Domain Trust Scanner — Live SSL, DNS, Email & Security Report

A single scan runs six independent probes against a domain, rolls each dimension up into a weighted composite, and grades the domain A through F. The report is designed as the master entry point into the DomainScan platform — every capability the score reflects is also available as a standalone tool if you want to drill deeper.

The composite is a weighted average across five independent dimensions. Each dimension runs on its own cadence, is scored on its own 0–100 scale, then rolled up into the single composite number. Every weight is fixed and public — no proprietary black-box scoring.

• SSL Certificate — 25% weight Live TLS handshake. Certificate validity window, days-to-expiry, issuer trust, chain completeness, key strength. Cert with more than 90 days runway scores 100; under 30 days is warn; expired is crit.
• DNS Health — 20% weight Authoritative resolution across A, AAAA, MX, NS records. Presence of A + MX earns 100, A only earns 85, missing everything drops to crit. Cross-referenced with nameserver agreement.
• Domain Expiry — 20% weight Registrar renewal runway from RDAP or WHOIS. Same scale as SSL — >90 days is ok, sliding warn under 90, crit under 30. Zero when the domain has already lapsed.
• Email Authentication — 20% weight SPF, DMARC and DKIM posture combined. Full 100 with SPF present + DMARC reject/quarantine + DKIM signature. Partial credit as each layer weakens or drops out. Zero means the domain is spoofable.
• Security Headers — 15% weight HTTP response header audit — CSP, HSTS, X-Frame-Options, Referrer-Policy, X-Content-Type-Options. Graded A+ through F, mapped to a numeric score. Missing headers are named individually with the exact policy you should ship.

const WEIGHTS = { ssl: 0.25, exp: 0.20, dns: 0.20, email: 0.20, hdr: 0.15 };

function composite(subScores) {
  let weightedSum = 0;
  let totalWeight = 0;
  for (const [cap, w] of Object.entries(WEIGHTS)) {
    const s = subScores[cap];
    if (s && s.status !== 'unknown') {
      weightedSum += s.score * w;
      totalWeight += w;
    }
  }
  return totalWeight === 0 ? 0 : Math.round(weightedSum / totalWeight);
}

function gradeFromScore(score) {
  if (score >= 90) return 'A';
  if (score >= 75) return 'B';
  if (score >= 60) return 'C';
  if (score >= 40) return 'D';
  return 'F';
}

Every domain scanned enters the monitoring engine. Re-checks run on a staggered schedule — volatile signals faster, stable signals slower — so we hit registries and certificate authorities lightly while still catching drift within hours.

• DNS resolution — every 1 hour Fastest-moving signal. A / AAAA / MX / NS records change with deploys, load balancer failovers, and email provider swaps. Hourly cadence catches propagation within one TTL cycle.
• SSL / TLS certificate — every 6 hours Renewals from Let's Encrypt (90-day) or ACME automations (typically 45–60 day) get picked up within a quarter-day. Manual cert swaps at DigiCert / GTS scale are caught same-day.
• Email authentication — every 6 hours SPF/DKIM/DMARC changes ripple within hours of any DNS TXT edit. Same cadence as SSL because both are high-impact security signals.
• Security headers — every 12 hours Header policy shifts less often than transport or auth — twice-daily fetch keeps the audit fresh without hammering the origin.
• WHOIS / registrar data — every 24 hours Registrar and expiry data update slowly and rate-limit heavily. Daily cadence is deliberate; anything more aggressive would trigger blocks at Verisign, MarkMonitor, and other high-volume registries.

Grades map score bands to a five-letter scale. The scoring gradient is deliberately non-linear — the score curve rewards well-configured domains and penalizes real security gaps proportionally to their exploitability.

• Grade A (≥ 90) — Production-grade SSL healthy with runway, DNS complete with MX + A, DMARC at reject or quarantine, security headers A/A+. Domain is publicly indistinguishable from mature infrastructure. Fewer than 8% of Tranco top-1M sit here.
• Grade B (75–89) — Good with a gap Solid overall, one or two dimensions could improve. Typical shortfalls: DMARC at 'none' policy (SPF still enforced but no visibility), or missing security headers, or SSL renewal window under 30 days.
• Grade C (60–74) — Working but exposed Multiple dimensions need attention. Common shape: SPF present but DMARC absent, headers below C, expiring cert. Working infrastructure but a real attacker would have measurable footholds.
• Grade D (40–59) — Serious issues Two or more critical failures. Expired cert, absent email authentication, no security headers at all. Domain may still function but is trivial to abuse for phishing or spoofing.
• Grade F (< 40) — Broken or hostile Fundamental problems — cert failure, dead DNS, or an actively parked / hijacked state. Do not trust email or web traffic from an F-grade domain without out-of-band verification.

Every scanned domain that grades D or higher qualifies for an embeddable trust badge. The badge is a single SVG served from the same origin as the report — no JavaScript to load, no CORS gymnastics, no tracking pixels. It re-fetches the underlying score every scan cycle so what visitors see always matches your live report.

<a href="https://domainscan.in/scan/yoursite.com" rel="noopener">
  <img src="https://domainscan.in/badge/yoursite.com.svg?variant=horizontal"
       width="260" height="44"
       alt="DomainScan Trust — verified" />
</a>

[![DomainScan Trust](https://domainscan.in/badge/yoursite.com.svg)](https://domainscan.in/scan/yoursite.com)

This report is a UI over api.domainscan.in — the same JSON that renders every card is available to your code. No signup, no API keys, no billing tier. Free is the whole tier. Every endpoint is CORS-enabled and returns a stable `{ success, data, error }` envelope.

curl "https://api.domainscan.in/api/v1/domain/trust?domain=cloudflare.com"

curl "https://api.domainscan.in/api/v1/security/ssl-info?domain=cloudflare.com"

curl "https://api.domainscan.in/api/v1/domain/dns?domain=cloudflare.com"

{
  "success": true,
  "data": {
    "domain": "cloudflare.com",
    "score":  97,
    "grade":  "A",
    "subScores": {
      "ssl":   { "score": 100, "status": "ok"   },
      "dns":   { "score": 100, "status": "ok"   },
      "exp":   { "score": 100, "status": "ok"   },
      "email": { "score":  95, "status": "ok"   },
      "hdr":   { "score":  85, "status": "ok"   }
    }
  }
}

Six recurring patterns for teams and individuals:

• How long does the first scan take? For a domain we haven't seen before, six probes run in parallel: SSL handshake, DNS resolution, WHOIS/RDAP lookup, SPF, DMARC, and HTTP header fetch. Median wall time is under 30 seconds; heavier registries or unresponsive sites can push it to 60. The page polls the backend every 4 seconds and fills in each dimension as its probe completes — you see the score materialize live.
• Is the data cached? Yes, at multiple layers. Each probe result is stored with a 30-day TTL. Composite scores refresh on every probe cycle. The badge SVG is CDN-cached for one hour by default with stale-while-revalidate — you always get an image, never a broken embed.
• What triggers a monitoring event? Any material change between two consecutive probe snapshots — a new SSL certificate, a DMARC policy switch, an NS record change, a domain expiry date update, a header removal. Events are classified by severity (crit / high / medium / low / info) and shown in the Recent Changes tab.
• How is a scan different from a WHOIS lookup? WHOIS returns only registration metadata — creation date, expiry, registrar, nameservers. A trust scan runs six independent live probes and produces a security posture verdict. WHOIS answers 'who owns this?' — a scan answers 'is this configured correctly and safe to trust?'
• Can I rescan on demand? Yes. The Rescan button boosts all probe jobs to run immediately with a 30-second per-job cooldown. Fresh results start landing within seconds. Useful right after you ship a security header fix or DMARC upgrade — you don't have to wait for the next cadence tick.
• Do you support IPv6 / internationalized domain names (IDN)? Yes to both. AAAA records are fetched alongside A. Internationalized domains are normalized to punycode (xn--) at probe time and displayed in their unicode form in the UI. Emoji domains work but are visually filtered from the badge to keep SVG size predictable.
• How is this different from Qualys SSL Labs or SecurityHeaders.com? Those tools each grade one dimension. Domain Trust Scanner aggregates SSL Labs-style TLS analysis, SecurityHeaders-style HTTP header grading, MXToolBox-style email authentication, plus WHOIS and DNS into one composite. And it monitors continuously — you don't re-run each scan manually.
• Is there a rate limit? The public API doesn't require an API key and doesn't apply per-IP rate limits at the free tier. Probes are backed by upstream services (Verisign RDAP, Google DNS, etc.) that have their own limits — we cache aggressively to avoid burning through them. Sustained high-volume use should identify the caller via User-Agent so we can talk about a plan.

The trust report aggregates the same probes you can also run standalone. Every tool below is free and unauthenticated.