Free Security Posture Score (Website + Email + DNS)
Get one A–F security grade for your domain — combining website headers, email spoofing (SPF/DMARC/DKIM) and DNS posture in a single scan. Free, from Neurobyte.
About this tool
Your security posture is the sum of many small signals attackers check first — whether your website enforces HTTPS and the right security headers, whether anyone can spoof email from your domain because SPF, DKIM and DMARC aren't enforced, and whether your DNS is misconfigured or missing DNSSEC. This free security posture score checks all three at once and blends them into a single A–F grade for your domain, so you can see where your external attack surface stands in seconds — no sign-up, no agents to install, nothing intrusive.
It runs the same non-intrusive checks our analysts run as a first pass before a deeper engagement: a live website header scan, an email-spoofing (SPF/DMARC/DKIM) check, and a DNS posture review. Each becomes its own sub-grade, then combines into an overall score you can share with a colleague or your board. A strong grade is reassuring, but it only reflects publicly observable signals — a poor grade is a reliable sign that quick, high-value hardening is available, and even a good one doesn't test the deeper application, authentication and access-control flaws that only a full VAPT (vulnerability assessment and penetration test) uncovers.
Frequently asked questions
What is a security posture score?
It's a single A–F grade summarising how well a domain is protected across three publicly observable areas: website security headers and HTTPS, email spoofing protection (SPF, DKIM and DMARC), and DNS posture (including DNSSEC). Neurobyte's free tool checks all three at once and blends them into one score with a per-area breakdown.
Is the posture check intrusive or safe to run?
It's completely non-intrusive and safe. It only reads publicly available response headers and DNS records — the same information any browser or email server already sees. It never probes, scans pages, attempts logins, or sends anything to the target beyond a normal request.
How is the overall grade calculated?
Each area is scored out of 100 and weighted — website and headers count most, then email spoofing protection, then DNS. The weighted average is mapped to a letter grade (A to F). If one area can't be checked, its weight is dropped and the remaining areas are re-balanced so the score stays fair.
Does a good posture score mean my organisation is secure?
No. The score reflects only publicly observable signals — it's an awareness indicator, not a full security assessment. Real-world risk lives in application logic, authentication, access control and business logic, which only a manual VAPT (vulnerability assessment and penetration test) can uncover. A poor score is a strong signal to act; a good score is a starting point, not a guarantee.