SSL/TLS & Security Tools
Grade a site's SSL/TLS setup, generate a CSR and private key for a new certificate, decode an existing certificate, and check HSTS preload eligibility.
Check whether a mail server's IP address is on DNS blacklists, find dangling CNAMEs that allow subdomain takeover, and publish a security.txt so researchers can report issues to you.
7 free security tools
- SSL/TLS CheckerCertificate chain, expiry, protocol and an A+ to F grade
- CSR & Key GeneratorGenerate a CSR and private key to buy an SSL certificate
- Blacklist CheckerDNSBL reputation lookup
- Subdomain TakeoverDangling CNAME detection
- security.txt GeneratorBuild or validate an RFC 9116 security.txt
- Certificate DecoderRead a PEM X.509 certificate's details
- HSTS Preload CheckerCheck HSTS header against preload-list requirements
Guides: Web & Mail Servers
- Postfix as a Relay, with MiltersConfiguring Postfix to relay for internal networks or through a smarthost with SASL auth, restriction stages (client/helo/sender/recipient/data), and wiring OpenDKIM/OpenDMARC/SpamAssassin as milters.
- Postfix postscreen and Pre-Queue Spam DefenseHow postscreen filters connections before smtpd, the deny/pass list, DNSBL weighting, deep protocol tests (pipelining, non-SMTP, bare newline), greylisting effect, and tuning to avoid false positives.
- Dovecot IMAP BasicsDovecot's role in a mail stack, Maildir vs mdbox, authentication and userdb/passdb, the LMTP hand-off from Postfix, SSL, and debugging login and delivery with doveadm.
- unbound as a Recursive ResolverRunning unbound for a LAN or a single host: DNSSEC validation, caching, access control, forwarding vs full recursion, local zones and overrides, DoT upstream, and prefetching.
- OCSP Stapling and Modern TLS ConfigA current TLS server config for Nginx and Apache: protocols and ciphers, OCSP stapling, session resumption, HSTS, OCSP must-staple, and testing with testssl.sh and the checker.
- HAProxy BasicsThe frontend/backend model, L4 vs L7 mode, balance algorithms, health checks, sticky sessions, ACL-based routing, TLS termination, and reading the stats page and logs.
Checking a whole domain? The Super Scanner runs every DNS, email, website and security check at once and gives one score.