Check a host's TLS setup and judge it PASS/WARN/FAIL with fixes.

Reports the leaf certificate (subject, SAN, issuer, validity, days left, key and signature algorithms), the chain actually served, whether the name matches, whether the chain validates against the system trust store (distinguishing expired, self-signed, incomplete chain and untrusted root), which of TLS 1.0/1.1/1.2/1.3 the server offers, and the negotiated cipher. Expiry under 30 days is a WARN, under 14 days a FAIL. host is a name or IP (no scheme); use port for non-443 TLS services (e.g. 465, 993). OCSP stapling cannot be observed from Python's ssl module, so only the responder URL is reported.

Look up DNS records with TTLs, following the CNAME chain.

types is a comma-separated list from A, AAAA, CNAME, MX, TXT, NS, CAA, SOA, SRV, PTR. resolver is 'system' (this machine's configured DNS), 'cloudflare' (1.1.1.1), 'google' (8.8.8.8), 'quad9', or an IP address (optionally ip:port) to ask a specific server, which is how you compare what different resolvers see. The result says NXDOMAIN (the name does not exist) separately from NODATA (the name exists but has no record of that type).

Follow a URL through its redirects and time every hop.

For each hop: status, DNS/connect/TLS/time-to-first-byte/total milliseconds. Then judges the final response: status, redirect problems (loops, >3 hops, HTTPS->HTTP downgrade, no HTTPS), compression, caching headers, and HSTS. Sends no cookies or credentials; reads at most 1 MiB of body; follows at most 10 redirects; gives up after 30 seconds. url may omit the scheme (https assumed).

Grade a site's security headers (A+ to F) and give the exact header line to add for each gap.

Covers Strict-Transport-Security, Content-Security-Policy (flags unsafe-inline, unsafe-eval, wildcards), clickjacking protection (X-Frame-Options / frame-ancestors), X-Content-Type-Options, Referrer-Policy, Permissions-Policy, cookie flags (Secure/HttpOnly/SameSite), version-disclosing headers, and cross-origin isolation headers. Follows redirects and grades the final page.

Check whether specific TCP ports on one host are reachable, and grab any banner.

ports is e.g. '22,80,443' or '8000-8005' (max 20 ports per call; this is a health check, not a scanner, and CIDR ranges are refused). Each port is reported open, closed (refused) or filtered (no answer, usually a firewall). Open ports are listened to passively for a banner (SSH, SMTP, FTP announce themselves); nothing is sent. Warns when databases/RDP/telnet are open to the internet.

Audit a domain's email DNS: MX, SPF, DMARC, DKIM and MTA-STS.

MX targets must resolve and not be CNAMEs. SPF is parsed and expanded through include:/redirect= and the 10-DNS-lookup limit and 2-void-lookup limit are counted (exceeding either makes receivers return permerror). DMARC reports its policy (none/quarantine/reject), pct and rua. DKIM probes common selectors; pass your own as a comma-separated selectors (e.g. 'mail2024,s1') since selectors are arbitrary. MTA-STS and TLS-RPT presence are reported.