DomainDNSCheck
Security posture

Domain Security Report

How well a domain is protected against takeover, forged DNS, interception, email spoofing and look-alike names — scored by published rules, with the fixes that matter most first.

Six areas of domain security

Each area is scored from its own findings; the overall score is their weighted average.

Security report or domain report?

The Domain Report rates overall configuration quality: does everything resolve, load and deliver mail. The Security Report uses the same live checks but asks a different question: how hard is it to take over, forge, intercept or impersonate this domain? The two scores are calculated separately and can differ.

How the score works

Every area starts at 100. Only findings listed in the published rules deduct points, and every deduction is shown with its reason. The overall score is the weighted average of the areas that could be checked. Critical findings — an expired certificate, a failing DNSSEC chain, a missing DMARC record — prevent a Strong rating whatever the score.

Unknown is not a failure

If a check could not be completed — a timeout, an unavailable registry, a site that cannot be reached from our servers — it is marked unknown and its area is left out of the score. Nothing is deducted for data that could not be retrieved.

What is not checked

This is a passive review of public DNS, registration, certificate and HTTP information. DomainDNSCheck does not scan ports, test for vulnerabilities, crawl the site or attempt logins.

Area weights

  • Domain control 20
  • DNS protection 20
  • Transport security 20
  • Email anti-spoofing 25
  • Web security headers 10
  • Identity / IDN risk 5

Ratings

  • Strong — score 85 or higher
  • Good — score 70 or higher
  • Needs attention — score 50 or higher
  • Weak — score 0 or higher

Security rules version 2026.09-1. An automated review of public information, not a certification or penetration test.

Security intelligence tools

Look at one area in depth: certificates, publicly observed hostnames, look-alike names and email protection.

Certificate Transparency Search

See certificates publicly logged for a domain and its subdomains: issuers, validity dates and the names they cover.

Passive Subdomain Finder

List hostnames publicly observed in Certificate Transparency logs and whether they still resolve — no brute force, no scanning.

IDN Homograph Risk Analyzer

Check whether an international (Unicode or Punycode) domain name can be visually confused with another name: scripts, look-alike characters and invisible characters.