Cluster
Security Spot-Checks
Security headers, TLS, and email authentication are all readable from a domain without login or credentials. This cluster covers how to grade each one and what the results tell you, drawn from the same security layer Bassethound returns in every dossier.
5 questions about security spot-checks
- How do you check a website's security headers?
You check a website's security headers by reading the HTTP response headers of a request, then grading the six that carry the most weight.
- How do you check SPF, DKIM, and DMARC for a domain?
You check SPF, DKIM, and DMARC by reading three DNS TXT records: SPF at the domain root, DMARC at _dmarc, DKIM at selector._domainkey.
- How do you run a quick security recon on a domain?
Run one keyless sniff_domain call to read a domain's TLS certificate, A-F security-header grade, and SPF/DKIM/DMARC posture in a single dossier.
- Is a company's email domain protected against spoofing?
A domain is protected against email spoofing only when it publishes SPF and DKIM and enforces DMARC with a quarantine or reject policy.
- What is a good security header grade?
A good security header grade is an A: all six response headers set on a modern TLS config. B is common and fine. C or lower flags real gaps.
Related clusters
Frequently asked questions
Can you check a domain's security without scanning it?
Yes. Response headers, the TLS certificate, and the DNS TXT records for SPF, DKIM, and DMARC are all served publicly on request. Reading them is passive, not a scan, and touches nothing an ordinary browser or resolver would not.
Does a good header grade mean a site is secure?
No. The grade measures whether the defensive response headers (HSTS, CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy) are set correctly. It says nothing about application logic, auth flows, or unpatched services, so read it as one spot-check, not a verdict.
Sniff a domain.
Run sniff_domain on any site and read its five-layer dossier in one call.