Is Domain Security Check free?
Yes. It is a private, non-commercial project: no cost, no signup, no advertising, no affiliate links.
Frequently asked questions
The most common questions about the free domain security check: cost, privacy, what is checked, how the grade is calculated, and how the tool compares to single-purpose scanners.
What exactly is checked?
Six modules in one scan – more than 100 individual checks: website HTTPS/TLS (certificates, protocol versions, ciphers, forward secrecy), mail server STARTTLS and DANE/TLSA, email authentication (SPF, DKIM, DMARC, BIMI, MTA-STS, TLS-RPT), DNSSEC, general DNS hygiene, and HTTP security headers.
Do you store scan results or track visitors?
No visitor tracking, no analytics and no cookies. Scan results live in an in-memory cache for up to one hour so repeated checks don't re-probe your servers, then they are discarded — never written to disk. What does leave a trace — Cloudflare Turnstile on the scan form, the server access logs, and the receiver test's suppression list — is described in the privacy policy.
How is the grade calculated?
Each check yields a weighted finding; the weighted score maps to a letter grade from A+ to F. Serious single findings cap the module grade regardless of the average (rating caps modeled on the SSL Labs Server Rating Guide) – accepting a NULL, export or anonymous cipher suite, for example, caps the website module at F. An expired certificate usually produces the special grade T instead, because the chain no longer validates at all; where the chain could still be built, the expiry itself caps at F. Full methodology →
How is this different from SSL Labs or securityheaders.com?
Those tools each cover one aspect. This scan combines the most important checks of SSL Labs, securityheaders.com, internet.nl, Hardenize, Mailhardener and DNSViz-style DNSSEC analysis into a single report for the whole domain. Detailed comparison →
Can I see or block the scanner in my logs?
Yes — for everything that reaches your servers. HTTP requests carry a stable User-Agent token linking to the scanner page, and the HTTP, TLS and SMTP probes come from fixed, published IP addresses with matching reverse DNS (the scanner and the receiver test use separate, published pairs). Most DNS lookups run through public DNS-over-HTTPS resolvers and never touch your name servers; only two checks query them directly on port 53. Identify & block the scanner →