The latest articles on DEV Community by Domain Armor (@domainarmor). https://dev.to/domainarmor https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F4225795%2Fae09d9dd-dae7-4ccc-9e0e-50ad90114c4c.png https://dev.to/domainarmor en Domain Armor Wed, 04 Nov 2026 09:12:20 +0000 https://dev.to/domainarmor/i-built-a-free-a-f-security-grade-for-any-domain-passive-no-signup-3mlg https://dev.to/domainarmor/i-built-a-free-a-f-security-grade-for-any-domain-passive-no-signup-3mlg <p>Most domain owners have no idea whether their email can be spoofed or whether their site sends the right security headers. The tools to check are scattered: one for SPF and DMARC, another for TLS, another for headers, another for DNS. I wanted one answer, so I built a letter grade.</p> <p><strong><a href="https://getmirror.online" rel="noopener noreferrer">Domain Armor</a></strong> gives any domain an A-F security grade in seconds. Free, no signup, no install.</p> <h2> What it checks </h2> <p>100 points across four areas:</p> <ul> <li> <strong>Email security</strong> - SPF, DMARC, DKIM. This is where most domains fail. A missing or permissive DMARC policy means anyone on the internet can send mail as your domain.</li> <li> <strong>HTTPS and certificate</strong> - HTTPS redirect, certificate validity and expiry.</li> <li> <strong>Browser headers</strong> - HSTS, Content-Security-Policy, frame protection, and the rest of the usual suspects.</li> <li> <strong>DNS infrastructure</strong> - DNSSEC, CAA records, nameserver redundancy.</li> </ul> <p>A critical finding caps the grade at D, so a domain with DMARC missing cannot score an A no matter how good the rest looks.</p> <h2> It is fully passive </h2> <p>Everything the scanner reads is public data:</p> <ul> <li>public DNS records</li> <li>Certificate Transparency logs</li> <li>one ordinary HTTP request to the homepage, the same request any browser makes</li> </ul> <p>No port scanning, no probing, no agents. You can point it at your own domain, a competitor, or a client before a sales call.</p> <p>For every finding it shows the raw evidence, the command to verify it yourself (<code>dig</code>, <code>curl</code>, <code>openssl</code>), and a link to the relevant standard.</p> <h2> Why a letter grade </h2> <p>Security people love detail; everyone else needs an answer. The grade makes the state of a domain obvious in a second, and the full breakdown is there for whoever has to fix it. There is also a head-to-head comparison mode, which I built for before/after-a-fix checks and "us vs them" conversations.</p> <h2> What I want feedback on </h2> <ol> <li>Run it on a domain you own - does the grade match your expectations?</li> <li>Is the scoring fair? The split across the four areas is a judgment call.</li> <li>Is the comparison mode useful or a gimmick?</li> </ol> <p>Built as a side project, still rough around the edges. Tell me what's wrong with it.</p> <p><em>Disclosure: this post was drafted with AI assistance, as part of how we run the Domain Armor project.</em></p> security webdev showdev