One graded report: SSL, headers, and email spoofing defense
Domain Security Report Card
We check the domain's certificate, headers, and DNS records live, server-side. Nothing is stored.
What goes into the grade
SSL/TLS is worth 30 points (certificate validity and days until expiry), security headers are worth 40 (scaled from our header-by-header check), and email authentication is worth 30 (10 each for SPF, DKIM, and DMARC being configured). DKIM is checked against common selectors since there's no way to discover a domain's exact selector name — a missing result there isn't definitive proof DKIM is absent.
Frequently asked questions
What does the Domain Security Report Card actually check?+
Three things: your SSL/TLS certificate (validity, issuer, days until expiry), your HTTP security headers (HSTS, CSP, X-Frame-Options, and more), and your email authentication setup (SPF, DKIM, and DMARC records) — the same fundamentals a real security audit starts with.
Is this a full penetration test or vulnerability scan?+
No. This checks configuration and posture — it doesn't probe for vulnerabilities, attempt exploitation, or scan for open ports. Think of it as a fast health check you'd run before a deeper audit, not a replacement for one.
Why does DKIM sometimes show as "not found" even though we have it configured?+
DKIM records live under a selector name (e.g. "google._domainkey.yourdomain.com") that varies by provider and can be fully custom. We check the selectors used most often in practice, but a non-standard selector name will show as not found even when DKIM is correctly configured — this check is best-effort, not exhaustive.
Do you store the domains people scan?+
No. We fetch the certificate, headers, and DNS records live for each request and return the result — nothing about the scan or the domain is logged or stored.
What's a good score to aim for?+
An A (90+) means valid, non-expiring SSL, a strong set of security headers, and all three email authentication records in place. Most sites land in the B–C range; anything in the D–F range usually means a missing SSL renewal, no CSP/HSTS headers, or no DMARC policy — all fixable without major engineering work.