Our story
Every public security gap on your domain, worst first, with the fix.
I'm Johnny Mobley. I started building systems for other people in 2000, when I was 16, and I've been doing it ever since. Along the way I automated most of my own work, and the tools I built for myself became these companies. Each one runs on rules I wrote down, not on paid AI calls, which is why it can cost so little.
Most small businesses never check their own domain until something goes wrong: mail lands in spam, someone spoofs their address, or a certificate expires on a Saturday. The checks that catch these are public and well known, but they're scattered across many tools and written for specialists.
Malathor runs them all against your domain in one go: the certificate, the security headers, SPF, DMARC, DKIM and the rest of email authentication, DNSSEC, and public blocklists. Then it lists what failed, worst first, and says in plain words why it matters and what to change.
What works today
- Checks HTTPS, the redirect from http://, and whether the TLS certificate is valid, expired or about to expire
- Checks HSTS and the security headers (Content-Security-Policy, X-Frame-Options, nosniff, Referrer-Policy, Permissions-Policy) and security.txt
- Checks email authentication: SPF, the DMARC policy and its reporting address, DKIM keys, MTA-STS, TLS-RPT and BIMI
- Checks DNSSEC, CAA, the name servers and the reverse DNS of your mail servers
- Checks whether your mail servers are on four public blocklists
- Turns the results into a fix list, worst first, saying why each one matters and what to do
- Keeps a history of a domain's score so you can see it improve
What it doesn't do yet
MxToolbox still does things Malathor doesn't:
- Re-checking on a schedule and emailing you when something changes. Malathor checks when you ask.
- Talking to your mail server directly (open relay, banner, STARTTLS). A Cloudflare Worker can't open mail connections.
- Checking around 100 blocklists. Malathor checks 4.
- Testing each name server for lame delegation.
What it costs
| What you get | Price | |
|---|---|---|
| MxToolbox Delivery Center | Monitoring for 5 domains, inbox placement tests, complaint reports, outbound mail-flow monitoring and BIMI management. Their free account monitors blacklists weekly for one domain. | $129/mo |
| Malathor | Every check above, no account needed. An optional $4.00, 30-day Pro pass adds known-vulnerability findings (Shodan InternetDB) and public breach history (Have I Been Pwned) to the fix list. | Free |
MxToolbox's price is from their pricing page as of October 29, 2026. Prices change, so check theirs before you compare.
Check my domain— Johnny