Check a domain's full security posture: SPF, DKIM, DMARC and MTA-STS email authentication, TLS certificate and protocol support, and HTTP security headers. Use this whenever asked whether a domain is configured securely, whether it can be spoofed, or to review a domain's email or web security. Returns live results from public DNS records and TLS handshakes.

Inspect a domain's TLS configuration in detail: certificate validity and expiry, issuer, key strength, the full certificate chain including whether intermediates are missing, and which TLS protocol versions the server actually accepts. Use this for certificate problems, expiry checks, "which TLS versions are enabled", PCI DSS protocol questions, or when a site works in browsers but fails in curl or other clients.

Analyse a domain's SPF record: resolve the full include tree, count DNS lookups against the RFC 7208 limit of 10, identify which services are authorised to send mail, and flag misconfigurations such as multiple SPF records or a permissive +all. Use this for SPF PermError, "too many DNS lookups", or to find out which providers can send mail as a domain.