HOW.IS
?

How is x.com?

Looks fine risk 0/100

Registered 34 years ago, on no blocklists we checked, valid HTTPS, the site answered 200 in 128 ms.

Why

02050100
finecarefulhigh risk
  • ·Nothing in the checks added risk.

Rule-based: domain age, blocklists, TLS. A heuristic, not a guarantee.

How x.com looks right now
The home page, rendered by how.is in a sandboxed browser. Nothing on it is clickable here.
Site
200
128 ms
HTTPS
63 d
left on a Let's Encrypt certificate
Age
34 years
registered 1993-04-02
Blocklists
0
listings across 5 lists

Everything we looked at

DNS records4 record types
A172.66.0.227
MX5 alt2.aspmx.l.google.com
5 alt1.aspmx.l.google.com
10 alt3.aspmx.l.google.com
10 alt4.aspmx.l.google.com
1 aspmx.l.google.com
NSc.u10.twtrdns.net
d.r10.twtrdns.net
b.r10.twtrdns.net
b.u10.twtrdns.net
a.r10.twtrdns.net
d.u10.twtrdns.net
a.u10.twtrdns.net
c.r10.twtrdns.net
TXTapple-domain-verification=sEij6tJOW11fVNrG
google-site-verification=6Xapa1BbHGcpSKAIcPHcZsxuKK2yK9FCn3OpZDgUBSs
3089463
stripe-verification=11AE5005048CF2B40BD2AC26DA89C512596CF727581C499E240549D95C37CEE0
adobe-sign-verification=c693a744ee2d282a36a43e6e724c5ea
figma-domain-verification=ee8420edd01965ba297f3438c907cfc6fbbaa1ee90a07b28f28bcfca8e6017bb-1729630998
_w548xs1kfxtlqk3jyx19bzwk34c473i
adobe-idp-site-verification=ab4d9ce3473a73e81f46238da34ea4967fd5ac80e5c43fbfa8dff46d06a5321c
google-site-verification=BT51mebIp7CbI7Qy_5Qg6LJLSBrLuCGQ_oznVAgfgKA
google-site-verification=8yQmoVhQedzlt36RPeQP41ytrEFk9aHEnde_xm0626g
v=spf1 ip4:199.16.156.0/22 ip4:199.59.148.0/22 include:_spf.google.com include:_spf.salesforce.com include:_oerp.x.com include:phx1.rp.oracleemaildelivery.com include:iad1.rp.oracleemaildelivery.com -all
notion-domain-verification=BnCKbWESk142VKiGKHQ8PZkBfVoWYpsZxzl8Z95k0jB
atlassian-sending-domain-verification=bd424180-8645-4de5-bd6a-285479c7577a
kkdl3qb3tcrmdhfsm803p67r0my0svs8
google-site-verification=isX7U92-gLht5aKvjaPvQ9tWaxoqREy8agpAOcqlfIE
stripe-verification=46F7B88485621DC18923B43D12E90E6CDBCE232F2FEBCF084E6EFA91F6BA707D
shopify-verification-code=cUZazKrqCWgcshrcGvgfFR1lieuhRF
slack-domain-verification=Csk4bjCPFnJaDLLaKFUwCTFuUpCVvnYlAm2Tba0i
atlassian-domain-verification=j6u0o1PTkobCXC84uEF/sWpIPtaZURBVYqKzmTvT8wugLcHT1vvrzzA63iP1qSLN
central-10416
google-site-verification=lEZNYWieV7-UbDJafAm0u_RvNFb7GGqIYWAP4JmG5qs
google-site-verification=rbRGYlOADDbtUYJTGd8GEDm0PwPZExviDSaSH4JLR8Q
google-site-verification=reUF-TgZq93ZGtzImw42sfYglI2hY0QiGRmfc4jeKbs
google-site-verification=F6u9mGL--d2lbLljvH3b1UUgXtevQPdcamKr9c8914A
RegistrationGoDaddy.com, LLC
registrarGoDaddy.com, LLC
registered1993-04-02
expires2034-10-20
last changed2024-12-03
nameserversa.r10.twtrdns.net
a.u10.twtrdns.net
b.r10.twtrdns.net
b.u10.twtrdns.net
c.r10.twtrdns.net
c.u10.twtrdns.net
d.r10.twtrdns.net
d.u10.twtrdns.net
statusclient delete prohibited
client renew prohibited
client transfer prohibited
client update prohibited
registered 1993-04-02expires 2034-10-20
HTTPS certificate63 days left
validyes
issuerLet's Encrypt
covers*.live.x.com, *.watch.x.com, *.x.com, cdn.syndication.x.com, click.send.x.com, x.com
protocolTLSv1.3
issued 2026-09-28expires 2026-12-27
DNSSECinsecure

Domain is not signed with DNSSEC

. → com → x.com
Email authenticationexcellent
SPFpass v=spf1 ip4:199.16.156.0/22 ip4:199.59.148.0/22 include:_spf.google.com include:_spf.salesforce.com include:_oerp.x.com include:phx1.rp.oracleemaildelivery.com include:iad1.rp.oracleemaildelivery.com -all
DMARCpass policy reject
DKIMfound: google

Whether mail claiming to be from this domain can be checked as genuine.

Security scoregrade B · 155/205
Basic Security
10/40missing: DNSSEC Enabled, Nameserver Diversity
Record Security
30/45missing: CAA Records, DKIM Presence
Advanced Security
20/25missing: IPv6 Support
Domain Reputation
50/50
Threat Detection
45/45missing: Domain Age Check
Blocklists0 listings · 5 lookups
SURBL MultidomainURIBL MultidomainSpamCop172.66.0.227Barracuda172.66.0.227UCEPROTECT Level 1172.66.0.227

Green: clean. Red: listed. Grey: the list did not answer.

Ask it yourself

Agents get this as data. Bought through the API, the checks behind this page cost $0.070: profile $0.025 + trust $0.020 + screenshot $0.020 + site status $0.005.

curl "https://how.is/v1/domain/trust?domain=x.com" \ -H "Authorization: Bearer $HOWIS_KEY" # or pay per call in USDC (x402), no key: the 402 tells your agent the price curl -i "https://how.is/v1/domain/profile?domain=x.com"

MCP: add https://how.is/mcp to Claude, Codex or Cursor (one-line install) and ask for domain_trust on x.com. Reference: /llms.txt.

Watch x.com. DNS read at the source every 5 minutes; certificate, blocklists and expiry every 6 hours. You get an email only when something changes.

Watch — $1 / 30 days