Every check on this site either runs in your browser or asks a public source at the moment you press Check. Here is which is which, and what each method can and can't tell you.
Three kinds of checks
- In your browser only: the subnet calculator and the decoding on What is my user agent (that page also shows the Accept-Language header your browser sent to our server with the page).
- Your browser talks to a public service directly: the WebRTC leak test (Cloudflare's STUN server), the speed test (Cloudflare's speed servers) and the IPv4/IPv6 check on What is my IP (ipify).
- Through our server: DNS, WHOIS, IP lookup, email records, website checks and the port checker. Our server runs on Cloudflare's network, asks the right public source, and turns the raw answer into a readable result. It keeps no log of what you checked.
DNS: which resolver answers
DNS lookups go over DNS-over-HTTPS (RFC 8484) to public resolvers. The DNS lookup lets you pick one. The propagation checker asks seven at once, plus six "as seen from" views: Google Public DNS answers as if the visitor were in that region, using the EDNS Client Subnet hint (RFC 7871). That shows what content networks (CDNs) hand out around the world. It is not the same as asking hundreds of servers in hundreds of cities, and the page says so.
Every DNS answer carries a TTL: how long resolvers may keep it. After you change a record, the old value can live on for up to the old TTL. That's why "propagation" is really "caches expiring", and why the checker shows when the old answer will be gone at the latest.
Domains and IP addresses: the registries
Ownership data comes from RDAP (RFC 9082 and RFC 9083), the structured successor of WHOIS. IANA publishes which registry runs RDAP for each domain ending and address block, and the tools ask that registry directly. Since the GDPR, registries hide private owners' names and contact details, so you'll usually see the registrar, the dates and the status codes, not a person.
Email records: the standards
The email checkers read the DNS records receiving servers read: MX, SPF (RFC 7208), DKIM (RFC 6376), DMARC (RFC 9989, which replaced RFC 7489 in May 2026), MTA-STS (RFC 8461) and TLS reporting (RFC 8460). SPF includes are followed and counted against the limit of 10 DNS lookups. DKIM keys sit under a selector that only the sender knows; the checker tries the selectors common providers use, and you can type your own. The grade is our own summary of those checks, explained on the result, not an industry score.
Websites: a live request from Cloudflare
Is it down?, the HTTP headers checker and the redirect checker send one normal request to the address you typed and follow redirects one hop at a time (up to 10). The answer shows what Cloudflare's network saw at that moment. A site can still fail for you if the problem is between you and it (your DNS, your ISP, a firewall), and some sites block automated checks; the result tells you when that seems to be the case.
Addresses inside private networks (192.168.x.x, 10.x.x.x, localhost and the like) are refused, and so is every redirect that points into one. That keeps the tools from being used to probe internal systems.
Certificates: Certificate Transparency
A server function can't read the certificate a website presents, so the SSL checker combines two facts: whether an HTTPS connection from Cloudflare to the site succeeds (it fails for an invalid, expired or wrong-name certificate), and the newest valid certificate for that exact name in the public Certificate Transparency logs, which publicly trusted certificates are logged in. If a site serves an older certificate than the newest one logged, the dates shown can differ from what your browser sees.
Your connection: Cloudflare's request data
Your IP address, network (ASN), provider name and approximate location come from the data Cloudflare attaches to every request. Location databases place an address where its network is registered or routed, which is often your ISP's city rather than yours, and VPNs move it entirely. The page shows it as approximate for that reason.
Caching and limits
Answers may be cached on Cloudflare for one minute (website and email checks) up to one hour (WHOIS, IP and certificate data), keyed by the thing checked, never by who checked it. "Check again" may therefore return the same answer for a short while. Each visitor has a rate limit so the free public services behind the tools aren't overloaded.
Corrections
If a result looks wrong, or a page explains something badly, please use the contact form. Mistakes get fixed and the page's "Last reviewed" date moves forward.