What the report covers
The report is a breadth-first look at a host rather than a deep dive into any one aspect. It answers the questions you would otherwise open six tools to ask: who registered this domain and when does it expire, where does it resolve, can I reach it, what is listening, is its certificate valid, can it send mail that will be accepted, and is its address on a blocklist.
Each panel is produced by the same code as the matching standalone tool, so if something looks wrong you can open that tool directly and re-run just that check while you change things.
Reading the summary
The summary panel at the top lists only findings worth acting on: a missing SPF or DMARC record, an expired or unverifiable certificate, a host that refused connections, a blocklist entry. If it says no major issues were detected, the individual panels are still worth scanning -- the summary flags problems, not every detail.
A finding in the summary is a starting point, not a verdict. A domain with no MX records is broken if it is meant to receive mail and perfectly fine if it is not.
Why some checks return less for an IP
Several checks are concepts that only exist for domains. SPF, DMARC, DKIM and MX are DNS records published under a domain name, and TLS certificates are issued for hostnames. Point the report at a bare IP address and those panels will say the check does not apply, while reverse DNS -- which only exists for addresses -- becomes available instead.
Limits worth knowing
Traceroute is unavailable here. It needs raw-socket privileges that container hosts do not grant, so the reachability panel measures TCP handshake time instead, which answers "can I reach it and how far away is it" without them.
Blocklist results can be inconclusive rather than clean. Major DNSBLs refuse queries that arrive from datacenter resolvers, and this tool runs in a datacenter. When that happens the panel says so rather than reporting a clean result it cannot actually verify.
Frequently asked questions
How long does the full report take?
Usually three to eight seconds. The checks run concurrently rather than one after another, so the total is roughly the slowest single check rather than the sum of all of them.
Does running this report touch the target host?
Yes, lightly. It opens TCP connections to a handful of common ports and makes an HTTPS request. That is ordinary client traffic and is not a scan in any aggressive sense, but you should only run it against hosts you own or have permission to test.
Why do two panels sometimes show different IP addresses?
Large sites answer DNS queries with different addresses depending on who is asking and when. Checks resolve independently, so a round-robin or geo-balanced domain can legitimately produce a different address in two panels of the same report.
Can I share a report with a colleague?
Yes. The result has its own URL -- copy the address bar and the same report will re-run for whoever opens it.