How do you run a quick security recon on a domain?

Best move: make one sniff_domain call and read the security plus infrastructure layers together, instead of stitching a cert checker, a header scanner, and a DNS lookup into three separate tools.

Why it works: a domain’s security posture is externally observable. The TLS handshake, the response headers, and the DNS email-auth records all come back from an ordinary request, so one crawl correlates them with no keys and no agent loop to run.

Key takeaways

• One sniff_domain call returns the security-relevant slices together: the TLS certificate, the A-F header and TLS grades, and the SPF/DKIM/DMARC booleans.
• The header grade spans six response headers (HSTS, CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy); the TLS grade covers the certificate and protocol.
• days_remaining on the certificate flags an expiry before it turns into an outage.
• A recon reads observable posture. It is not a port scan, a CVE scan, or a penetration test.
• Keyless and stateless delivery lets an agent recon an entire domain list in a loop, with nothing carried from one call to the next.

What does one recon call return?

The security-relevant answer lives across two of the five layers, and Bassethound hands them back correlated instead of loose. From the infrastructure layer you get the TLS certificate: issuer, SANs, the expiry date, and a days_remaining countdown, plus the email-auth booleans (SPF, DKIM, DMARC present or absent) read straight from DNS TXT records. From the security layer you get the header grade, an A-F score across HSTS, CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and Permissions-Policy, and a separate TLS grade for the certificate and protocol. The top-level summary fuses those into a single security_grade so you can triage at a glance before you read the detail. Because these arrive in one dossier, you see a weak header grade next to an expiring cert next to a missing DMARC record, and you read them as one picture of the same domain. The mechanics of each piece live in their own nodes (see the header-grade and SPF/DKIM/DMARC write-ups). The point of the recon is the fused read, not the individual lookups.

Which profile do you run for a spot-check?

The fast profile is deterministic and keyless and returns in one to three seconds. That is enough for the cert-and-email pass: the TLS certificate with issuer, SANs, expiry, and days_remaining, plus the SPF, DKIM, and DMARC booleans from DNS. If you want the letter grades, run the deep profile. Deep adds the A-F header grade across the six response headers, the TLS grade for the certificate and protocol, and the follow-on probes, and it pulls Wayback first-seen history if you want to know when a control appeared. Standard sits in the middle for the rest of the dossier (AI stack, firmographics), but it does not add security signal beyond what fast already reads. So the rule is short. Reach for fast when you want an expiry countdown and an email-auth pass or fail. Reach for deep when you want the graded posture and the probes behind it. Most spot-checks start fast across a list, then rerun deep on the domains worth a closer look.

How is this different from a port scan or a pentest?

Different question, different tool. Shodan and Censys build corpora of exposed services and open ports across the internet, so they answer “what is this host running and reachable on.” That is a scanning-and-inventory problem, and they own it. Bassethound answers “what posture does this domain present on a normal web request.” It reads the TLS handshake, the response headers, and the DNS records a visitor’s browser would meet, and it grades them. It does not knock on ports, enumerate services, or probe for CVEs, and it does not authenticate into anything. That boundary is deliberate. A posture read is safe to run at volume, needs no permission, and maps to how a real client experiences the site. A vulnerability assessment is a heavier, consent-bound exercise that belongs to a scanner or a pentest team. Use Bassethound to triage hygiene across many domains fast, then hand the ones that fail to a deeper tool. The recon narrows the field; it does not replace the audit.

What can a quick recon miss?

Be honest about the edges. The recon reads what a crawl and an optional JS render can reach, so a fully server-side control or a component behind a proxy can hide from a static pass, and the dossier says where the trail stopped rather than guessing past it. Headers read from an edge (Cloudflare, Fastly, a WAF) reflect that edge, not the origin, so a graded header set can belong to the proxy in front of the app. The email-auth booleans report presence, not policy strength: a DMARC record set to p=none counts as present but enforces nothing, and the record-level detail lives in the SPF/DKIM/DMARC node. And the whole read is external. It sees no authenticated surface, no internal endpoints, no open ports, and no app-layer logic. None of that makes the recon less useful. It makes it honest. You get a fast, repeatable posture snapshot with its scope stated, and you know exactly which questions to send somewhere heavier.

How do you recon a whole list of domains fast?

A domain list is where keyless, stateless delivery matters most. Every sniff_domain call is self-contained, so an agent loops the whole list without managing sessions, tokens, or per-domain keys, and nothing carries from one request to the next. Run the fast profile across all of them first and sort on the fused security_grade and days_remaining. That surfaces the expiring certs and the F-grade headers in one pass. Then rerun the deep profile only on the domains that failed the first cut, which keeps the graded probes off the domains that already look clean. Because the tool is a remote MCP endpoint, the loop lives inside whatever agent host you already use (Claude, Cursor, ChatGPT), and the free tier’s daily limit sets a natural pace; a paid plan raises it when you need volume. The correlation matters here too: sorting a list on a single fused grade beats juggling five separate lookups per domain and reconciling them by hand. One call per domain, one grade to sort on, one rerun for the outliers.

Bassethound perspective

Security-scoring SaaS would dispute that a one-call, no-auth external read counts as recon. They would tell you the real answer needs their proprietary risk model and continuous monitoring. Two problems with that. A black-box score you cannot inspect is harder to trust than a grade shown next to the evidence that produced it, and a header grade detached from the cert, the email-auth records, and the stack it sits beside is a vanity number. That is the reason Bassethound returns them together. The header grade means more when you can see it against a cert with forty days left and a missing DMARC record, because those are the same domain’s story, not three unrelated readings. We are also clear about scope, which the scanners rarely are. This is a posture snapshot, honest about what a crawl reached and where it stopped, not a pentest wearing a scan’s clothes. Shodan and Censys answer a different question well (exposed services and ports), and you should use them for that. For “what does this domain present to a normal request, and is its hygiene sound,” one correlated call beats five loose ones.

Sources

• MDN Web Security guide: https://developer.mozilla.org/en-US/docs/Web/Security
• HTTP Strict Transport Security (RFC 6797): https://datatracker.ietf.org/doc/html/rfc6797
• DMARC (RFC 7489): https://datatracker.ietf.org/doc/html/rfc7489
• Sender Policy Framework (RFC 7208): https://datatracker.ietf.org/doc/html/rfc7208
• Mozilla SSL Configuration Generator: https://ssl-config.mozilla.org