Bluebench

Domain security checker

Get a letter grade for a domain's email and web security, with a one-line fix for every problem.

A URL or email address works too. We check public DNS, the site's home page and certificate logs.

Your domains

Loading…

What it checks

Email: whether SPF, DMARC and DKIM stop others sending mail as you, including SPF's 10-lookup limit, the DMARC policy that actually applies, and weak DKIM keys. DNS: whether the domain is signed with DNSSEC.

Web: whether the site loads over HTTPS and redirects plain HTTP, sends HSTS and the recommended security headers, and when its newest certificate in public Certificate Transparency logs expires.

How it works

Bluebench reads the domain's public DNS through Cloudflare's 1.1.1.1, requests the site's home page over HTTPS and plain HTTP (following at most 3 redirects, identifying itself as Bluebench), and looks up certificates on crt.sh (or SSLMate's Cert Spotter when crt.sh is down). It never scans ports or crawls beyond the home page. Reports are cached for an hour.