WEB SITE SECURITY CHECK
Check HTTP headers, DNS, SPF, and DMARC
Enter a URL to check HTTP headers such as CSP and HSTS, DNS records, SPF, and DMARC.
CHECKING YOUR URL
Checking the URL you entered
We are checking browser security rules, domain records, and email sender authentication.
- Browser security rulesHTTP headers (CSP, HSTS, etc.)Waiting
- Domain recordsDNS records (A, AAAA, MX, etc.)Waiting
- Email sender authenticationSPF and DMARCWaiting
DIAGNOSTIC RESULT
— public settings
Check completeNeeds review or not foundCannot determine
HTTP headers—
MDN checks the HTTP headers that tell browsers how to apply security rules.
Overall grade—
Score—
Passed—
Needs review—
HTTP status—
Last scan—
DNS records—
| Type | Status | Value |
|---|
DNSSEC― Cannot determine
Retrieving DNSSEC validation status.
The absence of AAAA or CAA records does not by itself indicate a problem.
Email authentication (SPF and DMARC)—
SPFAllowed senders
—DMARCPolicy for authentication failures
—About DKIM
DKIM requires a selector, so this check cannot test it automatically and will not report it as missing.
Suggested improvements—
SCOPE & LIMITATIONS
What this tool does not check
This basic check reviews HTTP and DNS settings visible on the internet. It does not prove that a site has no vulnerabilities or guarantee overall security.
- Live SQL injection/XSS testing and CSRF vulnerabilities
- WordPress plugins, CMS, PHP, Apache, and other vulnerabilities
- Password strength, authentication, access control, and internal server settings
- Malware infections and web application logic vulnerabilities
- TLS versions, certificate validity/issuer/SAN, and cipher suites
SECURITY CHECK / 13
These are the three areas we can check.
Review browser display rules, domain records, and email sender authentication to see their status and possible improvements.
What is checked
- Browser security rules
HTTP headers such as CSP and HSTS - Domain records
A, AAAA, NS, CNAME, MX, TXT, CAA, and DNSSEC - Email sender authentication
SPF and DMARC
Not checked: Live SQL injection/XSS testing and CSRF vulnerabilities, WordPress plugins, CMS, PHP, Apache, and other vulnerabilities, Password strength, authentication, access control, and internal server settings, Malware infections and web application logic vulnerabilities, TLS versions, certificate validity/issuer/SAN, and cipher suites
Checks public configuration only
HOW IT WORKS
Public settings, checked from three angles.
HTTP Security
MDN HTTP Observatory v2 provides an overall grade and score for HTTP security settings. See the MDN report for individual test details.
DNS Configuration
Google Public DNS JSON API checks public records such as A, AAAA, NS, CNAME, MX, TXT, and CAA.
Mail Security
SPF and DMARC are checked from TXT records. The domain is sent to external APIs and results are shown temporarily in this browser.
SERVICE REFERENCES
Services and specifications
This browser uses public APIs from external services. No external libraries, custom backend, or database are used.