Domain Health by Modern Mustard Seed

Domain Health checks any domain the way a mail server, a browser and a registry do, and explains what it finds in plain words. Email: MX, SPF expanded through every include and counted against the 10-lookup limit, DMARC policy, alignment and report permissions, DKIM keys at common selectors or ones you name, BIMI, MTA-STS, TLS-RPT, and the DNS requirements Google, Yahoo and Microsoft set for bulk senders. Website: certificate issuer, expiry, chain and name match, accepted TLS versions, CAA, and browser security headers including HSTS, CSP and clickjacking protection. Ownership: the registry record over RDAP (registrar, expiry, transfer and other locks, danger states such as redemption or hold), nameserver consistency, and DNSSEC. Every finding carries a severity, a one-sentence fix, and the RFC or provider document behind it. Lookups that fail are reported as not measured, never guessed. Read-only, no sign-in, no model.