reddit.com scored 69/100 on a domain health checker — I ran it and here’s exactly why

I ran reddit.com through a domain health check covering TLS, WHOIS, DNS, email authentication, security headers, hosting and reputation signals.

The result was 69/100, grade C, which initially seemed surprisingly low for a site like Reddit. Looking at the scoring breakdown explains most of it.

TLS received 9.7/30. The certificate itself is valid and issued by DigiCert, but it had around 58 days remaining when the scan was performed. The scoring model gradually reduces the TLS expiry score once a certificate enters its final six months rather than treating certificates as simply valid or invalid.

Security headers received 21/30. CSP, HSTS, X-Frame-Options and nosniff were present, while Referrer-Policy, Permissions-Policy, COOP and CORP were not detected in the response.

Email authentication received 15/15. SPF, DKIM and DMARC were all present, with DMARC using p=reject.

Reputation received 20/20, although there is an important limitation here. VirusTotal and AbuseIPDB were not configured for this scan, so PhishTank was the only reputation source that actually returned a result. That part of the scoring probably needs to account for incomplete coverage more clearly.

Web configuration received 3.2/5. HTTP/2 was used and HTTP redirected to HTTPS, while compression was not detected.

The final calculation was 9.7 + 21 + 20 + 15 + 3.2 = 68.9, rounded to 69.

Most of the lost points therefore came from the certificate expiry weighting and the four missing security headers, rather than anything suggesting reddit.com is actually unsafe.

I’m curious whether 69 feels too harsh for this kind of result, particularly how much weight certificate expiry should have in an overall domain health score.