What devtls does
devtls is a hosted scanner at devtls.fleeq.net. You give it the names of your servers; it connects to them, tests what they accept, and tells you — as a grade, a score and a list of fixes — how well they’re protected and what to change.
The four checks
Section titled “The four checks”| Check | What it looks at | Where to read more |
|---|---|---|
| Web TLS | TLS 1.0–1.3 (each tested separately), the negotiated cipher and forward secrecy, the certificate (trust chain, hostname, key strength, expiry) and HSTS | Web TLS grading |
| Mail servers | SMTP, submission, IMAP and POP3 on the ports you choose: certificates, protocols, ciphers, and whether STARTTLS is enforced before credentials are accepted | Mail, DNS & config rules |
| Mail DNS | SPF (including its 10-lookup limit), DKIM, DMARC, MTA-STS and TLS-RPT | Mail, DNS & config rules |
| Config review | A pasted docker-compose.yml, Traefik config, Nginx server block or Caddyfile |
Reviewing a config |
A web scan resolves the name to every IPv4 and IPv6 address and probes each one, because servers behind a CDN or a load balancer don’t always agree. The grade reflects the weakest address that answered.
From scan to grade
Section titled “From scan to grade”Each scan starts at 100 points and loses points for each problem — TLS 1.0 still enabled, HSTS missing, a certificate expiring in under two weeks. Some problems cap the score outright: an expired certificate or SSLv3 is always an F. The score then maps to a grade:
| A+ | A | B | C | D | F |
|---|---|---|---|---|---|
| 95–100 | 80–94 | 65–79 | 50–64 | 35–49 | 0–34 |
Every penalty comes with a fix: what’s wrong, how serious it is, and what to change. The rules are deterministic and published in full on Web TLS grading, so you can predict a grade before you scan.
How your account is organized
Section titled “How your account is organized”- You sign in with an email and a password, or with a one-time link sent to your email.
- Your organization owns everything else: the plan, the domains, the scans, the API keys and the webhook. Each account starts with its own organization; you can be invited into others and switch between them.
- Domains are what you scan: a web target (
host:port) or a mail target (a mail domain and the ports to probe). - Scans are kept as history for each domain, for as long as your plan retains it.
What devtls never does
Section titled “What devtls never does”- It never sends credentials to your mail server. The mail probe stops at the point a client would log in.
- It doesn’t scan private or internal addresses (
10.x,192.168.x,localhost, link-local, cloud metadata). A name that resolves to one is refused. - It doesn’t fetch anything a pasted configuration refers to: config review runs entirely on the text you paste.
- SSL Labs is only asked when you request a deep scan, and its grade is shown alongside devtls’s, never mixed into the score.