121::2, 2a06:98c1:3120::2
CNAME	—
NS	john.ns.cloudflare.com, faye.ns.cloudflare.com
MX	—
TXT	—
CAA	Lookup not available with standard resolver

Resolved in 186 ms

SPF helps prevent email spoofing. Add a TXT record starting with 'v=spf1'.

Why this matters

Without SPF, receiving servers can't validate sending IPs — your domain is easier to spoof in phishing.

Learn more ▾

SPF complements DMARC. Both should be published. SPF records list authorized sending IPs (e.g., `v=spf1 include:_spf.google.com ~all` for Google Workspace). After publishing, verify in Google Postmaster Tools or mxtoolbox.

Source: RFC 7208 (SPF)

A+

Subdomain Takeover

No subdomain takeover risk detected

PASS

No subdomain takeover risk detected

No CNAME record present

A

Redirect Chain

1 redirect(s), 848 ms total

PASS

1 redirect(s), 848 ms total

Single redirect

Got: https://eanhost.dpdns.org → https://eanhost.dpdns.org/login (302)

Uses 302 (temporary) redirect

If permanent, use 301 instead.

Got: https://eanhost.dpdns.org

Redirect overhead: 848 ms total

Got: 848 ms

https://eanhost.dpdns.org

506 ms · HTTP/1.1

302

https://eanhost.dpdns.org/login

342 ms · HTTP/1.1 FINAL

#	URL	Status	Time	Protocol	Server
1	https://eanhost.dpdns.org	302	506 ms	HTTP/1.1	cloudflare
2	https://eanhost.dpdns.org/login	200	342 ms	HTTP/1.1	cloudflare

See the visual redirect chain in the HTTP Probe tab →

If permanent, use 301 instead.

Why this matters

302 (Found) is for genuinely temporary redirects — if this redirect is permanent, switch to 301 to preserve SEO equity.

Learn more ▾

Search engines treat 302 as temporary, keeping the original URL indexed and not transferring full link equity to the destination. Use 301 (Moved Permanently) for permanent redirects (HTTP→HTTPS, www-vs-non-www, URL restructures).

Source: Google Search Central

A+

IPv6 Readiness

IPv6 reachable (17 ms)

PASS

IPv6 reachable (17 ms)

IPv6 is configured and reachable at 2a06:98c1:3121::2, 2a06:98c1:3120::2

Got: 17 ms connect

IPv6 Ready

AAAA Records 2a06:98c1:3121::2, 2a06:98c1:3120::2 Connection Reachable (17 ms)

A+

URL Variants

www/non-www, trailing slash, HTTP→HTTPS

PASS

www/non-www, trailing slash, HTTP→HTTPS

HTTP correctly redirects to HTTPS permanently

Got: HTTP 301

www / non-www

https://www.eanhost.dpdns.org/

200https://eanhost.dpdns.org/

HTTP → HTTPS

301http://eanhost.dpdns.org/ → https://eanhost.dpdns.org/

Consistent

A

HTTP Probe Timing

Total 738 ms — DNS, TCP, TLS, TTFB, content transfer breakdown

PASS

DNS Lookup

186 ms

TCP Connect

18 ms

TLS Handshake

28 ms

Time to First Byte

738 ms

Total Time

739 ms

Connection waterfall

DNS Lookup 186 ms TCP Connect 18 ms TLS Handshake 28 ms Server Processing 506 ms Content Transfer 0 ms

A

CDN & Delivery

Cloudflare (DYNAMIC)

PASS

Cloudflare (DYNAMIC)

Document is served via Cloudflare CDN (edge: CDG)

Got: cf-ray: a5239952fd4da8a7-CDG

CDN cache status: DYNAMIC

Document served via CDN: Cloudflare

Provider Cloudflare Cache Status DYNAMIC Evidence cf-ray: a5239952fd4da8a7-CDG

A+

CDN Cache Observability

Cache state: DYNAMIC

PASS

Cache state: DYNAMIC

CDN cache state observable via 1 header(s)

Got: cf-cache-status=DYNAMIC

Domain Intelligence

Domain intelligence data not available

INFO

Domain intelligence data not available

RDAP and WHOIS lookup both failed