Tool

Domain Security Toolkit

Overview

Automated domain security auditing for 35+ checks across TLS, email authentication, HTTP headers, DNSSEC, and OSINT exposure.

Domain Security Toolkit is an open-source Python tool that audits any domain against a comprehensive set of security controls in one pass. It generates customer-ready reports with remediation guidance aligned to NIST, OWASP, NCSC, CISA, and GDPR — the kind of thing that normally takes a consultant a day to assemble manually.

Why this exists: Domain security spans email authentication, DNS security, certificates, HTTP headers, and OSINT. Most tools cover one slice. This one runs everything in a single pass and produces reports you can hand to a customer.

Installation

pip install git+https://github.com/wblv-dev/domain-security-toolkit

Python 3.10+ required.

Quick Start

# Single domain audit
domain-audit --domains example.com

# Multiple domains
domain-audit --domains example.com example.org

# From a file
domain-audit --domains-file domains.txt

Output lands in the current directory as:

Email Security

DNS & Certificate Security

Web Security

OSINT & Threat Intelligence

Cloudflare Integration

Optional integration pulls zone settings directly via the Cloudflare API:

SSL/TLSMode validation and minimum TLS version checks
HTTPSAutomatic HTTPS rewrites, HSTS, HSTS preload
SecuritySecurity level, WAF rules, Bot Management
PrivacyEmail obfuscation and hotlink protection
export CF_API_TOKEN="your_cloudflare_token"
domain-audit --domains example.com --cloudflare-token $CF_API_TOKEN

Reporting & Output

The toolkit maintains a persistent SQLite database across audit runs, enabling historical comparisons and change tracking. The diff functionality highlights what's changed between runs — useful for tracking remediation progress or catching config drift.

# Interactive dashboard of historical audits
domain-dashboard                      # port 8001 default
domain-dashboard --port 9000

Each finding includes remediation guidance with references to the relevant standard (NIST SP 800-52, OWASP, NCSC, CISA, PCI DSS, GDPR, or RFC).

Advanced Usage

--output-dirCustom output directory for reports
--formatSelect output formats: html, md, csv (default: all three)
--verboseDebug logging
--log-fileWrite detailed logs to file
--no-diffSkip comparison with previous run
--concurrencyParallel domain count (default: 20)

Exit Codes

Suitable for CI/CD integration where you want to fail the pipeline on security regressions.

Architecture

Built on Python's asyncio with aiohttp for concurrent HTTP requests and dnspython for DNS queries. Each check module is independent and returns a standardised result structure, making it straightforward to add new checks. Rate limiting via asyncio semaphores prevents overwhelming target infrastructure or API endpoints.

Standards & Compliance

Remediation guidance embedded in the toolkit references:

↗ View on GitHub