# domainposture.com > runs an external security scan of any domain and turns it into a dated, signed report. the free scan covers eighteen checks — fifteen on DNS, MX, SPF, DMARC, DKIM, TLS, redirects, security headers, CORS, web surface, DNSSEC, MTA-STS, TLS-RPT, WHOIS and CT log, plus the ai layer: security.txt, llms.txt and ai-crawler policy. prove you own a domain with a dns txt record to run a deeper active scan for exposed secrets and config (the full scan). built for security teams and consultants who scan client domains. the same engine also publishes the ai ecosystem's own posture (the observatory) and answers the domain-security section of a vendor security questionnaire (CAIQ, SIG, or custom) with Ed25519-signed evidence mapped to SOC 2 and ISO 27001 controls. free scans are unauthenticated over http (web) or mcp (claude desktop, cursor, windsurf, chatgpt connectors). ## free domain scan the front door: an external security posture scan of any domain, no signup. eighteen checks across dns, email authentication, tls, security headers, dnssec and the ai layer, dated and re-runnable. - [scan any domain](https://www.domainposture.com/): the free 18-check dossier - [full scan](https://www.domainposture.com/full-scan): dns-txt-verified deep scan for exposed secrets and config - [for security teams & consultants](https://www.domainposture.com/for-consultancies): scan every client domain, monitored and white-labelled - [signed report](https://www.domainposture.com/evidence-pack): ed25519-signed, dated domain security report - [pricing](https://www.domainposture.com/pricing): free scan, one-off report, monitoring plans ## ai observatory outside-in security posture for named ai vendors and mcp servers. every entity is scored on the same checks, dated, and linked to its full domain dossier. - [ai observatory](https://www.domainposture.com/ai): hub, with ecosystem-wide statistics - [mcp servers ranked by security posture](https://www.domainposture.com/ai/rankings/mcp-servers) - [model providers ranked by security posture](https://www.domainposture.com/ai/rankings/model-providers) - [ai apps & tools ranked by security posture](https://www.domainposture.com/ai/rankings/ai-apps) - [agent platforms & frameworks ranked by security posture](https://www.domainposture.com/ai/rankings/agent-platforms) ## questionnaire answers each page gives the exact wording for one questionnaire item plus the SOC 2 / ISO 27001 controls it evidences. - [all domain questionnaire questions](https://www.domainposture.com/questionnaire): index of the 15 questions - [Are the standard apex DNS records (A/AAAA/NS) published and resolving correctly?](https://www.domainposture.com/questionnaire/dns-records-lookup): Apex DNS records resolve correctly across the queried record types. - [Does the domain publish valid MX records for inbound mail handling?](https://www.domainposture.com/questionnaire/mx-lookup): MX records are published and resolve to valid mail exchangers. - [Is SPF published with a hardfail (-all) policy on the sending domain?](https://www.domainposture.com/questionnaire/spf-checker): SPF is published with a hardfail (-all) policy. - [Does your domain enforce DMARC with a quarantine or reject policy?](https://www.domainposture.com/questionnaire/dmarc-checker): DMARC is published and enforcing (p=quarantine or p=reject). - [Are DKIM keys published with sufficient key strength (>= 1024 bits)?](https://www.domainposture.com/questionnaire/dkim-lookup): At least one DKIM selector is published with adequate key strength. - [Is the public web endpoint protected by a valid TLS certificate from a trusted CA?](https://www.domainposture.com/questionnaire/tls-certificate-checker): The public web endpoint serves a valid, trusted TLS certificate. - [Does the public web endpoint redirect HTTP to HTTPS within a single hop?](https://www.domainposture.com/questionnaire/redirect-checker): HTTP traffic redirects to HTTPS cleanly on the public web endpoint. - [Are HSTS, CSP, X-Frame-Options, and X-Content-Type-Options set on the public web endpoint?](https://www.domainposture.com/questionnaire/security-headers-checker): The core security response headers are present on the public web endpoint. - [Does the public web endpoint avoid a permissive (wildcard) CORS configuration on credentialed responses?](https://www.domainposture.com/questionnaire/cors-checker): The public web endpoint does not advertise a permissive CORS policy. - [Has the public web surface (server identification, exposed paths) been reviewed?](https://www.domainposture.com/questionnaire/web-surface-inspector): Public web surface inspection found no obvious exposure. - [Is MTA-STS published to enforce TLS for inbound SMTP?](https://www.domainposture.com/questionnaire/mta-sts-checker): MTA-STS is published and enforcing TLS for inbound SMTP. - [Is TLS-RPT (SMTP TLS Reporting) published for failure visibility?](https://www.domainposture.com/questionnaire/tlsrpt-checker): TLS-RPT is published with a valid reporting address. - [Is DNSSEC enabled on the apex domain?](https://www.domainposture.com/questionnaire/dnssec-checker): DNSSEC is enabled and the chain validates. - [Is the domain registration verifiable via WHOIS / RDAP with active status?](https://www.domainposture.com/questionnaire/whois-lookup): WHOIS/RDAP shows the domain is registered and in active status. - [Are TLS certificates monitored via Certificate Transparency logs for unauthorised issuance?](https://www.domainposture.com/questionnaire/ct-log-lookup): Issued certificates are visible in Certificate Transparency logs (CT-monitoring viable). ## tools - [user agent](https://drwho.me/tools/user-agent): parse your browser's user agent string (browser, os, device, engine). - [what is my ip](https://drwho.me/tools/ip): your public ip address, location, and timezone. - [http headers](https://drwho.me/tools/headers): inspect the http request headers your browser sends. - [ip lookup](https://drwho.me/tools/ip-lookup): look up any IP's geolocation, ASN, and ISP (via ipinfo.io). - [dns lookup](https://drwho.me/tools/dns): resolve A, AAAA, MX, TXT, NS, or CNAME records via Cloudflare DoH. - [dns records lookup](https://drwho.me/tools/dns-records-lookup): resolve A, AAAA, NS, SOA, CAA, and TXT records for a domain in one go. - [mx lookup](https://drwho.me/tools/mx-lookup): list the mail exchangers (MX records) a domain advertises, sorted by priority. - [blacklist check](https://drwho.me/tools/blacklist-check): check whether a domain's web and mail server IPs are on email blocklists (Barracuda, SpamCop, UCEPROTECT, Mailspike, PSBL, s5h). - [spf checker](https://drwho.me/tools/spf-checker): find and parse a domain's SPF (sender policy framework) record. - [dmarc checker](https://drwho.me/tools/dmarc-checker): find and parse a domain's DMARC policy record at _dmarc.. - [dmarc record generator](https://drwho.me/tools/dmarc-record-generator): build a valid DMARC TXT record from your policy, reporting addresses and alignment — with warnings for the mistakes people make. - [spf record generator](https://drwho.me/tools/spf-record-generator): build a valid SPF TXT record from your includes, IPs and qualifier — with a live count of the 10-DNS-lookup limit. - [dkim lookup](https://drwho.me/tools/dkim-lookup): probe common DKIM selectors (default, google, k1, selector1/2, mxvault) for a domain. - [tls certificate checker](https://drwho.me/tools/tls-certificate-checker): inspect a domain's TLS certificate: subject, issuer, validity, SANs, fingerprint. - [redirect checker](https://drwho.me/tools/redirect-checker): trace the HTTP(S) redirect chain from https:/// up to 10 hops. - [security headers checker](https://drwho.me/tools/security-headers-checker): inspect the response headers served at https:/// — HSTS, CSP, X-Frame-Options, etc. - [cors checker](https://drwho.me/tools/cors-checker): run a CORS preflight (OPTIONS) against a domain and surface the access-control-* response headers. - [web surface inspector](https://drwho.me/tools/web-surface-inspector): fetch robots.txt, sitemap.xml, and the home page's to summarise a domain's public-web surface. - [dnssec checker](https://drwho.me/tools/dnssec-checker): verify DNSSEC chain-of-trust (DS, DNSKEY, and AD flag) for a domain. - [mta-sts checker](https://drwho.me/tools/mta-sts-checker): fetch and validate a domain's MTA-STS policy (mode, mx, max_age). - [tls-rpt checker](https://drwho.me/tools/tlsrpt-checker): look up a domain's TLS-RPT (SMTP TLS Reporting) policy. - [whois lookup](https://drwho.me/tools/whois-lookup): registrar, creation date, expiry date, and registry statuses for a domain. - [ct-log lookup](https://drwho.me/tools/ct-log-lookup): discover subdomains via Certificate Transparency logs (crt.sh / certspotter). - [ai-crawler checker](https://drwho.me/tools/ai-crawler-checker): see whether a domain's robots.txt has declared a stance for GPTBot, ClaudeBot, and other major AI crawlers. - [llms.txt checker](https://drwho.me/tools/llms-txt-checker): check whether a domain publishes an llms.txt content index for AI agents. - [security.txt checker](https://drwho.me/tools/security-txt-checker): check whether a domain publishes a security.txt (RFC 9116) so researchers have a way to report vulnerabilities. ## mcp - [endpoint](https://www.domainposture.com/mcp/mcp): streamable http transport for ai clients - [landing page](https://drwho.me/mcp): setup instructions and tool list - [server.json](https://www.domainposture.com/server.json): mcp server manifest ## site - [home](https://www.domainposture.com/): browsable tool grid - [blog](https://www.domainposture.com/blog): technical notes on the tools and mcp - [rankings](https://www.domainposture.com/rankings): cohort email-security rankings - [feed.xml](https://www.domainposture.com/feed.xml): atom feed of new posts and rankings - [about](https://www.domainposture.com/about): maintainer and mission - [privacy](https://www.domainposture.com/privacy): privacy policy (cookieless analytics, no accounts)