denyfirst.

Porch by denyfirst

Look closer.
Know what answers.

What your infrastructure presents to the outside world: the TLS handshake and certificate, how the site is reached, and what the domain's DNS says about its mail. Each finding cites the rule behind it, and what could not be measured is said.

TLS & certificatesWeb reachMail policyDNS

How it works

Try itLive

Our domain.
A real result.

Domain

denyfirst.dev — this server

Checks

This deployment checks only the domains this project runs. To check yours, run Porch yourself.

How it works

From connection
to clarity.

Here it checks our own domain. Run it yourself for the infrastructure you are responsible for.

01 / Connect

Ask what a client asks.

Handshakes at each TLS version, one request for the front page, and the DNS records a mail server reads. Nothing is sent that a browser or a mail server would not send.

02 / Examine

Grade against a named rule set.

Each check has its own rule set, and every finding cites the standard it rests on. Where no standard sets a line, the fact is reported rather than graded.

03 / Understand

Start with what matters.

Each check leads with its verdict and its findings, with the tables and limits underneath. Your own copy lets you save every report.

Get started

Your own copy,
in three steps.

Docker on the server, Go on any machine. Nothing is fetched but this source and the standard library.

  1. Build it

    Get the source and build the service. Built elsewhere, copy porchd into the checkout on the server.

    git clone https://github.com/denyfirst/porch
cd porch
CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -trimpath -o porchd ./cmd/porchd

  2. Start it

    Give the container a data directory, then start it. Proof of control is on from the first start.

    mkdir -p porch-data && sudo chown 65534:65534 porch-data
docker compose up -d --build

  3. Open it

    It listens only on the server itself. Reach it through SSH, then open http://localhost:8080.

    ssh -L 8080:127.0.0.1:8080 you@your-server

The first check of a domain shows a DNS record to add; the checks run once it is published. A public address, a signed release and everything else are in the self-hosting guide.

For your own infrastructure

Run Porch where you work.

Self-hosted, with proof of control for every domain, and nothing sent to us.

Self-hosting guide