Back to Tools

Domain Health

A staged, evidence-based health audit for a public domain.

Scan mode
Quick covers routine controls. Deep adds slower infrastructure and vulnerability checks.
Advanced options

Scan progress

Scan status
Waiting to start
0%

All findings

How the Domain Health audit works

The scanner treats each category as an independent stage. DNS checks establish the domain and mail routing foundation, email checks inspect sender-authentication policy, TLS checks inspect certificate and protocol signals, and HTTP checks review redirects and response security. Deep mode can add public infrastructure and vulnerability observations. A failed or unreachable stage does not erase findings produced by the other stages.

How to read the result

  • Health score (0–100): confirmed outcomes for applicable controls, category-weighted. It is not coverage.
  • Coverage (0–100%): the portion of applicable controls conclusively assessed. Low coverage limits certainty and does not itself mean poor health.
  • Grade A–F or ?: ? means insufficient data, not zero and not a pass. The exact current rule is: coverage below 50%, or no active scored category, yields ? / Insufficient data.

Scoring methodology

Scoring model 2.0. Only catalogued, scoring, applicable controls affect the score; not-applicable controls are excluded.

  • Passed, warning, and failed outcomes are conclusive. Warning and failed deductions account for severity, status, and evidence confidence.
  • Unreachable, inconclusive, skipped, and system error outcomes are not passes. They reduce coverage rather than masquerade as confirmed success.
  • A confirmed Critical issue caps the maximum numeric score and grade at 49/F; a confirmed High issue caps them at 69/D under the current grading. An incomplete vulnerability fingerprint does not receive a vulnerability hard cap.
  • Repeated symptoms with the same root cause are grouped, so the strongest relevant deduction applies once.
  • A confirmed Null MX means email is intentionally disabled. DKIM, DMARC, MTA-STS, and TLS-RPT then become not applicable and do not lower the score.
  • The category health and coverage remain separate.
What each status means
Passed
The applicable control was conclusively satisfied.
Needs attention
A conclusive warning identifies an issue worth reviewing.
Action required
A conclusive failure identifies a control that was not satisfied.
Information
An observation is provided without a pass or failure outcome.
Could not verify
The target could not be reached well enough to assess the control.
Not confirmed
The available evidence could not establish a conclusive outcome.
Not checked
The control was skipped and was not assessed.
Check failed
A system error prevented the control from being assessed.
Not applicable
The control does not apply to the observed target and is excluded from scoring.

Limits of this audit

This is a passive, public, point-in-time view from the scanner's vantage point. It is not a penetration test or a compliance guarantee. Independently verify important evidence and CLI results before acting on them.

Scope and safety

Only public targets are accepted. Private, loopback, link-local, reserved, credential-bearing, and unsupported URL targets are rejected before work is queued. Safe transports revalidate redirect destinations and resolved addresses. Quick reports expire after 6 hours and Deep reports after 12 hours; reports are unlisted and marked noindex.

CLI Equivalent

dig +short A example.com
 dig +short MX example.com
 curl -sSIL --max-redirs 5 https://example.com
 openssl s_client -connect example.com:443 -servername example.com </dev/null