Online domain security posture check without an ownership token
Any public domain exposes its transport cipher suite, response headers, and mail anti-spoofing records to every visiting browser. This express verifier reads those public signals through a single cached request, builds ready Nginx and DNS configuration lines, and seals the result with an RFC 6986 digest.
isslab.ru or asi5.ru and run the express check immediately with zero DNS changes. Domain administrators can also expand Step 2 below to run the 12-point owner-verified inspection.Inspect Raw JSON API Response & Ledger Entry
{}1. Passive public posture inspection schematic
Single cached connection over port 443 combined with public DNS queries for SPF, DMARC, CAA, and MX records: zero exploit payloads, zero path enumeration, and strict private-subnet blocking.
2. Eight perimeter controls checked without server modifications
Engineering teams launching a web service or customer portal often leave transport and browser isolation directives incomplete behind reverse proxies. Missing Strict-Transport-Security headers permit protocol downgrade attempts on public wireless networks, while absent framing guards expose authenticated dashboards to user-interface redressing.
During the express pass, the engine establishes one direct TLS session to the resolved public address, records the negotiated protocol version and key length, calculates remaining days on the X.509 certificate, and inspects response headers for Content-Security-Policy, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy.
In parallel, the resolver queries authoritative text and certification authority records to verify whether external senders can forge mail from the company domain. When SPF or enforced DMARC policies are absent, the report generates exact zone records ready for publication at the registrar.
3. Moving from external header hygiene to internal API verification
Clean external headers protect browser sessions yet cannot prevent logic flaws inside backend handlers or autonomous tool connectors. Organizations operating high-load financial or enterprise interfaces deploy the air-gapped indra-core runner from the Autonomous Non-Profit Organization Research Institute of System Synthesis at isslab.ru alongside the MITR action gateway.
4. Engineering reference notes for verifier TOOL-DOM-01
Difference between step-1 public express check and step-2 owner verification
Step 1 reads only standard homepage headers and public DNS records cached for thirty minutes per domain, whereas Step 2 inspects auxiliary operational files such as security.txt and robots.txt after confirming administrative control.
Protection against abusive scanning of third-party servers
Every target is protected by a thirty-minute snapshot cache, per-client rate limiting, and mandatory IP validation that rejects loopback, link-local, and private network ranges.
Enterprise pilot packages and air-gapped delivery
Perimeter posture, transport security & localization
Streebog-256 verification passport.Air-gapped interface verification (indra-core)
OpenAPI schemas and an isolated staging container as input, delivering a thirty-class paired decoy assessment with zero false positives, compiled mcp-sentinel contracts, and a full ledger passport.Autonomous agent runtime gate (MITR)
mcp.json manifests and tool schemas as input, delivering compiled satisfiability policies and pre-socket parameter enforcement.Request the offline kit or schedule a pilot
--no-index --find-links) and standalone verifier scripts are provided for isolated laboratory testing and enterprise pilot evaluations. Submit a work email below without page reload or write directly to af@isslab.ai.
Institutional developer and platform operator
OGRN 1267700083617, INN 9731161602, KPP 773101001, 18 Davydkovskaya Street, Suite VIII, Moscow, 121352). Under the Security 3.0 research and engineering program, the institute develops and operates the MITR runtime action gateway and the INDRA verification stand, publishes the monograph Proven Action, and maintains open Apache-2.0 software packages with zero outside subcontractors.