About the self-test

Do you see requests from Suploris in your logs? Then someone has started the self-test for your domain. This page explains what happens.

How you can recognise the requests

Every request carries the identifier Suploris-Selbsttest (+https://www.suploris.com/selbsttest/info).

What we retrieve

• DNS records: MX, SPF, DMARC, MTA-STS, TLS-RPT, CAA and DNSSEC.
• The certificate and the TLS versions your website offers.
• The home page over HTTP and HTTPS, with at most 3 redirects.
• The file /.well-known/security.txt and the policy /.well-known/mta-sts.txt.
• The expiry date of the domain through the public RDAP service.

We only check the domain itself and the address with “www”. We do not look for other subdomains.

What we do not do

• No search for open ports.
• No login attempts and no forms.
• No attacks and no bypassing of protective measures.
• At most one new check of the same domain per hour.

Objection

You do not want us to check your domain? Write to security@suploris.com and name the domain. We will add it to our exclusion list. After that, we will not start any more checks for this domain.