MobCorp Bench · products tested against their category leaders
Malathor vs MXToolbox Domain Health
Tells a business owner, in plain words and worst first, every public security and email-authentication gap on their domain and exactly how to fix each one.
Score against MXToolbox Domain Health: 93 / 100 · tested 2026-10-29
The leader's features
| Feature | Malathor | Proof |
|---|---|---|
| HTTP redirects to HTTPS | Yes | recorded run, 6.1 s |
| HSTS | Yes | recorded run, 11 s |
| TLS certificate expiry | Yes | recorded run, 7.9 s |
| SPF record and quality (qualifier, 10-lookup limit, duplicates) | Yes | recorded run, 14.1 s |
| DMARC policy strength and reporting address | Yes | recorded run, 7 s |
| DKIM key discovery | Yes | recorded run, 5.8 s |
| MTA-STS | Yes | recorded run, 13.3 s |
| TLS-RPT | Yes | recorded run, 13.8 s |
| Security headers (CSP, XFO, nosniff, Referrer, Permissions) | Yes | recorded run, 15.3 s |
| security.txt | Yes | recorded run, 5.7 s |
| Worst-first fix list | Yes | recorded run, 12.8 s |
| Blacklist (DNSBL) check | Yes | recorded run, 12.6 s |
| DNSSEC on the free tier | Yes | recorded run, 14.3 s |
| CAA on the free tier | Yes | recorded run, 5.4 s |
| Reverse DNS (PTR) of mail servers | Yes | recorded run, 6 s |
| DNS server health (NS, SOA, lame delegation) | Yes | recorded run, 13.6 s |
| BIMI record | Yes | recorded run, 15.1 s |
| Scheduled re-check with alerts | Not yet | MXToolbox monitors and emails on change; Malathor checks on request |
| SMTP diagnostics (open relay, banner, STARTTLS) | Not yet | MXToolbox connects to the mail server; a Worker cannot open SMTP connections |
| Blocklist coverage (about 100 lists) | Not yet | Malathor checks 4 public lists |
Known-answer tests (7 passed)
- example.com: null MX, strict SPF, DMARC reject
- github.com: HSTS, CSP, DMARC quarantine with reports
- paypal.com: DMARC reject, SPF present
- weylandai.com: DKIM found at cf2024-1, http redirects
- expired.badssl.com: the expired certificate is caught
- example.com: revoked DKIM keys are not counted as found
- badssl.com subdomain without DMARC is flagged