What this service does, and how to prove it

A tool that asks you to trust it should let you check it. This page describes exactly what happens when you press the button, and gives you a way to test the central promise yourself.

What happens when you run a check

1. Your domain is validated. IP addresses, private ranges, ports other than 80 and 443, and anything that resolves into a private network are refused. This service runs inside a home network in Perak; without those rules a public box like this would be a way into that network.
2. The hostname is resolved once, and the address is checked again on every redirect hop, because a redirect is the obvious way to smuggle a request somewhere it should not go.
3. Nothing is opened that the report does not need. One run spends at most: a handful of DNS lookups (including the CAA, MTA-STS, TLS-report and BIMI records); one TLS handshake; up to six page requests (the page itself, capped at 2 MB and ten seconds, plus five HEAD hops following your redirects); one second page fetch to read compression, cookie flags and the server banner; one policy file for MTA-STS; one HEAD for the preview image your page declares; three requests to compare your address with and without www; and two for the registry record behind the expiry date. That is under twenty-five requests in the worst case, none of which downloads a second page body beyond the two named above. The certificate is read from the socket the request already opened, so checking the padlock never creates a second visit.
4. The result is rendered and cached for an hour; results with a warning or a firewall block are cached for five minutes, so a fix you just published shows up quickly.

What is kept

No query log. No account. No cookie. No third-party script, font or image on these pages — open the network panel of your browser and you will see one stylesheet, served by this service.

Two counters exist, in memory only, and both die when the process restarts: a per-IP request count (ten a minute, a hundred a day) and a cache of the public DNS and HTTP answers so that a link shared on WhatsApp is not re-fetched every time somebody opens it. Nothing is written to disk.

How to prove it

Point the checker at a host you control and watch its log. One run shows at most: one request for the page, up to five HEAD hops if you redirect, one HEAD for the image your page declares as og:image, three requests comparing your address with and without www, and two to the domain registry — all carrying the user agent HoeleeCheck/1.0 (+https://www.hoelee.com/check/about/), and nothing else. If you see more, or from somewhere unexpected, that is a bug worth reporting.

What this service will not do

• It will not test whether your email lands in the inbox — that needs a real message from a real server, and claiming otherwise would be dishonest.
• It will not check IP blacklists. The free DNSBL feeds that make this easy forbid commercial use and refuse queries from cloud resolvers, and a false positive there could cost somebody real mail.
• It will not crawl your site, measure its speed from one location, or identify your tech stack from a distance.
• It will not pretend a firewall is a fault. When a CDN refuses an automated probe, the row says skipped in grey, never red.

Who runs it

Hoelee Enterprise, a one-person studio in Perak, Malaysia, that builds websites and hosts business email for small Malaysian companies. This service is free because it is useful, and because a business that discovers a broken padlock here usually wants it fixed by somebody.