Domain Risk Scanner

What the Domain Risk Scanner Checks

This tool runs a broad security posture scan against a single domain and rolls the results into a readable risk picture. Instead of checking one thing in isolation, it samples the layers an attacker (or a careless misconfiguration) would touch first:

• SSL/TLS — certificate validity, expiry, chain, and protocol/cipher health.
• Security headers — HSTS, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy.
• Email authentication — SPF, DKIM, and DMARC records that stop your domain being spoofed.
• DNS health — record sanity, nameserver setup, and common gaps.
• HTTPS enforcement — whether HTTP redirects cleanly to HTTPS.
• Breach history and reputation — known exposure and blocklist signals.

Why a Combined View Matters

Individually, each finding is minor. Together they describe real exposure. A site with a valid certificate but no HSTS and a ~all SPF record is still trivially phishable and downgrade-able. Scanning everything at once lets you triage: fix the high-impact, low-effort items (DMARC enforcement, HSTS, missing CSP) before chasing edge cases.

When to Use It

• Before launching a new domain or subdomain.
• During vendor or acquisition due diligence on a third-party domain.
• As a periodic hygiene check — certificates expire and DNS drifts.

Reading the Results

Treat the score as a prompt, not a verdict. Email authentication and HTTPS enforcement gaps are the items most often weaponized in real attacks, so weight those first. For a deeper look at any certificate the scan flags, the X.509 Certificate Decoder breaks a cert down field by field, including its validity window and signature algorithm.