Troubleshooting

The scan failed

A failed scan shows why. The usual causes:

Message	What to check
The name doesn’t resolve	the DNS record exists and has propagated; try dig +short example.com
Connection refused / timed out	the port is open to the internet, not only to your network or a VPN; a firewall isn’t dropping unknown sources
Handshake failed	the port actually speaks TLS (port 80 doesn’t); for mail, that you chose the right ports — STARTTLS ports start in plain text and are handled for you

If the host is reachable from your own machine but not from devtls, check for geo- or IP-based blocking in front of it.

“Resolves to a private address”

The hosted scanner refuses names that point at private, loopback or link-local addresses. If the name is public, check it doesn’t have a stray A or AAAA record pointing at an internal IP — devtls checks every address the name has.

The grade didn’t improve after my fix

• Scan again. The grade belongs to the latest scan; it doesn’t change on its own until the next scheduled run.
• Every address counts. If the name has several A/AAAA records (a CDN, a load balancer, IPv6), the grade is the weakest. The report lists each address: one may still have the old configuration.
• Reload the server. A changed config file does nothing until Nginx, Traefik or Caddy reloads it.
• HSTS is read from the HTTPS response of the root path. A header added only on some routes isn’t seen.

TLS 1.0 or 1.1 says “not tested”

The probe couldn’t attempt that protocol from a modern TLS library. It isn’t counted against you. Run a deep scan for SSL Labs’s view.

The mail scan shows an SPF or DKIM problem I’ve already fixed

DNS answers are cached for the record’s TTL. Wait for it to expire and scan again. For DKIM, make sure the selector you use is on the target.

I can’t add a domain or start a scan

Answer	Why	What to do
Verify your email first	the account’s email isn’t verified	use the link in the verification email, or resend it from the banner
Choose a plan	a new organization hasn’t picked one	choose one in the dashboard — Free works
PLAN_LIMIT	domain allowance reached	delete a domain, or upgrade
SCAN_LIMIT	month’s scans used	wait for the 1st (UTC), or upgrade
FEATURE_LOCKED	the feature needs a paid plan	upgrade
Too many scans	rate limit	wait a minute

I didn’t get the sign-in or verification email

Check spam, then ask for it again from the sign-in page. The one-time sign-in link and the password-reset link each work once and expire; request a new one if it’s been a while.