One off probes for
posture you need now.

Verify any domain's SSL/TLS certificate. Check validity, expiry, issuer, protocol version, and cipher strength.

Test TLS protocol support and cipher suites. Detect outdated TLS 1.0/1.1 and weak cipher configurations.

Validate your SSL certificate chain. Verify root CA trust, intermediate certificates, and chain completeness.

See which certificate authorities can issue TLS certs for your domain. Lock this down before a rogue CA does it for you.

Check your DMARC policy configuration. Validate alignment, reporting URIs, and enforcement levels.

Validate your SPF record syntax and DNS lookups. Detect common misconfigurations and lookup limits.

Check any domain's DKIM signing setup. See which selectors are configured and whether outbound mail is cryptographically signed.

Check SPF, DKIM, DMARC, and MX together against the Google & Yahoo bulk sender requirements. One verdict: will your bulk mail get through.

Look up mail exchange records for any domain. View priorities, hostnames, and mail server configuration.

Check if a domain or its IP address appears on common DNS-based blacklists (DNSBLs). Identify deliverability issues before they affect your email reputation.

Verify your domain forces incoming SMTP over TLS (MTA-STS) and that TLS-RPT reporting is configured so you see delivery failures.

Check if your brand logo will appear in Gmail / Apple Mail / Yahoo next to your emails. Validates the BIMI record + VMC pointer.

Query A, AAAA, CNAME, TXT, NS, and SOA records. Check propagation and identify misconfigurations.

Verify if a domain has DNSSEC enabled. Check DS records, DNSKEY records, signing algorithm, and key tags.

Discover subdomains via Certificate Transparency logs. Uncover hidden attack surface and forgotten assets.

Look up WHOIS data for any domain. Check registrar, creation date, expiry date, nameservers, and privacy protection status.

Query 15 global DNS resolvers at once to see where your DNS change has landed. Useful after record updates or nameserver switches.

Analyze HTTP security headers. Check for X-Frame-Options, Content-Security-Policy, HSTS, and more.

Verify HTTP Strict Transport Security configuration. Check max-age, includeSubDomains, and preload status.

Analyze your Content Security Policy. Detect unsafe directives, missing policies, and inline script risks.

Trace HTTP redirect chains. Check each hop's status code, location header, response time, and detect redirect loops.

Analyze cookie security attributes. Check Secure, HttpOnly, and SameSite flags for every cookie a domain sets.

Measure real response times for any domain. Check TCP connect time, time to first byte, and total page load against performance budgets.

Fetch and analyze any website's robots.txt file. See user-agent rules, disallow patterns, sitemap references, and crawl directives.

Scan any domain for commonly open ports. Identify running HTTP, SSH, FTP, SMTP, and database services.

Check if a domain is flagged by DNS-based threat feeds (SURBL, Spamhaus DBL, URIBL, SORBS) for phishing or malware.

Resolve a domain to its IP and reverse DNS. Abuse-database lookups are currently disabled, and we say so rather than invent a score.