Website & Email Security Scorecard
Enter a domain and get a quick read on SSL, email authentication, security headers, and public-facing basics.
Checks the hostname, not a page path. Use the domain after @ in your email address for email-record checks.
Scanning...
Want help reviewing these findings?
Use the scan as a first signal. If the result matters, start with the service that matches what showed up.
Common questions
What does the Security Scorecard check?
It checks HTTPS reachability, HTTP-to-HTTPS redirects, published SPF and DMARC policies, common DKIM selectors, and five website-header signals. It uses public lookups and basic website requests.
What does an unconfirmed result mean?
A connection or lookup could not be completed, or a DKIM selector was not discovered. An unconfirmed result is not proof that a protection is missing. The overall grade is withheld if any of the six checks is unconfirmed.
Does it check malware or blacklist reputation?
No reputation or malware lookup is included. The score does not certify safety, validate compliance, or replace a security assessment. DNS and HTTPS connectivity do not establish that a website is trustworthy.
Which domain should I enter?
Enter a public domain or website URL. Only the hostname is checked, and custom ports or credentials are not supported. Email checks use the same hostname; use the domain after @ in your email address when reviewing email records.
What data is sent and can I download a report?
The submitted domain is sent to the checking service, which performs public website and DNS lookups. You can download the result as a text report. Report details are not automatically attached to a contact inquiry.