Skip to content
https://checkpoint.com

Infrastructure

· 9 checks — DNS, redirects, IPv6, crawlability, URL variants, and domain intelligence rolled into one auditable list.
SCORE
86
GRADE
B
FIX
1
REVIEW
1
PASS
7
INFO
0
Probed from Santa Clara, United States
301 Moved Permanently
Checks
9
7 PASS 1 REVIEW 1 FIX
F
IPv6 Readiness
Action
IPv6 records exist but unreachable
FIX
IPv6 records exist but unreachable
Warning::
IPv6 DNS records exist but server is not reachable
Having AAAA records but an unreachable server is worse than no AAAA — clients may experience delays before falling back to IPv4.
Got: 2600:9000:285b:400:13:1d23:bc80:93a1, 2600:9000:285b:5200:13:1d23:bc80:93a1, 2600:9000:285b:7a00:13:1d23:bc80:93a1, 2600:9000:285b:8a00:13:1d23:bc80:93a1, 2600:9000:285b:a800:13:1d23:bc80:93a1, 2600:9000:285b:bc00:13:1d23:bc80:93a1, 2600:9000:285b:e000:13:1d23:bc80:93a1, 2600:9000:285b:ea00:13:1d23:bc80:93a1
Info::
IPv6 connection error
Got: dial tcp6 [2600:9000:285b:400:13:1d23:bc80:93a1]:443: connect: network is unreachable
IPv6 Misconfigured
AAAA Records 2600:9000:285b:400:13:1d23:bc80:93a1, 2600:9000:285b:5200:13:1d23:bc80:93a1, 2600:9000:285b:7a00:13:1d23:bc80:93a1, 2600:9000:285b:8a00:13:1d23:bc80:93a1, 2600:9000:285b:a800:13:1d23:bc80:93a1, 2600:9000:285b:bc00:13:1d23:bc80:93a1, 2600:9000:285b:e000:13:1d23:bc80:93a1, 2600:9000:285b:ea00:13:1d23:bc80:93a1 Connection UNREACHABLE

Having AAAA records but an unreachable server is worse than no AAAA — clients may experience delays before falling back to IPv4.

Why this matters

Advertising IPv6 (AAAA records) without a reachable server means IPv6-preferring clients silently fail every connection.

Learn more ▾

Modern browsers prefer IPv6 if AAAA exists (Happy Eyeballs algorithm). If the IPv6 server isn't reachable, browsers fall back to IPv4 — but with seconds of added latency per request. Either fix IPv6 reachability or remove the AAAA records.

Source: RFC 8305 (Happy Eyeballs)

B
TLS Certificate Expiry & Recommendations
79 days until leaf cert expires — 2 issues to address
REVIEW

Certificate validity

79
days left
0d 30d 60d 90d+

Recommended actions

  • Add the preload directive and submit to hstspreload.org once max-age + includeSubDomains are in place
  • Enable OCSP stapling on your TLS server to remove a CA roundtrip and protect user privacy
A+
DNS Records
4 A records, 25 ms lookup
PASS
4 A records, 25 ms lookup
Info::
Resolves to 4 IPv4 address(es)
Got: 3.169.183.79, 3.169.183.70, 3.169.183.122, 3.169.183.129
Info::
Has 8 IPv6 (AAAA) record(s)
Got: 2600:9000:285b:400:13:1d23:bc80:93a1, 2600:9000:285b:5200:13:1d23:bc80:93a1, 2600:9000:285b:7a00:13:1d23:bc80:93a1, 2600:9000:285b:8a00:13:1d23:bc80:93a1, 2600:9000:285b:a800:13:1d23:bc80:93a1, 2600:9000:285b:bc00:13:1d23:bc80:93a1, 2600:9000:285b:e000:13:1d23:bc80:93a1, 2600:9000:285b:ea00:13:1d23:bc80:93a1
Info::
4 nameserver(s) configured
Got: dns1.p01.nsone.net, dns2.p01.nsone.net, dns3.p01.nsone.net, dns4.p01.nsone.net
Info::
2 mail exchanger(s) configured
Info::
CAA records not checked
CAA record lookup requires a specialized DNS resolver. This check will be available in a future update.
Info::
SPF record present in TXT
Info::
DNS resolution time: 25 ms
Got: 25 ms
A3.169.183.79, 3.169.183.70, 3.169.183.122, 3.169.183.129
AAAA2600:9000:285b:400:13:1d23:bc80:93a1, 2600:9000:285b:5200:13:1d23:bc80:93a1, 2600:9000:285b:7a00:13:1d23:bc80:93a1, 2600:9000:285b:8a00:13:1d23:bc80:93a1, 2600:9000:285b:a800:13:1d23:bc80:93a1, 2600:9000:285b:bc00:13:1d23:bc80:93a1, 2600:9000:285b:e000:13:1d23:bc80:93a1, 2600:9000:285b:ea00:13:1d23:bc80:93a1
CNAME—
NSdns1.p01.nsone.net, dns2.p01.nsone.net, dns3.p01.nsone.net, dns4.p01.nsone.net
MX
0 checkpoint-com.d-v1.mx.microsoft
100 checkpoint-com.mail.protection.outlook.com
TXT
MS=ms22023784
MS=ms61202101
9rjr8ghmqvjiulmjg4pj423qnt
ikxg6gkc7y0k6ugegi08qa0ycc
ivtccuvjt7kv0cnop38g5gn1ob
j0r31jspuaai48ae3d7rab3k4e
jcpsie6ji2tbgufb8m4mh1s0pi
q5upo64pn9dfl0u34h2a1bkk1f
2fd959111ffb4474b7e02863e00ac28a
5452fc6c472e4ce1bfb45f7f0ca753d4
hvtq0fjm2jxf9j7kr459rm3g30dc3svl
1895fd12-6155-44d9-8cf1-d034ed3f9081
2a2676f6-e6fc-4754-ab3e-04e7808724e7
2d7209d5-35fe-487a-becb-2ff9e6d21c4d
36988e76-f426-444a-bf29-0f7d16d2a1a8
37d894f4-2dab-4879-b69a-12cae50ccfc4
45d45d4e-f35c-4473-9360-68660dbf576d
4ee983f9-5422-4889-a5ba-1df355c2973b
70fdee12-bf32-4950-92bc-91a3632bd3f6
720a0827-8d9a-40ca-a879-549d40649674
7b4c4c32-2a80-48d7-ab91-dfd4cf41dfe4
8a2f84e6-93c4-45cf-9759-8e724f1aa616
bd1cea06-a5bf-4bfd-a039-9a725419cf23
c793c6d9-34df-4485-bdb9-efced2aa5fb9
c980eab4-f13e-4564-b6b2-8861251b065e
deb3128a-b74b-4b27-95a8-82b4fcf7a1c5
f28a3f6e-1959-4a86-a3e4-46a3b5974c17
fbd29d20-3129-4d07-aff9-0b67547c8bdf
fc8c2548-22f2-4582-8b9b-457f358d5aef
dropbox-domain-verification=ao680b3a3a15
apple-domain-verification=7QhtdqjdDG2t0PMa
jR=TrQdaY5lxw4bR0=NDW9TrJSzVdu-9u4xaFPuF5EZV
status-page-domain-verification=2h0hq9z9ztj5
docusign=9500ab24-ae00-4143-934c-5ad0edbea319
canva-site-verification=ucSy6Km-oyeB5kmmd7ozmg
SPF v=spf1 include:_spf1.b1723vyl.eu.cp-dmarc.com ~all
1password-site-verification=2CR4T6ZCSJHYRFCDCGML7PCK2E
airtable-verification=61d226de8d29fd1aee7eae9064ef1c40
docker-verification=e197713e-0cdd-4b07-9db9-3dfe2037c9d9
cloudflare_dashboard_sso=7880b55133859ba9fa37cd64c26c7649
mongodb-site-verification=EquOvFierKYIw7qYM8ec3pFiayGjsr6r
mongodb-site-verification=F3c1IhUI81YAogWYmRzAOXTdCHxwE0OY
mongodb-site-verification=aCsGW9rrjprkpiRFqzJ8lnd9AooUUBNg
mongodb-site-verification=enRLfN4wAWgImh6gWNEWUlB4EiHZyDHb
mongodb-site-verification=pvGkUyWZIju45KC37L9ajoz48bPvsKlk
mongodb-site-verification=sKKFmlh0taqfo3eE3BoCDkOkO6uSw507
mongodb-site-verification=wvXvntDeK8AqOHC8TzmXnr5voFTkaq6S
convex-domain-verification-kvhc58=nGfltUnhvMinm9kxR67cPMQAC
cursor-domain-verification-13a8v3=ug0qsYud0fpm2BJSguDtZQfID
facebook-domain-verification=r4djys91aknh85fhkxmz3z5t48gt4q
mixpanel-domain-verify=1ed58526-836b-41ed-91df-b19d63df84f1
twilio-domain-verification=3d65c3ee9c1bacb1c92a6f4aa4254168
34CDDF42E93DC8291A9FFB03F2782CB4406FE5842A2FC9E75760DC7CE8988EFA
slack-domain-verification=2Vp6FzIgIx71fuWYtdQfSKvw6a6RaN4YHFPWufEr
slack-domain-verification=hBJ7iTCUxDdnWYUKNBHmsz7tlpoCPKDxLBrGLs0R
monday-com-verification=V8qtBgdqStqxSyGsvuVwdjz3csBZs2A3ZdEPwJ9G3Qg
google-site-verification=XG4zgx5SK5nmDbaphm5tc2OTZOOQW9LWzJwOUfdqcIs
google-site-verification=cr-Qr8qr0FvJM7rcCIBbqlvDMj9NGS52rcUPnoRgqjs
google-site-verification=dwMGbISN9laSvidELOpgLRccCPcbGc5WMQIcFdo_3Ps
google-site-verification=rFuYxjFBb219O8AIjD8joMkMWhtZPanxPJS-6s6lN3w
google-site-verification=vPb8jQJ2tMku_eJtjkdiri8EIiepr76S2543L_mgqO0
google-site-verification=vYWPDJt28gEcEjzGCiN18Rnb-udh_2qF1puEbWPp8wI
notion-domain-verification=ElTTtPkiVIyV0H8Mwklw6KKczIH6eHyEhyecdZ07VXz
notion-domain-verification=MnDzXcU9YC9Hhql6uYfvOry2PyxdOlDCsGGta3Ur7ZO
mgverify=1c587286111c349875a099c382eb88c9ab1fe5dfcc3487506d9b49839ba117ab
hubspot-domain-verification=OTI1ZWQ5N2UtMWVjZS00MTk5LTliNTEtNWNkNTNiNTlhZmIw
notion_verify_]-KBzH-e+aa7ja2_MeLin9#*@McMu5rP44_*,]yU?50i~.nuQ8twrcmR=F0A8.2CCs...
box-domain-verification=8527ca495818001dfe42380446cd6b5d63d282aed94758a8228116ac...
hcp-domain-verification=ce2770782fd69f681cffd900bfed1c6c093efb55aaf6e00a7e5e44e0...
jqh0Jx01f2FL5Ktxt+ugQQ3RS3PWtK0kXxapIgEb/9I+/r0fTaeE7oXzMQUAED9ifJ/156eRCnddwrwb...
lyIRWpl30ICYZA1WEdosDihosuS0m3ahty0WpjuUcIoVImkL60t5Kor5QyQowt29jmi8JBmQF+0AYPnb...
atlassian-domain-verification=OAFLhunIHAsvjL1SCeeNaYiPslEf7JXjseLgxMXSyiKvzuqI/y...
google-site-verificationgoogle-site-verification=sTWXCIRPR57b1uy4_mUdDXOP UA...
CAALookup not available with standard resolver
Resolved in 25 ms

CAA record lookup requires a specialized DNS resolver. This check will be available in a future update.

Why this matters

Informational: CAA (Certification Authority Authorization) records weren't checked in this scan.

A
Redirect Chain
1 redirect(s), 67 ms total
PASS
1 redirect(s), 67 ms total
Info::
Single redirect
Got: https://checkpoint.com → https://www.checkpoint.com/ (301)
Info::
WWW normalization redirect

https://checkpoint.com

18 ms · HTTP/1.1

301

https://www.checkpoint.com/

49 ms · HTTP/1.1 FINAL

#URLStatusTimeProtocolServer
1https://checkpoint.com30118 msHTTP/1.1nginx
2https://www.checkpoint.com/20049 msHTTP/1.1nginx

See the visual redirect chain in the HTTP Probe tab →

A+
Crawlability
robots.txt present, sitemap with 1684 URLs
PASS
robots.txt present, sitemap with 1684 URLs
Info::
robots.txt is present
Got: 1373 bytes
Info::
sitemap.xml is present
Info::
sitemap.xml is valid XML
Info::
sitemap.xml contains 1684 entries
Info::
robots.txt references sitemap
robots.txt 200 OK
Size 1373 B Sitemaps referenced 1 User-agents * Blocking No — crawling allowed
User-Agent: *

Disallow: /corporate/agency/

Disallow: /corporate/events/sko/

Disallow: /downloads/resources/

Disallow: /email/

Disallow: /emails/

Disallow: /feed/

Disallow: /form/

Disallow: /forms/

Disallow: /help/ddos-protector/

Disallow: /images/

Disallow: /inc/

Disallow: /partners/resources/

Disallow: /partners/syndication/

Disallow: /quiz/

Disallow: /resources/downloads/

Disallow: /services/education/sa/

Disallow: /services/education/saprogram/

Disallow: /skunk/

Disallow: /support/

Disallow: /surveys/

Disallow: /tag/

Disallow: /test/

Disallow: /wp-admin/

Disallow: /downloads/company-related/cpx360-2019-agenda.pdf


## For Events Calendar

Disallow: /events/list/

Disallow: /venue/

Disallow: /fr/venue/

Disallow: /kr/venue/

Disallow: /jp/venue/

Disallow: /tw/venue/

Disallow: /es/venue/

Disallow: /de/venue/

Disallow: /it/venue/

Disallow: /pt/venue/

Disallow: /vi/venue/

Disallow: /ru/venue/

Disallow: *post_type=tribe_events*

Disallow: *hide_subsequent_recurrences=*

Disallow: *tribe-bar-date=*

Disallow: *tribe-venue=*

Disallow: *eventDisplay=*

Disallow: *eventDate=*

Disallow: *paged=*

Disallow: *pagename=*

Disallow: *shortcode=*

Disallow: *ical=*

Disallow: *outlook-ical=*

Disallow: *related_series=*

Disallow: *tribe_geofence=*

Disallow: *tribe_organizer=*


Sitemap: https://www.checkpoint.com/sitemap.xml
sitemap.xml 200 OK
Type URL Set URLs 1684 entries Valid XML Yes
Sample URLs:
A+
URL Variants
www/non-www, trailing slash, HTTP→HTTPS
PASS
www/non-www, trailing slash, HTTP→HTTPS
Info::
HTTP correctly 301-redirects to HTTPS

www / non-www

202https://www.checkpoint.com/
200https://checkpoint.com/

HTTP → HTTPS

301http://checkpoint.com/ → https://checkpoint.com/

Consistent

A+
Domain Intelligence
checkpoint.com — via Domain The Net Technologies Ltd., 32 years, 6 months old, hosted on AWS
PASS
checkpoint.com — via Domain The Net Technologies Ltd., 32 years, 6 months old, hosted on AWS
Info::
Domain registered until Mar 30, 2027 (11 months remaining)
Info::
DNSSEC is enabled
Info::
Registrar: Domain The Net Technologies Ltd.
Warning::
Registrar lock is NOT enabled
The domain can be transferred without an unlock step. Enable registrar lock (clientTransferProhibited) in your registrar's control panel to protect against unauthorized or accidental transfers.
Info::
Hosting: AWS
Got: AS16509
Domain expiry

225 days

March 30, 2027

SSL certificate

79 days

Issued by GlobalSign nv-sa

Domain age

32 years, 6 months

Registered March 29, 1994

DNSSEC

Enabled

Protects against DNS spoofing

Hosting

AWS

ASN AS16509

3.169.183.79

Registrar

Domain The Net Technologies Ltd.

Unlocked 4 NS records
Expiry timeline
Today
+1 year
Domain expiry SSL expiry Danger zone (≤30 days)
Recommended actions
  • Enable registrar lock (clientTransferProhibited) to block unauthorized domain transfers
Registrar Domain The Net Technologies Ltd.
Created March 29, 1994 (32 years, 6 months ago)
Expires March 30, 2027 (11 months)
Last Updated February 23, 2026
Name Servers dns1.p01.nsone.net, dns2.p01.nsone.net, dns3.p01.nsone.net, dns4.p01.nsone.net
DNSSEC Enabled
Hosting
IP Address 3.169.183.79
ASN AS16509 (AMAZON-02 - Amazon.com, Inc., US)
Provider AWS
Data source: rdap (0.1s)

The domain can be transferred without an unlock step. Enable registrar lock (clientTransferProhibited) in your registrar's control panel to protect against unauthorized or accidental transfers.

Why this matters

Without registrar lock, an attacker who phishes your registrar credentials can transfer the domain in minutes — total brand hijack.

Learn more ▾

Registrar lock (clientTransferProhibited, clientUpdateProhibited, clientDeleteProhibited) requires extra verification before any transfer/update/delete. Every major registrar offers it free. Combined with 2FA on your registrar account, it's the strongest defense against domain hijacking.

Source: ICANN / domain-security best practice

A+
HTTP Probe Timing
Total 32 ms — DNS, TCP, TLS, TTFB, content transfer breakdown
PASS
DNS Lookup DNS Lookup — time to resolve the domain name to an IP address.
19 ms
TCP Connect TCP Connect — time to establish a TCP connection to the server.
2 ms
TLS Handshake TLS Handshake — time to complete the HTTPS encryption handshake.
4 ms
Time to First Byte Time to First Byte — how long the server takes to respond with the first byte of data.
32 ms
Total Time Total request time from DNS lookup through full response.
33 ms

Connection waterfall

DNS Lookup 19 ms TCP Connect 2 ms TLS Handshake 4 ms Server Processing 6 ms Content Transfer 1 ms
A+
CDN & Delivery
AWS CloudFront (Hit from cloudfront)
PASS
AWS CloudFront (Hit from cloudfront)
Info::
Site is served via AWS CloudFront CDN (edge: SFO53-P7)
Got: x-amz-cf-id: RONcV5qn5syHyPGznA3W2Ic8SC_aNcVpV_T2dCBFpsPY6UzD6WnkZg==
Info::
CDN cache status: Hit from cloudfront
CDN Detected: AWS CloudFront
Provider AWS CloudFront Cache Status Hit from cloudfront Evidence x-amz-cf-id: RONcV5qn5syHyPGznA3W2Ic8SC_aNcVpV_T2dCBFpsPY6UzD6WnkZg==
All checks on this page are automated. Results are estimates - run targeted manual reviews when the score affects a release decision.

Send Feedback