devtls.
Find what your TLS setup isn't telling you.
A valid certificate and a padlock hide a lot: mail ports that never encrypt, SPF records receivers quietly discard, a proxy still negotiating TLS 1.0. devtls scans your web and mail stack, reads your config, and tells you exactly what to change.
Four checks, one grade
Most scanners stop at your HTTPS port. Your mail stack and your reverse proxy are where the quiet failures live.
Web TLS
Certificate chain, expiry and trust, the full protocol matrix, cipher strength and forward secrecy, HSTS and redirects — probed on every resolved A/AAAA address, so the grade reflects your weakest IP.
Mail TLS
Submission, SMTPS, IMAP and POP3 — following your MX records. Tells you whether STARTTLS is genuinely enforced, and whether your server accepts credentials before the connection is encrypted.
Mail DNS
SPF, DKIM, DMARC, MTA-STS and TLS-RPT. SPF includes are followed recursively against the 10-lookup limit — the failure that silently makes an otherwise perfect record unusable to receivers.
Config analysis
Paste a docker-compose.yml, Traefik config, Nginx block or Caddyfile and get findings anchored to the line, each with a fix you can copy. Read as text — nothing in your config is ever fetched.
Findings you can act on
Every finding says what is wrong, why it matters, and what to paste to fix it — a DNS record with your domain already filled in, a corrected Traefik label, an Nginx block. No generic advice, no grade without a reason.
- Severity-ranked, so you know what to do first
- Config findings anchored to the exact line
- Re-scans on a schedule, with webhook alerts on a drop
- Public grade badge for your README
Enable STARTTLS on SMTP 587
mail-tls
Replace the self-signed certificate on IMAP 993
mail-tls
SPF needs 12 DNS lookups (limit 10)
mail-dns
Router "app" uses Traefik's default TLS options
config · line 11
Strengthen the DMARC policy beyond p=none
mail-dns
Start free, upgrade when it earns it
Every plan includes web TLS, mail TLS, mail DNS and config analysis. Paid tiers raise the limits and add automation.
Free
community support
- Domains
- 3
- Scans / month
- 30
- Config checks
- 10
- Auto-scan
- Weekly auto-rescan
- History
- 30-day history
- Seats
- 1
- API & webhooks
- —
- Prometheus
- —
- SSL Labs check
- —
- Priority queue
- —
Pro
email support
- Domains
- 25
- Scans / month
- 500
- Config checks
- 200
- Auto-scan
- Daily auto-rescan
- History
- 1 year history
- Seats
- 1
- API & webhooks
- Yes
- Prometheus
- Yes
- SSL Labs check
- Yes
- Priority queue
- —
Team
priority support
- Domains
- 100
- Scans / month
- 2,000
- Config checks
- 1,000
- Auto-scan
- Daily auto-rescan
- History
- Unlimited history
- Seats
- 5
- API & webhooks
- Yes
- Prometheus
- Yes
- SSL Labs check
- Yes
- Priority queue
- Yes
Founder
One-timePay once, keep it. 50 domains, 2,500 scans a month, 3 seats, unlimited history — no renewal.
Secure checkout and billing are handled on devtls.fleeq.net. Cancel any time from your billing portal.
Scan your domain in about a minute
No install, no agent, no card. Add a domain and devtls tells you where you stand — and what to change first.