scanner

gradedns.com grades a domain's DNS, email and HTTPS security from the outside. A grade runs when someone asks for one, and every day for domains their owners pay to watch. The checks come from one server, 72.11.152.11, whose reverse DNS is gradedns.com.

what a grade does

• DNS. Looks up the domain's public records. It asks its nameservers directly, including a zone transfer (AXFR) request to each one, to see if the zone is open to anyone, and a lookup of example.com, to see if they resolve names for anyone.
• Web. A few HTTP and HTTPS requests to the domain and its www: the home page, wherever it redirects, the page it lands on once more with an Origin header (to see which sites its CORS policy lets read it), /.well-known/security.txt and /security.txt, the MTA-STS policy if the domain publishes one, and the home page of any of its common subdomains (shop, status, mail...) or the names on its certificate that point at another service, to see if that service still has a site there. The user agent ends in +https://gradedns.com/scanner.
• TLS. Tests which TLS versions and ciphers the HTTPS server accepts. That's several hundred short handshakes over a minute or so, at most three at a time. A watched domain gets this at most once a week while its certificate doesn't change.
• Blocklists. Looks up the domain's addresses on public spam blocklists, and the domain itself on Quad9, Cloudflare's 1.1.1.2 and OpenDNS. Those queries go to them, not to you.

Nothing else: no logins or password guessing, no vulnerability probes, no port scans.

how grades work

• Each check starts at 100 and loses points for every problem it finds: 50 for a critical one, 25 high, 10 medium, 5 low. Low ones add up to 15 at most: a pile of small things isn't a big thing. A missing hardening feature (DNSSEC, CAA, MTA-STS) costs 25, a C: worth doing, not alarming.
• The overall grade is the average of the checks, weighted by how much each protects you: DMARC and TLS count 1.5 times, DNSSEC 0.75, CAA and MTA-STS 0.5, BIMI 0.25, the rest once. 90 and up is an A, 80 a B, 70 a C, 60 a D.
• An A means no serious problem. A high one, like DMARC that only monitors, caps the overall grade at 89 (B); a critical one, like no DMARC at all or an expired certificate, at 69 (D).
• Not counted: what isn't yours to change (a site builder's headers, a mail service's DKIM key, a big provider's shared servers), a check we couldn't run this time (its last grade within a week stands in), and things that are information rather than security, like TTLs and IPv6.

letting it in

Bot protection (Cloudflare's Bot Fight Mode, a WAF challenge) often answers our home-page request with HTTP 403, and then a report can't grade your security headers. To include them, allow the address 72.11.152.11, or user agents ending in +https://gradedns.com/scanner, in your firewall's rules. In Cloudflare that's a WAF custom rule with the action Skip, for that IP. We don't disguise ourselves as a browser to get past it.

opting out

Email abuse@gradedns.com from an address at the domain, or with some other sign that you run it, and say which domain. It goes on an opt-out list, usually within a day. Grades of it, and of its subdomains, are refused from then on, and its public report page comes down.

anything else

Abuse reports go to abuse@gradedns.com. Security issues with gradedns.com itself go to security@gradedns.com.