I built a free A-F security grade for any domain - passive, no signup
Most domain owners have no idea whether their email can be spoofed or whether their site sends the right security headers. The tools to check are scattered: one for SPF and DMARC, another for TLS, another for headers, an
Most domain owners have no idea whether their email can be spoofed or whether their site sends the right security headers. The tools to check are scattered: one for SPF and DMARC, another for TLS, another for headers, another for DNS. I wanted one answer, so I built a letter grade.
Domain Armor gives any domain an A-F security grade in seconds. Free, no signup, no install.
What it checks
100 points across four areas:
- Email security - SPF, DMARC, DKIM. This is where most domains fail. A missing or permissive DMARC policy means anyone on the internet can send mail as your domain.
- HTTPS and certificate - HTTPS redirect, certificate validity and expiry.
- Browser headers - HSTS, Content-Security-Policy, frame protection, and the rest of the usual suspects.
- DNS infrastructure - DNSSEC, CAA records, nameserver redundancy.
A critical finding caps the grade at D, so a domain with DMARC missing cannot score an A no matter how good the rest looks.
It is fully passive
Everything the scanner reads is public data:
- public DNS records
- Certificate Transparency logs
- one ordinary HTTP request to the homepage, the same request any browser makes
No port scanning, no probing, no agents. You can point it at your own domain, a competitor, or a client before a sales call.
For every finding it shows the raw evidence, the command to verify it yourself (dig, curl, openssl), and a link to the relevant standard.
Why a letter grade
Security people love detail; everyone else needs an answer. The grade makes the state of a domain obvious in a second, and the full breakdown is there for whoever has to fix it. There is also a head-to-head comparison mode, which I built for before/after-a-fix checks and "us vs them" conversations.
What I want feedback on
- Run it on a domain you own - does the grade match your expectations?
- Is the scoring fair? The split across the four areas is a judgment call.
- Is the comparison mode useful or a gimmick?
Built as a side project, still rough around the edges. Tell me what's wrong with it.
Disclosure: this post was drafted with AI assistance, as part of how we run the Domain Armor project.
Originally published by Dev.to Security. Aggregated on AIWithGhost for educational purposes — full credit and traffic to the original publisher.