Mastodon.sdf.org is a well-established Mastodon instance run by SDF, a computing club that has been around for 30 years. It has strong security and a clean reputation, but the lack of an obvious contact page and privacy-shielded registration are minor transparency gaps. You can use it with reasonable confidence, especially if you're already familiar with the SDF community.
Cross-referenced 42 live signals from Google Safe Browsing, VirusTotal, WHOIS and more on Oct 29, 2026.How we score →
Where the score comes from
We look at six areas. Here's how mastodon.sdf.org did in each.
85
Security
Strong security posture for a social media platform: HTTPS enforced via HSTS, a valid certificate from a trusted issuer, clickjacking protection enabled, and multiple security headers in place. No malware or phishing flags from Google Web Risk or DNS blacklists.
65
Identity
The domain itself is 30 years old and owned by SDF, a long-running computing club with a known identity. However, the specific Mastodon instance uses privacy-shielded WHOIS registration — normal for individuals but moderate transparency for a service that hosts user accounts.
80
Reputation
Strong reputation signals: 14 years in the Wayback Archive, positive Hacker News references across multiple years, and no blacklist hits. The parent domain sdf.org has been around since 1996, which adds trust.
60
Transparency
The site has an About page and publishes privacy/terms, but lacks a dedicated contact page or email address on the homepage. For a social media platform that stores user data, contact info is expected — its absence is a notable gap.
70
Compliance
Privacy and terms pages are present, which is appropriate for a site handling user accounts. No dedicated legal entity disclosure, but that's common for non-EU community-run services. A cookie consent banner was not detected but isn't unusual for a non-commercial instance.
75
Infrastructure
Solid technical setup: email authentication configured, fast page load, and a Mastodon server with proper DNS records. DNSSEC is not enabled, which is common for older domains, and the hosting network is reputable.
What we checked
The 42 signals behind this report.
Security & Transport
Certificate Issuer: Neutral
Let's Encrypt
Certificate issued by Let's Encrypt
Clickjacking Protection: Good
Present
X-Frame-Options: DENY
Content Security Policy: Good
Present
Site has Content Security Policy configured
Google Web Risk: Good
Clean
No threats detected by Google Web Risk
HSTS Header: Good
Present
Site enforces HTTPS via HSTS
Protective DNS: Neutral
Not blocked
Cloudflare's malware-blocking resolver (1.1.1.2) answered normally for this domain. These resolvers refuse domains their threat intelligence lists for malware or phishing, and a scam only days old often isn't listed yet. Quad9 gave no usable answer.
SSL Certificate: Good
Valid
Valid certificate, expires in 8 days
Search Cloaking: Neutral
Not detected
Neither a visitor arriving from a Google search nor Google's crawler was sent elsewhere or shown spam that a direct visit wasn't. Cloaking that checks the visitor's network address can't be seen from our server.
Site publishes an About / Team / Company page — a transparency signal that the operator is willing to describe who runs the business.
Branding: Good
Complete
Site has custom branding and social media metadata
Business Disclosure: Neutral
Not found
No dedicated legal-entity disclosure page detected — common and expected outside the EU, but required for commercial sites in Germany, France, Spain, Italy, and other EU jurisdictions.
Contact Info: Warning
Not found
No contact page link, email address or phone number found on the homepage
Domain Age: Good
30 years
Domain created 1996-10-12 (30 years ago) — registration of the parent domain sdf.org
Domain Expiry: Neutral
2027-10-11
Expires in 346 days
Legal Pages: Good
Privacy & Terms found
Website has both privacy policy and terms of service pages
Registrant: Neutral
Privacy protected
The registration shows a privacy service or redaction notice in place of the owner. Most registrars do this by default since GDPR (2018), for companies as well as individuals, so it hides nothing unusual.
Registrar: Neutral
NameCheap, Inc.
Registered through NameCheap, Inc.
Infrastructure & DNS
DNS Blacklists: Neutral
Clean
Not listed by SpamCop and Barracuda, the blacklists that answered
DNS Resolution: Good
1 IP(s)
Resolves to: 205.166.94.38
DNSSEC: Neutral
Not enabled
Domain is not signed with DNSSEC
DNSSEC: Neutral
unsigned
DNSSEC status from WHOIS
Email (MX Records): Good
1 record(s)
Mail servers: mastodon.sdf.org.
Hosting Network (ASN): Neutral
AS14361 HOPONE-GLOBAL
Hosted on: AS14361 HOPONE-GLOBAL (US)
Page Load Time: Neutral
905ms
Fast page load, timed once from our server in Europe including the DNS lookup, connection setup and any redirects
SPF Record: Good
Present
Domain has SPF email authentication configured
Reputation & Reach
Hacker News: Good
16 stories since 2018
Hacker News readers upvoted links to this site in 5 different years between 2018 and 2026. The most upvoted, "Freenode ops take control of 700 channels" (2021), got 604 points.
Open Graph Type: Neutral
website
og:type declared as website
Page Description: Neutral
"I appreciate SDF but it's a general-purpose server and the name doesn't make it obvious that it's about art." - Eugen R...
"I appreciate SDF but it's a general-purpose server and the name doesn't make it obvious that it's about art." - Eugen Rochko
Page Language: Neutral
en
HTML declares lang="en"
Page Title: Neutral
Mastodon @ SDF
Real Visitor Traffic: Good
Measured by Chrome
Google's Chrome UX Report publishes data for https://mastodon.sdf.org, which it only does once enough distinct real Chrome users have visited over the last 28 days.
Sitemap: Neutral
Not found
No sitemap found — common for smaller sites
Social Media Presence: Neutral
None found
No social media links found on homepage
Structured Data: Neutral
None found
No structured data markup found
Tranco Rank: Neutral
Not ranked
This site is not in the top 1 million most visited websites — this is normal for small or new businesses
Web Archive History: Good
14 years
Earliest archive snapshot from 20120530
Website Status: Good
Online
Website is live and responding
Wikidata Entry: Neutral
mastodon.sdf.org — Mastodon instance operated by SDF, the computing club
Wikidata lists this site as the item's official website, but no Wikipedia article covers the item. Anyone can add a Wikidata item, so on its own this says little.
robots.txt: Good
Present
robots.txt has 6 directives
Run this site? Show your score.
Add a trust badge so visitors can see your live score for themselves.
Mastodon.sdf.org is a social media instance — specifically, a Mastodon server run by the long-standing SDF computing club. Unlike commercial platforms, it's operated as a community service, which explains both its strengths and its quirks.
What works in its favor: the parent domain has been active since 1996, and the site shows up in the Wayback Archive dating back over a decade. Security is handled well — HTTPS is enforced, clickjacking is blocked, and the server passes Google's safety checks. Hacker News has linked to content on this instance positively across several years, which speaks to its reputation in the tech community.
The main thing missing is a straightforward way to get in touch with the instance admin. There's no contact page or email address clearly displayed, which is a transparency gap for any platform where users create accounts. The domain registration also uses a privacy service — common enough, but it means the person behind this particular server isn't directly named.
If you're a Mastodon user looking for a well-run instance with a long track record, mastodon.sdf.org is a reasonable choice. Just know that the community reputation of SDF does most of the heavy lifting here — direct contact and ownership details are less visible than on some newer, more polished instances. That's not a red flag for this kind of site, but it's worth noting.