Bastion.

Every record that decides whether your mail arrives — or gets spoofed

One domain in, one graded report out. Bastion reads registration, DNS, mail authentication and certificate records, checks each against how it should be configured, and tells you the exact record to publish when something is wrong. Built because SPF, DKIM and DMARC fail quietly: nothing breaks, mail just starts landing in spam or leaving in somebody else's name.

Read-only WHOIS / RDAP SPF · DKIM · DMARC DNSSEC TLS Scheduled re-checks

The scanner

Enter any domain. Every check is a live lookup against public records — DNS, RDAP, and one TLS handshake. Nothing is written or sent.

bastion — posture report Live

Strong posture

Mail authentication is enforcing and infrastructure records are complete.

0 passed 0 advisory 0 failed

What it inspects

Each area is graded independently, so one weak record does not hide behind a good average.

Registration

Registrar, expiry runway, registrar lock, privacy service, DNSSEC delegation.

DNS

A, AAAA, MX, NS and CAA records, name-server diversity, TTL sanity.

SPF

Syntax, the ten-lookup limit, overly broad senders, and a fatal trailing +all.

DKIM

Selector discovery, key length, and keys left published after rotation.

DMARC

Policy strength, subdomain policy, alignment mode, and whether reports go anywhere.

Transport

MTA-STS, TLS-RPT, and whether receiving servers actually negotiate TLS.

Certificates

Chain validity, days to expiry, issuer, and names the certificate does not cover.

Reputation

Sending IPs against public block lists, with the delisting route for each.

SpecificationBastion

Input	A domain name
Method	Read-only public record lookups
Grades	Per-area, plus an overall letter
Remediation	Exact record text, ready to publish
Monitoring	Scheduled re-checks, alert on change
Status	In development

Why this exists

Mail security records are the rare configuration that fails without an error.

A DMARC policy of p=none looks configured but enforces nothing.
An SPF record past ten DNS lookups is invalid — and silently ignored.
A DKIM key left published after rotation stays usable by whoever holds it.
Certificates expire on a Saturday.

Bastion checks read published records only. It sends no mail, makes no connection attempts beyond ordinary lookups, and changes nothing.

Back to Kernal Tech