Skip to content
https://vision-ai-3am9.onrender.com

Infrastructure

· 17 checks — DNS, redirects, IPv6, crawlability, URL variants, and domain intelligence rolled into one auditable list.
SCORE
86
GRADE
B
FIX
0
REVIEW
8
PASS
8
INFO
1
Probed from Madrid, Spain
200 OK
Checks
17
8 PASS 8 REVIEW
B
DNS Records
2 A records, 34 ms lookup
REVIEW
2 A records, 34 ms lookup
Info::
Resolves to 2 IPv4 address(es)
Got: 216.24.57.18, 216.24.57.16
Info::
No IPv6 (AAAA) records
Warning::
CNAME record at zone apex
A CNAME at the zone apex can break MX and NS records. Use ALIAS/ANAME or A records instead.
Got: gcp-us-west1-1.origin.onrender.com
Info::
No NS records found
Info::
No MX records — email not configured via DNS
Info::
No SPF record found in TXT records
SPF helps prevent email spoofing. Add a TXT record starting with 'v=spf1'.
Info::
DNS resolution time: 34 ms
Got: 34 ms
A216.24.57.18, 216.24.57.16
AAAA—
CNAMEgcp-us-west1-1.origin.onrender.com
NS—
MX—
TXT—
CAALookup not available with standard resolver
Resolved in 34 ms

A CNAME at the zone apex can break MX and NS records. Use ALIAS/ANAME or A records instead.

Why this matters

CNAME at the apex (example.com) breaks every other apex record (MX, TXT, NS) — DNS-protocol violation per RFC 1034.

Learn more ▾

RFC 1034 forbids CNAME alongside other records at the same name. Some DNS providers offer ALIAS / ANAME / flattened-CNAME records that work around this — use those instead. Otherwise apex-level CNAME breaks email (no MX), domain ownership verification (no TXT), and more.

Source: RFC 1034

SPF helps prevent email spoofing. Add a TXT record starting with 'v=spf1'.

Why this matters

Without SPF, receiving servers can't validate sending IPs — your domain is easier to spoof in phishing.

Learn more ▾

SPF complements DMARC. Both should be published. SPF records list authorized sending IPs (e.g., `v=spf1 include:_spf.google.com ~all` for Google Workspace). After publishing, verify in Google Postmaster Tools or mxtoolbox.

Source: RFC 7208 (SPF)

B
DNSSEC
Unsigned (DNSSEC not deployed)
REVIEW
Unsigned (DNSSEC not deployed)
Info::
DNSSEC is not deployed
The zone is not DNSSEC-signed. Users on validating resolvers (Cloudflare 1.1.1.1, Quad9 9.9.9.9, growing default in mobile resolvers) get no protection against DNS spoofing for this domain. Most registrars now offer DNSSEC at a single click; consider enabling it for sites where authenticity matters (banking, healthcare, government).
B
CAA Records
No CAA records (any CA may issue certificates)
REVIEW
No CAA records (any CA may issue certificates)
Info::
No CAA records published
Without CAA records, any publicly-trusted CA can issue certificates for this domain. Adding a CAA record (`yourdomain. IN CAA 0 issue "letsencrypt.org"`) restricts issuance to CAs you authorize. Required by CAB Forum baseline since 2017; the default of 'any CA' is widely supported but is the broader attack surface for issuance fraud.
B
Reverse DNS
0/2 IPs match cert SAN
REVIEW
0/2 IPs match cert SAN
Info::
PTR for 216.24.57.18 does not match any cert SAN: ip-216-24-57-18.ingress.render.com
Common when behind a CDN or shared hosting (PTR points at the provider's hostname). Mismatch can also affect mail deliverability if this IP sends email -- many MTAs reject mail when forward+reverse DNS disagree.
Info::
PTR for 216.24.57.16 does not match any cert SAN: ip-216-24-57-16.ingress.render.com
Common when behind a CDN or shared hosting (PTR points at the provider's hostname). Mismatch can also affect mail deliverability if this IP sends email -- many MTAs reject mail when forward+reverse DNS disagree.
C
IPv6 Readiness
Action
No IPv6 support
REVIEW
No IPv6 support
Info::
No IPv6 (AAAA) records found
IPv6 support is increasingly important for global accessibility. About 40% of internet users have IPv6 connectivity.
No IPv6 Support
About 40% of internet users have IPv6. Consider adding AAAA records.

IPv6 support is increasingly important for global accessibility. About 40% of internet users have IPv6 connectivity.

Why this matters

No AAAA records — same impact as 'no IPv6 (AAAA) records'; IPv6-preferring clients pay extra latency falling back to IPv4.

Source: Google IPv6 stats

B
HTTP Probe Timing
Total 1028 ms — DNS, TCP, TLS, TTFB, content transfer breakdown
REVIEW
DNS Lookup DNS Lookup — time to resolve the domain name to an IP address.
64 ms
TCP Connect TCP Connect — time to establish a TCP connection to the server.
1 ms
TLS Handshake TLS Handshake — time to complete the HTTPS encryption handshake.
6 ms
Time to First Byte Time to First Byte — how long the server takes to respond with the first byte of data.
719 ms
Total Time Total request time from DNS lookup through full response.
1.03 s

Connection waterfall

DNS Lookup 64 ms TCP Connect 1 ms TLS Handshake 6 ms Server Processing 648 ms Content Transfer 309 ms
B
TLS Certificate Expiry & Recommendations
41 days until leaf cert expires — 4 issues to address
REVIEW

Certificate validity

41
days left
0d 30d 60d 90d+

Recommended actions

  • Add includeSubDomains to the HSTS directive
  • Add the preload directive and submit to hstspreload.org once max-age + includeSubDomains are in place
  • Enable DNSSEC on your domain for DNS spoofing protection
  • Enable OCSP stapling on your TLS server to remove a CA roundtrip and protect user privacy
B
Operational Status Page
No status page link detected
REVIEW
No status page link detected
Info::
No operational status page link detected
Status pages communicate planned maintenance and incidents to users -- a hallmark of operationally-mature services. Most SaaS teams publish one via Atlassian Statuspage, Instatus, BetterUptime, or a self-hosted Cachet. Smaller sites legitimately don't need one; flagged as Info, not a failure.
A+
Subdomain Takeover
No subdomain takeover risk detected
PASS
No subdomain takeover risk detected
Info::
CNAME does not point at a known takeover-able service
A+
Multi-Resolver DNS Speed
Mean 21ms across 3 resolvers (spread 37ms)
PASS
Mean 21ms across 3 resolvers (spread 37ms)
Info::
Quad9: 1ms
Got: 1ms via 9.9.9.9:53
Info::
Cloudflare: 26ms
Got: 26ms via 1.1.1.1:53
Info::
Google: 38ms
Got: 38ms via 8.8.8.8:53
A+
Redirect Chain
No redirects — direct access
PASS
No redirects — direct access
Info::
No redirects — direct access
Got: https://vision-ai-3am9.onrender.com

https://vision-ai-3am9.onrender.com

213 ms · HTTP/1.1 FINAL

#URLStatusTimeProtocolServer
1https://vision-ai-3am9.onrender.com200213 msHTTP/1.1cloudflare
A
Crawlability
robots.txt present, no sitemap
PASS
robots.txt present, no sitemap
Info::
robots.txt is present
Got: 248 bytes
Info::
No sitemap.xml found
A sitemap helps search engines discover and index your pages more efficiently.
Info::
robots.txt references sitemap

A sitemap helps search engines discover and index your pages more efficiently.

Why this matters

No sitemap.xml — Google relies on crawl-graph discovery alone, slowing indexing of deep or fresh URLs.

Learn more ▾

A sitemap accelerates Google's discovery of new and updated content. Most CMSes auto-generate one; static-site frameworks need a build-step plugin. Reference it from robots.txt and submit in Search Console to confirm Google can fetch it.

Source: sitemaps.org / Google Search Central

robots.txt 200 OK
Size 248 B Sitemaps referenced 1 User-agents * Blocking No — crawling allowed
User-agent: *
Allow: /

Disallow: /admin
Disallow: /admin/
Disallow: /chat
Disallow: /chat/
Disallow: /web-search
Disallow: /proxy-image
Disallow: /broadcast
Disallow: /upload
Disallow: /analyze-memory
Disallow: /export-file

Sitemap: /sitemap.xml
sitemap.xml No sitemap found

No sitemap found

Adding a sitemap helps search engines discover your pages.

A+
URL Variants
www/non-www, trailing slash, HTTP→HTTPS
PASS
www/non-www, trailing slash, HTTP→HTTPS
Info::
HTTP correctly redirects to HTTPS permanently
Got: HTTP 301

www / non-www

https://www.vision-ai-3am9.onrender.com/
200https://vision-ai-3am9.onrender.com/

HTTP → HTTPS

301http://vision-ai-3am9.onrender.com/ → https://vision-ai-3am9.onrender.com/

Consistent

A
CDN & Delivery
Document and assets on Cloudflare
PASS
Document and assets on Cloudflare
Info::
Document is served via Cloudflare CDN (edge: MAD)
Got: cf-ray: a57f0edaa9315063-MAD
Info::
CDN cache status: DYNAMIC
Info::
Assets on Cloudflare: cdnjs.cloudflare.com (assets: 9), cache HIT
Got: cf-ray: a57f0fc60aa7a876-CDG
Document served via CDN: Cloudflare
Provider Cloudflare Cache Status DYNAMIC Evidence cf-ray: a57f0edaa9315063-MAD

Asset hosts on a CDN

  • cdnjs.cloudflare.com — Cloudflare · assets: 9 · Cache Status: HIT

Other asset hosts

  • fonts.googleapis.com — assets: 2 · below probe threshold
  • cdn.jsdelivr.net — assets: 1 · below probe threshold
A+
CDN Cache Observability
Cache state: DYNAMIC
PASS
Cache state: DYNAMIC
Info::
CDN cache state observable via 1 header(s)
Got: cf-cache-status=DYNAMIC
A+
Health Check Endpoint
Health endpoint at https://vision-ai-3am9.onrender.com/ping (HTTP 200)
PASS
Health endpoint at https://vision-ai-3am9.onrender.com/ping (HTTP 200)
Info::
Public health endpoint at https://vision-ai-3am9.onrender.com/ping
Got: https://vision-ai-3am9.onrender.com/ping
Domain Intelligence
Domain intelligence data not available
INFO
Domain intelligence data not available

RDAP and WHOIS lookup both failed

All checks on this page are automated. Results are estimates - run targeted manual reviews when the score affects a release decision.

Send Feedback