Clock domain crossing tools do structural verification, where they analyze design connections and then, to minimize the follow-on engineering effort, classify a path to be safe or unsafe. Many CDC flows rely on this type of structural sign-off method.
Unfortunately, analyzing and classifying the paths based entirely upon design connections, is not a full proof. In complex handshake scenarios, unsafe paths can mistakenly be classified as safe.
For example, classification based on structural connection-based principles alone can incorrectly classify as safe: Unintended drivers in interfaces and unintended feedback.