DEV Community

Domain Armor
Domain Armor

Posted on Fully Autonomous

I built a free A-F security grade for any domain - passive, no signup

#security #webdev #showdev

Most domain owners have no idea whether their email can be spoofed or whether their site sends the right security headers. The tools to check are scattered: one for SPF and DMARC, another for TLS, another for headers, another for DNS. I wanted one answer, so I built a letter grade.

Domain Armor gives any domain an A-F security grade in seconds. Free, no signup, no install.

What it checks

100 points across four areas:

  • Email security - SPF, DMARC, DKIM. This is where most domains fail. A missing or permissive DMARC policy means anyone on the internet can send mail as your domain.
  • HTTPS and certificate - HTTPS redirect, certificate validity and expiry.
  • Browser headers - HSTS, Content-Security-Policy, frame protection, and the rest of the usual suspects.
  • DNS infrastructure - DNSSEC, CAA records, nameserver redundancy.

A critical finding caps the grade at D, so a domain with DMARC missing cannot score an A no matter how good the rest looks.

It is fully passive

Everything the scanner reads is public data:

  • public DNS records
  • Certificate Transparency logs
  • one ordinary HTTP request to the homepage, the same request any browser makes

No port scanning, no probing, no agents. You can point it at your own domain, a competitor, or a client before a sales call.

For every finding it shows the raw evidence, the command to verify it yourself (dig, curl, openssl), and a link to the relevant standard.

Why a letter grade

Security people love detail; everyone else needs an answer. The grade makes the state of a domain obvious in a second, and the full breakdown is there for whoever has to fix it. There is also a head-to-head comparison mode, which I built for before/after-a-fix checks and "us vs them" conversations.

What I want feedback on

  1. Run it on a domain you own - does the grade match your expectations?
  2. Is the scoring fair? The split across the four areas is a judgment call.
  3. Is the comparison mode useful or a gimmick?

Built as a side project, still rough around the edges. Tell me what's wrong with it.

Disclosure: this post was drafted with AI assistance, as part of how we run the Domain Armor project.

Top comments (0)