About
What Surface is.
Surface reads the public record for a domain — its DNS, its certificate, the headers its site sends back — and grades what it finds. Everything it checks is already visible to anyone who looks: a TXT record, a TLS handshake, a response header. Surface just reads it plainly and tells you what it means.
What it checks
Five things, nothing more. Each is a question a domain answers publicly, and each has a right answer Surface can verify:
- 01Email authentication — SPF, DMARC, DKIM, MTA-STS
- 02DNS integrity — DNSSEC, CAA, nameservers
- 03The TLS certificate
- 04HTTP security headers — HSTS, CSP, framing, cookies, Permissions-Policy, CORS
- 05Files that should never be publicly reachable
What it does not do
Surface does not attack, fuzz, brute-force, or enumerate anything. It makes a handful of read-only requests to well-known, standard paths and stops. It is a posture checker, not a vulnerability scanner — it tells you what is misconfigured, not how to break in.
The grade is not an official certification. It validates only a few externally visible components and can never replace a full security audit, penetration test, or compliance assessment.
Only the latest report is kept
Surface keeps one report per domain, not a history. Re-inspecting a domain replaces its previous report outright — the old report’s link stops resolving. A domain’s stable URL (surface.darinor.com/d/yourdomain.com) always reflects whatever was most recently found; keep a copy yourself if you need a permanent record of a specific inspection.