> ## Documentation Index
> Fetch the complete documentation index at: https://docs.salad.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Destination Health Checks

> Optional feature to increase success rate when connecting to specific domains

*Last Updated: March 20, 2025*

## About Destination Health Checks (DHC)

SGS can be configured to periodically monitor its available egress nodes for successful connectivity to particular
services. This is only recommended for connecting to services which are particularly aggressive about blocking even
high-quality residential IPs such as those provided by SGS.

<Note>
  SGS does not come configured with Destination Health Checks by default. If you feel that you need it in a specific
  region, notify your account manager. They will work with you to ensure that the SGS server you are using is configured
  to detect nodes' connectivity to your desired service(s), for a nominal fee. Once configured, your account manager
  will provide you with a list of capability names, each of which represents one configured connectivity test.
</Note>

## Requesting DHC capability

When sending SGS a CONNECT request to route traffic that should be routed only via egress nodes that are marked as
capable of supporting a given capability, the incoming request should specify the capability name (e.g., `nflx`) in one
of two ways:

1. By including an `X-Sgs-Capabilities` header whose value is `nflx`

```
$ curl -v --proxy-header 'X-Sgs-Capabilities: nflx' -x
'https://user4:{password}@sgs-server.salad.com' https://ipinfo.io/ip
* Trying 127.0.0.1:443...
* Connected to (nil) (127.0.0.1) port 443 (#0)
* allocate connect buffer!
* Establish HTTPS proxy tunnel to ipinfo.io:443
* Proxy auth using Basic with user 'user4'
> CONNECT ipinfo.io:443 HTTP/1.1
> Host: ipinfo.io:443
> Proxy-Authorization: Basic <PASSWORD>
> User-Agent: curl/7.81.0
> Proxy-Connection: Keep-Alive
> X-Sgs-Capabilities: nflx
```

2. By appending a `&cap=` followed by the capability name, to the username portion of the authorization string.

```
$ curl -v -x 'https://user4&cap=nflx:{password}@sgs-server.salad.com'
https://ipinfo.io/ip
* Trying 127.0.0.1:443...
* Connected to (nil) (127.0.0.1) port 443 (#0)
* allocate connect buffer!
* Establish HTTPS proxy tunnel to ipinfo.io:443
* Proxy auth using Basic with user 'user4&cap=nflx'
> CONNECT ipinfo.io:443 HTTP/1.1
> Host: ipinfo.io:443
> Proxy-Authorization: Basic <PASSWORD>
> User-Agent: curl/7.81.0
> Proxy-Connection: Keep-Alive
```

## Additional considerations

The special capability name `any` is active by default and specifies that any egress node, regardless of which
capabilities it has, can service the request.

If both the header and the username specify a capability, the capability specified in the username takes precedence.

Currently, only one capability may be specified per request.

<Note>
  The SGS route association memory incorporates the capability name into the session ID. Thus, the session
  `user4&cap=nflx` vs `user4&cap=bbc` may be associated with different egress nodes. For purposes of route association
  memory, the capability specified via the `X-Sgs-Capabilities` header is incorporated into the username. For example, a
  connection specifying the `nflx` capability via header, but no capability in the `user4` authorization header will be
  memorized as `user4&cap=nflx`
</Note>