Where the answers come from. Registration dates are read live from the registry over RDAP, the public successor to WHOIS. DNSSEC, CAA, nameservers, MX, SPF, DKIM, DMARC, MTA-STS, TLS-RPT and BIMI come from public DNS over Cloudflare and Google’s DNS-over-HTTPS resolvers. Subdomains come from Certificate Transparency logs. The certificate result is your own browser attempting a real TLS handshake, so a pass means the chain satisfied your browser’s trust store. Performance and SEO come from Google PageSpeed Insights — the only check here that involves a third party, and the only one where the URL leaves your browser. Nothing is saved.