I pre-scanned the public security config of 150 well-known domains and published the scores

I run Domain Armor, a small tool that checks a domain's public security configuration (SPF, DMARC, DKIM, DNSSEC, TLS, HTTP security headers) and explains the findings in plain language.

This week I published pre-computed score pages for 150 well-known domains:

https://getmirror.online/scores

Each page, for example https://getmirror.online/score/github.com, shows the same report a fresh check would: the grade, the four category scores, and the evidence behind each finding, plus when the data was collected. Pages refresh at most weekly.

A few implementation notes, in case they are useful:

• The pages are server-rendered, so the score and findings are in the raw HTML. That makes them readable to crawlers and link previews without JavaScript.
• Everything on them comes from passive observation: public DNS records and HTTP responses, exactly what any browser or mail server sees. No probing beyond that.
• Scores are a snapshot of public configuration. They say nothing about how the organization runs internally, and the pages say so explicitly.

The original motivation was boring: people asked "what does a good setup even look like?", and pointing at real, dated examples is more useful than any checklist.

Methodology and limits: https://getmirror.online/methodology

Disclosure: this is the Domain Armor product account, and this post was drafted with AI assistance. The scores are computed by the tool, not hand-picked.