How Domain Security Check compares to SSL Labs, internet.nl, Hardenize & MxToolbox
Most domain security tools test one aspect: SSL Labs grades web TLS, securityheaders.com grades response headers, MxToolbox focuses on mail and DNS records. Domain Security Check runs more than 100 individual checks across six modules – web TLS, mail STARTTLS & DANE, DNS, DNSSEC, email authentication and HTTP security headers – in a single free scan with no signup.
The closest all-in-one alternatives are internet.nl (the free Dutch-government standards test) and Hardenize (now part of Red Sift: a free one-off report is still available, continuous monitoring is commercial). Here is an honest feature overview:
Coverage at a glance
| Check | Domain Security Check | SSL Labs | securityheaders.com | internet.nl | Hardenize | MxToolbox |
|---|---|---|---|---|---|---|
| Web TLS: certificates, protocols, ciphers, PFS | ✔ | ✔ (deepest) | – | ✔ | ✔ | partial |
| Mail server STARTTLS | ✔ | – | – | ✔ | ✔ | ✔ |
| DANE / TLSA (mail and web) | ✔ | – | – | ✔ (mail) | ✔ | – |
| DNSSEC validation | ✔ | – | – | ✔ | ✔ | partial |
| SPF & DMARC | ✔ | – | – | ✔ | ✔ | ✔ |
| DKIM (selector discovery & key length) | ✔ | – | – | partial (presence only) | – | ✔ (selector required) |
| MTA-STS & TLS-RPT | ✔ | – | – | – | ✔ | ✔ (separate lookups) |
| HTTP security headers (graded) | ✔ | – | ✔ (deepest) | partial | ✔ | – |
| DNS hygiene: NS redundancy, CAA, reverse DNS | ✔ | – | – | partial | ✔ | ✔ |
| RPKI (route origin validation) | ✔ | – | – | ✔ | – | – |
| One combined report for the whole domain | ✔ | – | – | partial (two tests) | ✔ | partial (Domain Health, no grade) |
| Price | free | free | free | free | free one-off report; monitoring commercial | freemium |
| Signup required | no | no | no | no | no (report) / yes (monitoring) | no (paid features: yes) |
Feature matrix as of July 2026, based on each tool's public documentation and test pages. Tools evolve – if something here is outdated, please say so via the contact address in the Impressum. "partial" means the aspect is touched but not covered in comparable depth.
When to use which tool
- Deep-dive web TLS analysis: SSL Labs remains the reference for handshake simulation across historic clients. Our web module covers the same core checks (protocols, ciphers, PFS, chain, key strength) plus DANE for HTTPS.
- Header fine-tuning: securityheaders.com pioneered header grading. Our headers module additionally evaluates CSP quality, cookie flags, CORS and information leaks in the context of the whole domain.
- Compliance with Dutch/EU government standards: internet.nl tests against the official "comply or explain" list (including IPv6 reachability everywhere). It does not check MTA-STS or TLS-RPT, and its DKIM subtest only verifies presence – no selector discovery or key-length evaluation.
- Continuous enterprise monitoring: Hardenize (Red Sift) monitors domain portfolios over time – a different, commercial use case.
- Mail record lookups & blacklists: MxToolbox offers many individual lookup tools, including blacklist monitoring, but no DANE; its Domain Health check aggregates issue counts without a grade.
Everything in one run, free, no signup: that is the niche this tool fills. Check your domain now →