Security report
northwind-traders.com
Scanned
B
84of 100
Solid, with a few things worth tightening.
80–89 is a B.
- Email78
- Certificate & HTTPS96
- Security headers71
- DNS hygiene100
- Reputation100
Free · no signup · about 20 seconds
Know your domain is safe — before a customer tells you it isn’t.
34 checks across email, certificates, headers, DNS and blocklists — one A–F grade, and the exact record to paste for everything that isn’t right. Free for one domain; daily watching from $19/month.
We only read public information — DNS records, the certificate, and your homepage’s headers. Nothing is changed.
What that buys you
Six things that stop going wrong.
Email that lands in the inbox
SPF, DKIM and DMARC set right meets the Google, Yahoo and Microsoft bulk-sender rules — and shuts out anyone sending as you.
No certificate surprises
Warnings 30, 14, 7 and 1 day before a certificate expires — long before a browser shows your customers an error page.
You hear it first
Daily rescans catch a changed record, a blocklist listing, a dropped grade — before it costs you leads or uptime.
Fixes, not homework
Every failing check ships the exact DNS record or header with your domain already in it. No consultant, no jargon.
Proof you can forward
A share link, a branded PDF, one grade the whole team understands — whether that team is your developer or your client.
Silence you can trust
No alert means nothing changed. Never a daily digest of green ticks — that guarantee is written into how alerts work.
What we grade
Five things that are invisible until they fail.
Mail landing in spam, a certificate quietly expiring, a subdomain nobody remembers — each one is public information, and each one is checked in a single scan.
- 9 checks
Email
Whether someone can send mail that looks like it came from you.
SPFDKIMDMARC p=none - 8 checks
Certificate & HTTPS
Whether visitors reach you over a valid, modern encrypted connection.
- 7 checks
Security headers
Instructions your pages send that browsers enforce for free.
- 5 checks
DNS hygiene
Whether your domain's plumbing is redundant, signed and tidy.
- 5 checks
Reputation
Whether public blocklists or certificate logs have flagged your domain.
Every check has its own explainer: what we look at, why it matters, and the change that fixes it.
All 34 checks
The fix, not just the finding
Every failing check comes with the record to paste.
Not “configure DMARC” — the actual DNS record, with your domain already in it, and a plain-language line on why it matters. Copy it into your DNS panel and scan again.
DMARC policy is set to “none”
Needs attentionA policy of none only reports on spoofed mail; it doesn’t stop any. Moving to quarantine tells receiving servers to put forged messages in spam.
Paste this
_dmarc.northwind-traders.com. TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc@northwind-traders.com; pct=100"
How it works
Grade it, fix it, then stop thinking about it.
- 1
Grade
Type a domain. Twenty seconds later you have a letter, a score out of 100, and every check that decided it — no signup, nothing installed.
- 2
Fix
Each failing check comes with the exact DNS record or header to paste, with your domain already filled in. Paste it, scan again, watch the grade move.
- 3
Watch
On a paid plan we rescan every day and email you only when something actually changes. An unchanged domain never sends a single alert.
Acme DigitalMonthly report
Security report
northwind-traders.com
B
Solid, with a few things worth tightening.
84 of 100
- Email78
- Certificate96
- Headers71
- DNS100
Prepared by Acme Digital · hello@acmedigital.example
For agencies and MSPs
The report your clients see carries your name, not ours.
Your logo and colour on every report, a PDF scheduled to each client every month, and a prospect’s domain graded before the first call. From signing up to a branded, client-ready PDF is about ten minutes.
- White-label PDF reports with your logo, accent and footer
- Scheduled monthly client reports, sent from your address
- 20 prospect scans a month, 50 monitored domains, 5 seats
What we don’t do.
A scan reads what your domain already publishes to the world. That is the whole method, and these are its limits.
- No port scans, no service fingerprinting
- No login attempts, no forms submitted
- One request to your homepage, identified as our bot
- Remove your domain from the public index any time
And hold us to our own standard — grade domaingrade.io yourself. Our build pipeline fails if this site scores below an A.
Monitoring
Then we keep watching.
From $19 a month we rescan every day and email you only when something actually changes. An unchanged domain never sends a single alert, and you can cancel any time.
- A record edited or a grade that moved — one email, the day it happens
- A blocklist listing, the moment your domain appears on it
- A certificate about to expire — warned 30, 14, 7 and 1 day out
BSample data
northwind-traders.com
Rescanned daily · last scan 06:00 UTC
Last 30 days
30 days agoToday
- CriticalDMARC policy dropped to p=noneTue 07:14
- WarningCertificate expires in 14 daysMon 08:00
- RecoveredSPF record is valid againFri 16:42
Sample data — history for your domain starts the day you monitor it.
- Is scanning a domain safe — and legal?
- Yes. Everything we read is information a domain already publishes to anyone who asks: its DNS records, the certificate its server presents, and the headers its homepage returns. We make one request to the homepage and never try to log in, submit a form or scan ports.
- How is this different from MXToolbox or an SSL checker?
- Those show you one record at a time and leave the reading to you. DomainGrade runs 34 checks across five areas, turns them into one grade with published weights, and gives you the fix for each one — then keeps watching, which a lookup tool never does.
- What does “DMARC p=none” mean?
- Your domain asks receiving mail servers to report on forged mail but not to do anything about it. It is the most common thing we find, and the fix is a one-line change to a DNS record — the report shows you exactly which.
- Is my report public?
- A report is reachable by anyone with its link, but it is kept out of search engines: every report page carries a noindex instruction and the reports path is disallowed in our robots.txt.
- Can I remove my domain?
- Yes. Prove you control it with one DNS record or one file on your server and its public report is removed. Monitoring and alerts on your own account keep working.
See where you stand.
About twenty seconds. No signup, nothing installed, nothing changed.
Grade my domain