FULL DOMAIN SCAN

Run every tool at once

One target, one report. Quick mode runs 17 fast checks across every category; Deep mode runs all 58, including active checks like a port scan and zone-transfer test.

threatkestrel / full-scan idle
—
Risk score /100
—
Grade
—
Subdomains found
—
Open ports

Findings

No findings at this severity.

Compared to previous scan

Recent scans

What the scan checks

Quick mode runs 17 fast checks across every category below; deep mode runs all 58, including active checks like a port scan and zone-transfer test. Each category links through to its own dedicated tool if you only need one answer.

Email Security

DMARC Checker — Stops anyone sending fake email as your domain.

SPF Checker — Declares which servers may send mail for you.

Web Security

SSL/TLS Checker — An expired certificate breaks trust instantly.

Security Headers Check — Browser-level protection against XSS and clickjacking.

Blacklist

IP Blacklist Check — Explains why your mail is landing in spam.

Domain

Domain Expiry Checker — Lapsed domains are re-registered within minutes.

How scoring works

Every finding has a severity. Each severity costs points off a starting score of 100; a scan with no findings at all scores 100. The grade is read straight off the resulting score — there's no separate weighting, so the numbers you see always match.

Point cost per finding

critical -15
high -8
medium -3
low -1
info -0

Grade thresholds

A 90+
B 75+
C 60+
D 40+
F below 40

FAQ

Yes. Every check quick mode and deep mode run is one of the same free tools available individually elsewhere on this site — the scan just runs several of them at once and combines the results into one report.

Quick mode (17 checks) usually finishes in under 30 seconds. Deep mode (all 58 checks, including a port scan and zone-transfer test) can take up to a couple of minutes depending on the target.

A scan result is stored only long enough to show it to you and to generate a shareable report link if you choose to create one — see the Privacy Policy for the exact retention window. Nothing is sold or shared for advertising.

The checks themselves only ever read publicly available information (DNS, WHOIS, HTTP headers, TLS certificates) the same way any browser or search engine already does. Still, only scan domains you own or are authorized to test.

No signup is required for either mode.