Security engineering field note

Audit the public controls around a domain without stitching together seven tools.

TLS, SPF, DMARC, security headers, MTA-STS, TLS reporting and DNSSEC live in different layers, but together they describe an important part of a domain's external security posture.

Why automate it

Public configuration drifts quietly.

A certificate renews incorrectly. A DMARC record never moves beyond monitoring. A migration drops HSTS. DNSSEC gets disabled at a registrar. None of these require an attacker to exist; they are operational changes that can be detected from the outside.

TLS

Validate the certificate, negotiated protocol and remaining certificate lifetime.

HTTP headers

Check HSTS, CSP, MIME sniffing protection, clickjacking controls, referrer policy and permissions policy.

SPF

Confirm there is exactly one SPF policy rather than a missing or conflicting configuration.

DMARC

Check whether the domain publishes a DMARC policy that receiving mail systems can evaluate.

Mail transport

Look for MTA-STS and TLS-RPT so transport expectations and failures can be observed.

DNSSEC

Detect DS records at the delegation as an external signal that DNSSEC is enabled.

Structured output

Turn checks into evidence your software can use.

A useful posture API should not only return a red or green light. It should expose each control, the evidence observed, how it contributed to the score, and a remediation path when a control fails.

{
  "domain": "example.com",
  "score": 84,
  "grade": "B",
  "checks": [
    {
      "name": "DMARC",
      "pass": true,
      "points": 15,
      "detail": "v=DMARC1; ..."
    },
    {
      "name": "DNSSEC",
      "pass": false,
      "points": 0,
      "remediation": "Enable DNSSEC..."
    }
  ]
}

Where it fits

Good automation is boring on purpose.

The highest-value use cases are repeatable ones: MSP client onboarding, recurring customer reviews, website launch QA, vendor screening, CI/CD checks, and portfolio monitoring. The API should be one building block in a larger review process—not a replacement for penetration testing or a compliance attestation.

Explore DomainGuard OpenAPI spec