Domain Armor：免費、免註冊的被動式網域安全評級工具

Most domain owners have no idea whether their email can be spoofed or whether their site sends the right security headers. The tools to check are scattered: one for SPF and DMARC, another for TLS, another for headers, another for DNS. I wanted one answer, so I built a letter grade.

Domain Armor gives any domain an A-F security grade in seconds. Free, no signup, no install.

What it checks

100 points across four areas:

Email security - SPF, DMARC, DKIM. This is where most domains fail. A missing or permissive DMARC policy means anyone on the internet can send mail as your domain.
HTTPS and certificate - HTTPS redirect, certificate validity and expiry.
Browser headers - HSTS, Content-Security-Policy, frame protection, and the rest of the usual suspects.
DNS infrastructure - DNSSEC, CAA records, nameserver redundancy.

A critical finding caps the grade at D, so a domain with DMARC missing cannot score an A no matter how good the rest looks.

It is fully passive

Everything the scanner reads is public data:

public DNS records
Certificate Transparency logs
one ordinary HTTP request to the homepage, the same request any browser makes

No port scanning, no probing, no agents. You can point it at your own domain, a competitor, or a client before a sales call.

For every finding it shows the raw evidence, the command to verify it yourself (dig, curl, openssl), and a link to the relevant standard.

Why a letter grade

Security people love detail; everyone else needs an answer. The grade makes the state of a domain obvious in a second, and the full breakdown is there for whoever has to fix it. There is also a head-to-head comparison mode, which I built for before/after-a-fix checks and "us vs them" conversations.

What I want feedback on

Run it on a domain you own - does the grade match your expectations?
Is the scoring fair? The split across the four areas is a judgment call.
Is the comparison mode useful or a gimmick?

Built as a side project, still rough around the edges. Tell me what's wrong with it.

Disclosure: this post was drafted with AI assistance, as part of how we run the Domain Armor project.